October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
23,743
Critical
3,236
High
7,715
Medium
7,363
Low
706
Severity not reported
4,723
In CISA KEV
188
Most affected vendors (by CPE data where available): microsoft (1424), google (825), linux (722), ibm (323), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-103758 Obot 0.21.1 through 0.24.1 contains an authorization bypass vulnerability that a... |
high | 8.1 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-103530 A vulnerability was detected in decolua 9Router up to 0.5.55. |
high | 7.3 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-103278 Ghost versions 5.8.0 before 6.34.0 contain an input validation vulnerability in... |
high | 7.3 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-103249 n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2... |
high | 7.6 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-103257 n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2... |
high | 7.7 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-101916 @grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, wi... |
high | 7.4 | — | — | 2026-09-28 | 2026-10-01 |
| CVE-2026-102278 The brace-expansion library generates arbitrary strings containing a common pref... |
high | 7.5 | — | — | 2026-09-28 | 2026-10-01 |
| CVE-2026-101073 A security flaw has been discovered in Netcore NR289-GE 1.4.5102. |
high | 8.3 | — | — | 2026-09-28 | 2026-10-01 |
| CVE-2026-101067 A vulnerability was identified in dbgate up to 6.8.1/7.0.2/7.1.8/7.2.5/7.3.1. |
high | 7.3 | — | — | 2026-09-28 | 2026-10-01 |
| CVE-2026-101009 A vulnerability was determined in aaPanel BaoTa up to 11.8.0. |
high | 8.4 | — | — | 2026-09-28 | 2026-10-01 |
| CVE-2026-101015 A flaw has been found in Trusted Domain Project OpenDMARC up to 1.4.2. |
high | 7.3 | — | — | 2026-09-28 | 2026-10-01 |
| CVE-2026-66246 iControl is affected by a Broken Access Control vulnerability, which could allow... |
high | 8.8 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-95301 Missing authorization in Extensions in Google Chrome prior to 154.0.8037.57 allo... |
high | 8.1 | — | Google / chrome | 2026-09-29 | 2026-10-01 |
| CVE-2026-103268 Ghost versions before 6.62.0 contain an authentication bypass vulnerability that... |
high | 8.8 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-103277 Ghost versions from 2.5.0 before 6.34.0 contain an untrusted script execution vu... |
high | 8.1 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-103292 Ghost versions from 0.5.3 through versions prior to 6.50.0 fail to sanitize the... |
high | 8.0 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-95344 Race condition in DevTools in Google Chrome prior to 154.0.8037.57 allowed a rem... |
high | 8.0 | — | Google / chrome | 2026-09-29 | 2026-10-01 |
| CVE-2026-102578 A flaw was found in Moodle. |
high | 8.8 | — | Moodle / moodle | 2026-09-30 | 2026-10-01 |
| CVE-2026-102379 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
high | 8.5 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-103067 Cross-Site Request Forgery (CSRF) vulnerability in Memberful Memberful - Members... |
high | 8.0 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-103338 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
high | 8.5 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-62059 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
high | 7.6 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-62060 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
high | 7.6 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-103757 Budibase through 3.41.0 contains a server-side request forgery vulnerability in... |
high | 7.7 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-103256 n8n versions before 2.39.6 and 2.40.0 before 2.40.1 contain a credentials leak v... |
high | 7.1 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-103252 n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2... |
high | 7.7 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-101012 A weakness has been identified in mathurvishal CloudClassroom-PHP-Project up to... |
high | 7.3 | — | — | 2026-09-28 | 2026-10-01 |
| CVE-2026-100891 A vulnerability has been found in Trusted Domain Project OpenDMARC up to 1.4.2. |
high | 7.3 | — | — | 2026-09-28 | 2026-10-01 |
| CVE-2026-95376 Externally controlled reference in DevTools in Google Chrome prior to 154.0.8037... |
high | 8.0 | — | Google / chrome | 2026-09-29 | 2026-10-01 |
| CVE-2026-95362 Cross-site request forgery in DevTools in Google Chrome prior to 154.0.8037.57 a... |
high | 8.8 | — | Google / chrome | 2026-09-29 | 2026-10-01 |
| CVE-2026-95365 Type confusion in IndexedDB in Google Chrome prior to 154.0.8037.57 allowed a re... |
high | 8.8 | — | Google / chrome | 2026-09-29 | 2026-10-01 |
| CVE-2026-95369 Inappropriate implementation in XML in Google Chrome prior to 154.0.8037.57 allo... |
high | 8.8 | — | Google / chrome | 2026-09-29 | 2026-10-01 |
| CVE-2026-16025 Improper validation of specified quantity in input vulnerability in PayTR Paymen... |
high | 7.5 | — | — | 2026-09-08 | 2026-10-01 |
| CVE-2026-16037 Observable timing discrepancy vulnerability in PayTR Payment and Electronic Mone... |
high | 7.5 | — | — | 2026-09-08 | 2026-10-01 |
| CVE-2026-101147 The Featured Image from URL (FIFU) WordPress plugin before 6.0.8, Featured Image... |
high | 8.8 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-19253 The Cache Enabler WordPress plugin before 1.8.17 does not validate a URL before... |
high | 8.7 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-81739 The Paytm Payment Gateway WordPress plugin before 2.8.9 does not sanitize and es... |
high | 7.5 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-81809 The Paytm Payment Gateway WordPress plugin before 2.8.9 does not properly escape... |
high | 7.5 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-89296 The Pro Like Button WordPress plugin before 2.0 does not properly sanitize and e... |
high | 8.6 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-92412 The Five Star Restaurant Reviews WordPress plugin before 2.3.14 does not properl... |
high | 7.1 | — | — | 2026-10-01 | 2026-10-01 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.