October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
23,704
Critical
3,234
High
7,703
Medium
7,358
Low
705
Severity not reported
4,704
In CISA KEV
188
Most affected vendors (by CPE data where available): microsoft (1424), google (825), linux (722), ibm (323), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-115300 The Contact Form by Supsystic WordPress plugin before 1.11.1 does not validate a... |
medium | 4.3 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-115302 The Contact Form by Supsystic WordPress plugin before 1.11.1 does not restrict a... |
medium | 5.3 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-78395 The Link Library WordPress plugin before 7.10.0 does not re-check the selected l... |
medium | 5.3 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-78396 The Link Library WordPress plugin before 7.10.0 does not verify that a requested... |
medium | 5.3 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-88928 The PAYCOMET for WooCommerce WordPress plugin before 5.46 does not verify the cr... |
medium | 6.5 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-75524 OpenReception's appointment booking software provides an end-to-end encrypted ap... |
medium | 5.4 | — | — | 2026-10-23 | 2026-10-29 |
| CVE-2026-19610 A flaw was found in the platform-mbean component of JBoss EAP, which provides ma... |
medium | 6.5 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-118030 A flaw was found in the HOTP authentication mechanism of the keycloak-services c... |
medium | 4.2 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-115877 Twisted is an event-based framework for internet applications, supporting Python... |
medium | 5.4 | — | — | 2026-10-23 | 2026-10-29 |
| CVE-2026-116010 RosarioSIS before 12.9.1 contains a missing authorization vulnerability that all... |
medium | 4.3 | — | — | 2026-10-24 | 2026-10-29 |
| CVE-2026-115774 Twisted is an event-based framework for internet applications, supporting Python... |
medium | 4.9 | — | — | 2026-10-23 | 2026-10-29 |
| CVE-2026-115802 A weakness has been identified in InternScience InternAgent 1.5.0. |
medium | 4.3 | — | — | 2026-10-24 | 2026-10-29 |
| CVE-2026-100394 Nezha Monitoring is a self-hostable, lightweight, servers and websites monitorin... |
medium | 6.5 | — | — | 2026-10-14 | 2026-10-29 |
| CVE-2026-100404 Zulip is an open-source team collaboration tool. |
medium | 6.5 | — | — | 2026-10-14 | 2026-10-29 |
| CVE-2026-118266 Echo is a Go web framework. |
medium | 5.3 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-118652 Echo is a Go web framework. |
medium | 6.1 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-118657 Echo is a Go web framework. |
medium | 5.9 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-113409 The Ortto plugin for WordPress before 1.0.25 did not escape stored settings on i... |
medium | 4.8 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-114173 The Ortto plugin for WordPress before 1.0.25 did not filter the WooCommerce prod... |
medium | 5.3 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-50539 Xibo is an open source digital signage platform with a web content management sy... |
medium | 6.5 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-50542 Xibo is an open source digital signage platform with a web content management sy... |
medium | 5.4 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-50543 Xibo is an open source digital signage platform with a web content management sy... |
medium | 4.3 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-118581 A BSON encoding component of the MongoDB Java Driver does not verify that an ext... |
medium | 6.5 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-93536 A use after free caused by missing lifecycle management of gesture sprites in Ge... |
medium | 5.3 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-106484 Insufficient policy enforcement in chrome-devtools-mcp in Google Chrome on Linux... |
medium | 4.4 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-83849 Out-of-bounds read in Windows Hello allows an authorized attacker to disclose in... |
medium | 5.5 | — | Microsoft / windows 10 21h2 | 2026-10-13 | 2026-10-29 |
| CVE-2026-118537 A vulnerability was found in a2ui up to 0.10.4. |
medium | 4.3 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-118578 A security flaw has been discovered in maotoumao MusicFreeDesktop 0.0.6/0.0.7/0.... |
medium | 4.3 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-118586 A security flaw has been discovered in dfm feedfinder2 up to 0.0.4. |
medium | 5.3 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-118590 A security vulnerability has been detected in nipy nibabel up to 5.4.2. |
medium | 5.3 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-93293 The Password Protected plugin for WordPress is vulnerable to Stored Cross-Site S... |
medium | 6.4 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-103485 The Extensions for Leaflet Map plugin for WordPress is vulnerable to Stored DOM-... |
medium | 5.4 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-103875 The Media Library Assistant plugin for WordPress is vulnerable to Reflected Cros... |
medium | 4.7 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-104727 The Sequential Order Numbers for WooCommerce plugin for WordPress is vulnerable... |
medium | 6.4 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-107627 The Greenshift – animation and page builder blocks plugin for WordPress is vulne... |
medium | 5.4 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-107629 The Greenshift – animation and page builder blocks plugin for WordPress is vulne... |
medium | 5.4 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-109215 The LiteSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site Scri... |
medium | 6.4 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-110707 The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video... |
medium | 4.7 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-111318 The HT Mega Addons for Elementor – Elementor Widgets & Template Builder plugin f... |
medium | 5.4 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-116763 The LiteSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site Scri... |
medium | 5.4 | — | — | 2026-10-29 | 2026-10-29 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.