October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
23,693
Critical
3,236
High
7,699
Medium
7,354
Low
705
Severity not reported
4,699
In CISA KEV
188
Most affected vendors (by CPE data where available): microsoft (1426), google (825), linux (722), ibm (323), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-101752 Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (compon... |
medium | 4.4 | — | Oracle / mysql cluster | 2026-10-20 | 2026-10-28 |
| CVE-2026-101753 Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (compon... |
medium | 4.4 | — | Oracle / mysql cluster | 2026-10-20 | 2026-10-28 |
| CVE-2026-101754 Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (compon... |
medium | 4.4 | — | Oracle / mysql cluster | 2026-10-20 | 2026-10-28 |
| CVE-2026-91359 Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM... |
medium | 5.3 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-91360 Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM... |
medium | 6.5 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-91362 Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM... |
medium | 5.3 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-91351 Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middl... |
medium | 6.1 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-91356 Vulnerability in the PeopleSoft Enterprise HCM Global Payroll Switzerland produc... |
medium | 4.2 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-91336 Vulnerability in the Oracle Solaris product of Oracle Systems (component: Utilit... |
medium | 6.5 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-91329 Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards... |
medium | 6.5 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-83500 Url redirection to untrusted site ('open redirect') in Windows BitLocker allows... |
medium | 6.1 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-115281 The Recipe Card Blocks Lite WordPress plugin before 3.6.4 does not sanitize and... |
medium | 6.8 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-114491 pdfmake 0.3.8 before 0.3.12 fails to apply the setLocalAccessPolicy() restrictio... |
medium | 5.3 | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2026-115224 The Customer Engagement System WordPress plugin before 2.0.2 does not safely bui... |
medium | 4.1 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-115225 The Customer Engagement System WordPress plugin before 2.0.2 does not restrict a... |
medium | 5.8 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-115255 The WP Roster WordPress plugin before 2.35 does not perform any capability or no... |
medium | 5.3 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-115223 The Smart Popup by Supsystic WordPress plugin before 2.0.2 does not prevent temp... |
medium | 4.9 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-114121 Electron is a framework for writing cross-platform desktop applications using Ja... |
medium | 5.4 | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2026-114129 stream-json is a micro-library of stream components for processing JSON and JSON... |
medium | 6.2 | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2026-114133 Nuxt is an open-source web development framework for Vue.js. |
medium | 5.4 | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2026-114265 A weakness has been identified in ProjectWorlds Advanced Library Management Syst... |
medium | 6.3 | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2026-113486 The Media Library Assistant WordPress plugin before 3.42 does not verify a CSRF... |
medium | 6.5 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-113487 The GeoDirectory WordPress plugin before 2.8.196 does not properly sanitise or e... |
medium | 6.8 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-113488 The GeoDirectory WordPress plugin before 2.8.196 does not properly escape a post... |
medium | 6.8 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-113813 The PayPlug for WooCommerce (Official) WordPress plugin before 3.1.1 does not pe... |
medium | 6.5 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-111960 The Royal MCP WordPress plugin before 1.5.10 does not perform object-level or po... |
medium | 4.3 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-111967 The MP3 Audio Player WordPress plugin before 5.16 does not escape one of its aud... |
medium | 6.8 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-113485 The Media Library Assistant WordPress plugin before 3.42 does not consistently v... |
medium | 6.5 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-111027 The Welcart e-Commerce WordPress plugin before 2.12.6 does not properly sanitise... |
medium | 6.8 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-111031 The Welcart e-Commerce WordPress plugin before 2.12.6 does not validate a user-s... |
medium | 4.7 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-110509 The Essential Addons for Elementor WordPress plugin before 6.8.7 does not restri... |
medium | 5.3 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-110524 The Copy Anything to Clipboard for WordPress WordPress plugin before 5.5.5 does... |
medium | 6.8 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-110691 The WPOrLogin WordPress plugin before 3.1.0 does not perform a capability check... |
medium | 6.5 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-110508 The Essential Addons for Elementor WordPress plugin before 6.8.7 does not apply... |
medium | 5.3 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-107097 The Royal Addons for Elementor WordPress plugin before 1.7.1070 does not perform... |
medium | 5.3 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-107098 The Royal Addons for Elementor WordPress plugin before 1.7.1070 does not sanitis... |
medium | 6.8 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-107100 The Royal Addons for Elementor WordPress plugin before 1.7.1070 does not verify... |
medium | 5.3 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-110292 The PayPlug for WooCommerce (Official) WordPress plugin before 3.1.1 does not ve... |
medium | 6.5 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-110506 The Page Builder by SiteOrigin WordPress plugin before 2.38.0 does not sanitize... |
medium | 6.8 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-105997 The Booking Package WordPress plugin before 1.7.33 does not restrict who can tri... |
medium | 5.3 | — | — | 2026-10-28 | 2026-10-28 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.