October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
23,693
Critical
3,236
High
7,699
Medium
7,354
Low
705
Severity not reported
4,699
In CISA KEV
188
Most affected vendors (by CPE data where available): microsoft (1426), google (825), linux (722), ibm (323), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-106003 The Court Reservation WordPress plugin before 1.12.4 does not perform any author... |
medium | 5.3 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-106648 The Royal Elementor Addons WordPress plugin before 1.7.1070 does not validate su... |
medium | 5.3 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-103359 The PayDunya WooCommerce Payment Gateway WordPress plugin through 1.1.6 does not... |
medium | 5.3 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-103372 The Payconiq WordPress plugin through 1.0.4 does not check that a visitor is all... |
medium | 5.3 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-103382 The Casso Flow WordPress plugin before 4.2.0 does not properly authenticate inco... |
medium | 5.3 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-104694 The Thrive Automator WordPress plugin before 11.2 does not properly sanitize and... |
medium | 6.8 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-103312 The Payment Integration Wompi WordPress plugin through 4.0.1 does not verify the... |
medium | 5.3 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-103332 The Payex Payment Gateway for Woocommerce WordPress plugin through 1.2.10 does n... |
medium | 5.3 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-103331 The UniPAY Payment Gateway For WooCommerce WordPress plugin through 2.3 does not... |
medium | 5.3 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-103313 The BitPay Gateway for WooCommerce WordPress plugin through 4.1.3 does not bind... |
medium | 5.3 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-103330 The Sadad QA Payment WordPress plugin through 1.28 does not correctly verify the... |
medium | 5.3 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-83504 Time-of-check time-of-use (toctou) race condition in Windows SmartScreen allows... |
medium | 4.7 | — | Microsoft / windows 11 23h2 | 2026-10-13 | 2026-10-28 |
| CVE-2026-83507 Improper link resolution before file access ('link following') in Windows Update... |
medium | 5.5 | — | Microsoft / windows 10 21h2 | 2026-10-13 | 2026-10-28 |
| CVE-2026-81964 Use of hard-coded credentials in Windows Update Orchestrator Service allows an a... |
medium | 5.5 | — | Microsoft / windows 10 21h2 | 2026-10-13 | 2026-10-28 |
| CVE-2026-70270 Untrusted pointer dereference in Windows Container Isolation FS Filter Driver al... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-70261 Exposure of sensitive system information to an unauthorized control sphere in Mi... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-70260 Exposure of sensitive system information to an unauthorized control sphere in Mi... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-70234 Buffer over-read in Desktop Window Manager allows an authorized attacker to disc... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-70128 Out-of-bounds read in HID Parser Library allows an authorized attacker to disclo... |
medium | 5.5 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-28 |
| CVE-2026-91357 Vulnerability in the Oracle Order Management product of Oracle E-Business Suite... |
medium | 5.3 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-91210 Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middlewar... |
medium | 6.5 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-91209 Vulnerability in the Oracle Solaris product of Oracle Systems (component: X Wind... |
medium | 4.2 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-91208 Vulnerability in the Oracle Solaris product of Oracle Systems (component: Servic... |
medium | 5.1 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-90726 Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS... |
medium | 6.0 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-87399 Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middlewar... |
medium | 6.3 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-70277 Out-of-bounds read in Windows Fast FAT Driver allows an unauthorized attacker to... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-82962 ethernet_fill_header() in subsys/net/l2/ethernet/ethernet.c can prepend the Ethe... |
medium | 6.5 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-50571 WebSub is a W3C recommendation produced by the Social Web Working Group. |
medium | 5.7 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-48380 Substance3D - Painter is affected by an out-of-bounds read vulnerability that co... |
medium | 5.5 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-118376 WeKnora before 0.8.2 contains a server-side request forgery vulnerability in isR... |
medium | 5.3 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-118275 A vulnerability was found in a2ui-project a2ui up to 0.10.6. |
medium | 5.3 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-118128 A vulnerability has been found in a2aproject a2a-js up to 1.1.0. |
medium | 6.5 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-118272 A vulnerability was detected in a2ui-project a2ui up to 0.10.6. |
medium | 4.3 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-117605 nopCommerce before 5.00.0 contains a missing authorization vulnerability in the... |
medium | 4.3 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-117556 zchunk before 1.5.5 contains a heap out-of-bounds read vulnerability in read_pre... |
medium | 4.3 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-117509 A vulnerability was detected in crownpku Rasa_NLU_Chi up to 0.12.2. |
medium | 6.3 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-117505 A security flaw has been discovered in a2aproject a2a-java up to 1.2.0.Final. |
medium | 4.3 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-116774 russh is a Rust SSH client and server library that includes an SSH agent protoco... |
medium | 4.3 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-116686 The Model Context Protocol Python SDK is the official Python SDK for Model Conte... |
medium | 6.5 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-116679 Neko is a a self-hosted virtual browser that runs in Docker and uses WebRTC. |
medium | 5.4 | — | — | 2026-10-27 | 2026-10-28 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.