October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
23,478
Critical
3,229
High
7,648
Medium
7,275
Low
690
Severity not reported
4,636
In CISA KEV
188
Most affected vendors (by CPE data where available): microsoft (1426), google (825), linux (722), ibm (323), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-97353 The News Kit Addons For Elementor WordPress plugin through 1.4.7 does not perfor... |
medium | 5.4 | — | — | 2026-10-24 | 2026-10-26 |
| CVE-2026-110285 The WP Stripe Checkout WordPress plugin before 1.2.2.62 does not verify the Stri... |
medium | 5.3 | — | — | 2026-10-25 | 2026-10-26 |
| CVE-2026-111976 The GiveWP WordPress plugin before 4.19.0.1 does not perform any status or capab... |
medium | 5.3 | — | — | 2026-10-25 | 2026-10-26 |
| CVE-2026-111978 The GiveWP WordPress plugin before 4.19.0.1 does not properly validate a user-su... |
medium | 6.0 | — | — | 2026-10-25 | 2026-10-26 |
| CVE-2026-111979 The GiveWP WordPress plugin before 4.19.0.1 does not properly sanitise and escap... |
medium | 6.8 | — | — | 2026-10-25 | 2026-10-26 |
| CVE-2026-111980 The GiveWP WordPress plugin before 4.19.0.1 does not correctly determine which p... |
medium | 5.5 | — | — | 2026-10-25 | 2026-10-26 |
| CVE-2026-114740 The WPVR WordPress plugin before 9.1.3 does not correctly check user capabilitie... |
medium | 4.9 | — | — | 2026-10-25 | 2026-10-26 |
| CVE-2026-103298 The CCAvenue Payment Gateway for WooCommerce WordPress plugin through 3.1 does n... |
medium | 5.3 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-103306 The Online Payments with iK Pay Gateway WordPress plugin before 3.0.4 does not p... |
medium | 5.3 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-103319 The OPay Payment Gateway for WooCommerce WordPress plugin through 2.5.5 does not... |
medium | 5.3 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-103381 The Mintpay for WooCommerce WordPress plugin through 2.2.3 does not verify the a... |
medium | 6.5 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-116152 ImageMagick before 7.1.2-33 contains a memory leak vulnerability in the MAT deco... |
medium | 5.3 | — | — | 2026-10-25 | 2026-10-26 |
| CVE-2026-83925 Use of uninitialized resource in Windows Kernel allows an authorized attacker to... |
medium | 4.7 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-26 |
| CVE-2026-83926 Improper certificate validation in Windows Hello allows an authorized attacker t... |
medium | 4.4 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-26 |
| CVE-2026-110892 Missing Authorization vulnerability in Brainstorm Force SureDash suredash allows... |
medium | 6.5 | — | — | 2026-10-24 | 2026-10-26 |
| CVE-2026-114190 Insertion of Sensitive Information Into Sent Data vulnerability in Hai Zheng / L... |
medium | 5.9 | — | — | 2026-10-24 | 2026-10-26 |
| CVE-2026-114693 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-24 | 2026-10-26 |
| CVE-2026-114194 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-24 | 2026-10-26 |
| CVE-2026-114705 Missing Authorization vulnerability in quadlayers WP Social Feed Gallery insta-g... |
medium | 6.5 | — | — | 2026-10-24 | 2026-10-26 |
| CVE-2026-114192 Missing Authorization vulnerability in Magepeople inc. |
medium | 6.5 | — | — | 2026-10-24 | 2026-10-26 |
| CVE-2026-110376 Missing Authorization vulnerability in VillaTheme DEPART depart-deposit-and-part... |
medium | 4.3 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-112828 Missing Authorization vulnerability in Meow Apps AI Engine ai-engine allows Expl... |
medium | 4.3 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-110377 Missing Authorization vulnerability in VillaTheme Bopo – WooCommerce Product Bun... |
medium | 5.3 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-114709 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-115602 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-115613 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-115614 Missing Authorization vulnerability in Magepeople inc. |
medium | 5.3 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-115949 Missing Authorization vulnerability in WP Smart Widgets Better Post & Filter Wid... |
medium | 6.5 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-115958 Missing Authorization vulnerability in WP Discussion Board WP Discussion Board w... |
medium | 5.3 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-97295 Cross-Site Request Forgery (CSRF) vulnerability in David Lingren Media LIbrary A... |
medium | 4.3 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-113209 Memory corruption in Navigation in Google Chrome on on iOS prior to 156.0.8078.4... |
medium | 6.5 | — | Google / chrome | 2026-10-20 | 2026-10-26 |
| CVE-2026-113224 Memory corruption in WebAppInstalls in Google Chrome on on Android prior to 156.... |
medium | 6.5 | — | Google / chrome | 2026-10-20 | 2026-10-26 |
| CVE-2026-97254 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-97255 Authorization Bypass Through User-Controlled Key vulnerability in WProyal Royal... |
medium | 5.3 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-112865 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-7473 Arista Extensible Operating System Incomplete Comparison with Missing Factors Vu... |
medium | 5.8 | Listed | Arista / Extensible Operating System | 2026-06-05 | 2026-10-25 |
| CVE-2026-116168 SiYuan before 3.8.7 contains a path traversal vulnerability in the MCP asset too... |
medium | 6.2 | — | — | 2026-10-25 | 2026-10-25 |
| CVE-2026-86245 A vulnerability was detected in itsourcecode Sales and Inventory System 1.0. |
medium | 6.3 | — | — | 2026-09-07 | 2026-10-24 |
| CVE-2026-86265 A vulnerability has been found in itsourcecode Sales and Inventory System 1.0. |
medium | 6.3 | — | — | 2026-09-07 | 2026-10-24 |
| CVE-2026-86269 A flaw has been found in itsourcecode Sales and Inventory System 1.0. |
medium | 6.3 | — | — | 2026-09-07 | 2026-10-24 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.