October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
23,426
Critical
3,227
High
7,633
Medium
7,252
Low
684
Severity not reported
4,630
In CISA KEV
188
Most affected vendors (by CPE data where available): microsoft (1426), google (825), linux (722), ibm (323), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-111966 The User Profile Builder WordPress plugin before 4.0.5 does not sanitise and esc... |
medium | 6.8 | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-112219 The Download Monitor WordPress plugin before 5.3.5 does not correctly restrict m... |
medium | 4.9 | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-113472 The Depicter — Popup & Slider Builder WordPress plugin before 4.8.2 does not pro... |
medium | 5.4 | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-94264 The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced C... |
medium | 6.8 | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-111965 The Profile Builder WordPress plugin from 4.0.0 to 4.0.4 does not enforce its re... |
medium | 4.3 | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-94263 The Advanced Custom Fields: Extended and Advanced Custom Fields: Extended PRO Wo... |
medium | 4.8 | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-113595 Sharkord before 0.0.26 contains a missing authorization vulnerability in the oth... |
medium | 4.3 | — | — | 2026-10-20 | 2026-10-23 |
| CVE-2026-113600 Fat Free CRM before 0.26.0 contains an insecure direct object reference vulnerab... |
medium | 5.4 | — | — | 2026-10-20 | 2026-10-23 |
| CVE-2026-111683 Allegro Ralph through 20260902.1 contains a missing authorization vulnerability... |
medium | 5.4 | — | — | 2026-10-16 | 2026-10-23 |
| CVE-2026-91766 When the http:// stream wrapper follows a redirect it forwards the user-supplied... |
medium | 5.9 | — | Php / php | 2026-09-25 | 2026-10-23 |
| CVE-2026-91769 PHP's OpenSSL stream peer verification checks the certificate's subjectAltName e... |
medium | 4.3 | — | Php / php | 2026-09-25 | 2026-10-23 |
| CVE-2026-101500 Vulnerability in the Oracle Global Lifecycle Management OPatchAuto product of Or... |
medium | 6.5 | — | — | 2026-10-20 | 2026-10-23 |
| CVE-2026-96376 Improper Neutralization of Special Elements used in an OS Command ("OS Command I... |
medium | 6.4 | — | — | 2026-10-22 | 2026-10-23 |
| CVE-2026-101403 Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM (compo... |
medium | 5.9 | — | — | 2026-10-20 | 2026-10-23 |
| CVE-2026-91394 Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK product of Oracle Ja... |
medium | 5.9 | — | — | 2026-10-20 | 2026-10-23 |
| CVE-2026-91398 Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Ente... |
medium | 6.8 | — | — | 2026-10-20 | 2026-10-23 |
| CVE-2012-20004 K-news plugin for WordPress before 1.1.1 contains a reflected cross-site scripti... |
medium | 6.1 | — | — | 2026-10-20 | 2026-10-23 |
| CVE-2026-113683 VPL (Virtual Programming Lab) for Moodle before 5.0.0 contains a reflected cross... |
medium | 6.1 | — | — | 2026-10-20 | 2026-10-23 |
| CVE-2026-113649 ApostropheCMS is an open-source Node.js content management system. |
medium | 6.5 | — | — | 2026-10-20 | 2026-10-23 |
| CVE-2026-112954 ApostropheCMS is an open-source Node.js content management system. |
medium | 5.3 | — | — | 2026-10-20 | 2026-10-23 |
| CVE-2026-113601 Memos before 0.27.0 contains a missing authorization vulnerability in the Activi... |
medium | 4.3 | — | — | 2026-10-20 | 2026-10-23 |
| CVE-2026-113611 Outline before 1.8.0 contains an improper access revocation vulnerability that a... |
medium | 4.9 | — | — | 2026-10-20 | 2026-10-23 |
| CVE-2026-113507 A vulnerability was found in aaPanel up to 8.25.0. |
medium | 5.3 | — | — | 2026-10-20 | 2026-10-23 |
| CVE-2026-112949 Vitest is a Vite-native testing framework for JavaScript and TypeScript projects... |
medium | 4.7 | — | — | 2026-10-20 | 2026-10-23 |
| CVE-2026-96303 Improperly implemented security check for standard in Microsoft PowerShell allow... |
medium | 6.5 | — | Microsoft / powershell | 2026-10-13 | 2026-10-22 |
| CVE-2026-76462 A vulnerability in the interprocess communication (IPC) channel of the Secure Fi... |
medium | 5.5 | — | — | 2026-10-21 | 2026-10-22 |
| CVE-2026-96234 Origin validation error in .NET allows an unauthorized attacker to disclose info... |
medium | 5.3 | — | — | 2026-10-13 | 2026-10-22 |
| CVE-2026-96238 Origin validation error in .NET allows an unauthorized attacker to bypass a secu... |
medium | 6.5 | — | — | 2026-10-13 | 2026-10-22 |
| CVE-2026-96229 Permissive list of allowed inputs in .NET allows an unauthorized attacker to dis... |
medium | 6.5 | — | — | 2026-10-13 | 2026-10-22 |
| CVE-2026-85790 Use after free in Microsoft QUIC allows an unauthorized attacker to disclose inf... |
medium | 5.9 | — | Microsoft / windows 11 23h2 | 2026-10-13 | 2026-10-22 |
| CVE-2026-83681 Weak authentication in Microsoft PowerToys allows an authorized attacker to perf... |
medium | 5.5 | — | — | 2026-10-13 | 2026-10-22 |
| CVE-2026-70194 Improper certificate validation in .NET Framework allows an unauthorized attacke... |
medium | 6.5 | — | — | 2026-10-13 | 2026-10-22 |
| CVE-2026-70165 Improper link resolution before file access ('link following') in .NET allows an... |
medium | 6.7 | — | — | 2026-10-13 | 2026-10-22 |
| CVE-2026-70162 A denial of service vulnerability exists when Microsoft Common Object Runtime Li... |
medium | 5.9 | — | — | 2026-10-13 | 2026-10-22 |
| CVE-2026-66822 Insertion of sensitive information into sent data in .NET allows an unauthorized... |
medium | 5.9 | — | — | 2026-10-13 | 2026-10-22 |
| CVE-2026-113583 Cypht webmail 2.0.0 through 2.12.2 contains a DOM-based cross-site scripting vul... |
medium | 6.1 | — | — | 2026-10-20 | 2026-10-22 |
| CVE-2026-113354 Dockhand before 1.0.46 contains an arbitrary file read vulnerability that allows... |
medium | 6.5 | — | — | 2026-10-20 | 2026-10-22 |
| CVE-2026-113384 A flaw has been found in Optimal IdM OptimalCloud 5.0. |
medium | 4.3 | — | — | 2026-10-20 | 2026-10-22 |
| CVE-2026-113411 A vulnerability was found in Nerimity Desktop up to 2.2.2. |
medium | 6.3 | — | — | 2026-10-20 | 2026-10-22 |
| CVE-2026-113349 OpenCATS before 0.10.0 contains a missing authorization vulnerability in Calenda... |
medium | 4.3 | — | — | 2026-10-20 | 2026-10-22 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.