October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
23,316
Critical
3,226
High
7,610
Medium
7,220
Low
656
Severity not reported
4,604
In CISA KEV
188
Most affected vendors (by CPE data where available): microsoft (1426), google (825), linux (722), ibm (323), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-98128 In the Linux kernel, the following vulnerability has been resolved:
scsi: mpi3m... |
medium | 5.5 | — | Linux / linux kernel | 2026-09-25 | 2026-10-22 |
| CVE-2026-100142 The FluentCart A New Era of eCommerce WordPress plugin before 2.2.0 does not ver... |
medium | 5.3 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-103234 The WP Ultimate Review WordPress plugin before 2.4.5 does not neutralise shortco... |
medium | 4.8 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-110010 The MB Custom Post Types & Custom Taxonomies WordPress plugin before 2.12.3 does... |
medium | 4.8 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-111971 The Photo Engine (Media Organizer & Lightroom) WordPress plugin before 6.5.8 doe... |
medium | 6.8 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-111972 The Photo Engine (Media Organizer & Lightroom) WordPress plugin before 6.5.8 doe... |
medium | 4.9 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-78392 The Link Library WordPress plugin before 7.9.6 does not sanitise and escape a li... |
medium | 6.8 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-111401 Cross-Site Request Forgery (CSRF) vulnerability in Tailored Media Tailored Tools... |
medium | 6.5 | — | — | 2026-10-21 | 2026-10-22 |
| CVE-2026-111847 Missing Authorization vulnerability in Kings Plugins MarketKing marketking-multi... |
medium | 5.4 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-112826 Missing Authorization vulnerability in eLightUp Falcon – WordPress Optimizations... |
medium | 5.3 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-112843 Missing Authorization vulnerability in WP Chill Strong Testimonials strong-testi... |
medium | 4.3 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-112867 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-114175 Missing Authorization vulnerability in DigitalME eRoom eroom-zoom-meetings-webin... |
medium | 5.4 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-114180 Missing Authorization vulnerability in Wpmet Metform metform allows Exploiting I... |
medium | 5.3 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-114182 Missing Authorization vulnerability in IdeaBox Creations PowerPack Addons for El... |
medium | 4.3 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-114184 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-110893 Missing Authorization vulnerability in Brainstorm Force SureDash suredash allows... |
medium | 5.3 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-110894 Missing Authorization vulnerability in Brainstorm Force SureDash suredash allows... |
medium | 5.3 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-111842 Missing Authorization vulnerability in WP Sunshine Sunshine Photo Cart sunshine-... |
medium | 5.3 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-112218 Missing Authorization vulnerability in Ahmad Majestic Support majestic-support a... |
medium | 5.3 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-112311 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') v... |
medium | 6.5 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-112845 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-114195 Insertion of Sensitive Information into Externally-Accessible File or Directory... |
medium | 5.3 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-114696 Missing Authorization vulnerability in miniOrange Page Restriction WordPress (WP... |
medium | 5.3 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-114698 Authorization Bypass Through User-Controlled Key vulnerability in myCred myCred... |
medium | 5.4 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-114699 Missing Authorization vulnerability in yoomoney ЮKassa для WooCommerce yookassa... |
medium | 5.3 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-114700 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-114701 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-114702 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-114703 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-112842 Missing Authorization vulnerability in Cozmoslabs Paid Member Subscriptions paid... |
medium | 6.5 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-98129 In the Linux kernel, the following vulnerability has been resolved:
scsi: mpi3m... |
medium | 5.5 | — | Linux / linux kernel | 2026-09-25 | 2026-10-22 |
| CVE-2026-106489 Backstage is an open framework for building developer portals. |
medium | 6.5 | — | Linuxfoundation / backstage\/plugin-techdocs-backend | 2026-10-06 | 2026-10-22 |
| CVE-2026-106490 Backstage is an open framework for building developer portals. |
medium | 6.5 | — | Linuxfoundation / backstage\/plugin-techdocs-backend | 2026-10-06 | 2026-10-22 |
| CVE-2026-76497 As part of Cisco's ongoing commitment to proactive security and product quality,... |
medium | 6.6 | — | — | 2026-10-21 | 2026-10-22 |
| CVE-2026-76489 Multiple Cisco products are affected by a vulnerability in the memory management... |
medium | 5.8 | — | — | 2026-10-21 | 2026-10-22 |
| CVE-2026-76487 A vulnerability in Cisco Unified Communications Manager (Unified CM) and Cisco U... |
medium | 5.3 | — | — | 2026-10-21 | 2026-10-22 |
| CVE-2026-76435 A vulnerability in Cisco Expressway Series could allow an unauthenticated, remot... |
medium | 5.3 | — | — | 2026-10-21 | 2026-10-22 |
| CVE-2026-76445 Multiple Cisco products are affected by a vulnerability in the Snort 3 Detection... |
medium | 5.3 | — | — | 2026-10-21 | 2026-10-22 |
| CVE-2026-20179 Multiple Cisco products are affected by a vulnerability in the Snort 3 Generic R... |
medium | 5.8 | — | — | 2026-10-21 | 2026-10-22 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.