October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
22,064
Critical
3,133
High
7,120
Medium
6,940
Low
617
Severity not reported
4,254
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (722), google (413), ibm (321), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-111793 Openwave Webtop Media Transcoder does not enforce administrator-defined file typ... |
medium | 4.3 | — | — | 2026-10-16 | 2026-10-19 |
| CVE-2026-111870 A security flaw has been discovered in itsmeravitejak Online-Examination-System... |
medium | 5.3 | — | — | 2026-10-18 | 2026-10-19 |
| CVE-2026-111942 A weakness has been identified in hrisikeshpal Blood_Bank_Management_System 1.0.... |
medium | 4.3 | — | — | 2026-10-18 | 2026-10-19 |
| CVE-2026-109131 The Hub collection module documentation renderer in the unified Ansible Automati... |
medium | 5.4 | — | — | 2026-10-15 | 2026-10-19 |
| CVE-2026-100793 JIT miscompilation in the JavaScript Engine component. |
medium | 6.5 | — | Mozilla / firefox | 2026-09-29 | 2026-10-19 |
| CVE-2026-100795 Denial-of-service in the Networking component. |
medium | 6.5 | — | Mozilla / firefox | 2026-09-29 | 2026-10-19 |
| CVE-2026-89098 A flaw was found in nfs-utils. |
medium | 5.5 | — | — | 2026-10-16 | 2026-10-19 |
| CVE-2026-85977 A flaw was found in libtirpc. |
medium | 5.3 | — | — | 2026-10-16 | 2026-10-19 |
| CVE-2026-112222 Missing Authorization vulnerability in Surfer Surfer surferseo allows Exploiting... |
medium | 5.4 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-112266 SGLang through 0.5.22 contains a denial of service vulnerability that allows API... |
medium | 5.9 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-112144 A weakness has been identified in satya-vinay Events-Management-System up to 437... |
medium | 5.3 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-111720 fish-island-backend through commit 7c61b78 contains an unauthenticated server-si... |
medium | 5.3 | — | — | 2026-10-16 | 2026-10-19 |
| CVE-2026-111890 phpMyFAQ from 4.2.0-alpha.2 before 4.2.0-beta contains a privilege escalation vu... |
medium | 5.5 | — | — | 2026-10-17 | 2026-10-19 |
| CVE-2026-111895 phpMyFAQ 3.2.0 before 4.0.0 and 4.0.2 before 4.2.0-beta contains an authenticati... |
medium | 6.8 | — | — | 2026-10-17 | 2026-10-19 |
| CVE-2026-111906 phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains a cross-site re... |
medium | 6.5 | — | — | 2026-10-17 | 2026-10-19 |
| CVE-2026-111831 Missing Authorization vulnerability in WP ManageNinja LLC FluentForm fluentform... |
medium | 5.3 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-111715 Arkon through 0.9.2 contains a missing authorization vulnerability in GET /api/w... |
medium | 4.3 | — | — | 2026-10-16 | 2026-10-19 |
| CVE-2026-111410 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-110902 Authorization Bypass Through User-Controlled Key vulnerability in Liquid Web / S... |
medium | 4.3 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-102066 A Improper Validation of Specified Quantity in Input vulnerability in the routin... |
medium | 6.5 | — | — | 2026-10-14 | 2026-10-19 |
| CVE-2026-107763 The Fastcache by Host.it plugin for WordPress is vulnerable to authorization byp... |
medium | 4.3 | — | — | 2026-10-17 | 2026-10-19 |
| CVE-2026-111601 The Hippoo Mobile App for WooCommerce plugin for WordPress is vulnerable to Refl... |
medium | 6.1 | — | — | 2026-10-17 | 2026-10-19 |
| CVE-2026-107744 The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin... |
medium | 6.5 | — | — | 2026-10-17 | 2026-10-19 |
| CVE-2026-107752 The Welcart e-Commerce plugin for WordPress is vulnerable to generic SQL Injecti... |
medium | 4.9 | — | — | 2026-10-17 | 2026-10-19 |
| CVE-2026-109368 The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to S... |
medium | 6.5 | — | — | 2026-10-17 | 2026-10-19 |
| CVE-2026-109369 The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to a... |
medium | 6.8 | — | — | 2026-10-17 | 2026-10-19 |
| CVE-2026-109985 The xSpeed Cache: AI-Powered Performance Hub with MCP, Caching & CDN plugin for... |
medium | 6.4 | — | — | 2026-10-17 | 2026-10-19 |
| CVE-2026-109989 The Themify Popup plugin for WordPress is vulnerable to Stored Cross-Site Script... |
medium | 6.4 | — | — | 2026-10-17 | 2026-10-19 |
| CVE-2026-110268 The Post Export Import with Media plugin for WordPress is vulnerable to Director... |
medium | 4.9 | — | — | 2026-10-17 | 2026-10-19 |
| CVE-2026-111726 The Themify Builder plugin for WordPress is vulnerable to Stored Cross-Site Scri... |
medium | 6.4 | — | — | 2026-10-17 | 2026-10-19 |
| CVE-2026-92715 The Tutor LMS – eLearning and online course solution plugin for WordPress is vul... |
medium | 4.3 | — | — | 2026-10-17 | 2026-10-19 |
| CVE-2026-92978 The User Registration & Membership – Free & Paid Memberships, Subscriptions, Con... |
medium | 4.3 | — | — | 2026-10-17 | 2026-10-19 |
| CVE-2026-109983 The YMC Filter plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site... |
medium | 6.4 | — | — | 2026-10-17 | 2026-10-19 |
| CVE-2026-110253 The weForms – Easy Drag & Drop Contact Form Builder For WordPress plugin for Wor... |
medium | 5.4 | — | — | 2026-10-17 | 2026-10-19 |
| CVE-2026-110882 Missing Authorization vulnerability in Cozy Vision Technologies Pvt. |
medium | 4.3 | — | — | 2026-10-17 | 2026-10-19 |
| CVE-2026-111407 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-112107 A flaw has been found in ztxz16 fastllm up to 1.8.2. |
medium | 6.3 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-112140 A vulnerability was found in llSourcell Doctor-Dignity up to 3f2ffb6c892f13b50a7... |
medium | 6.3 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-111705 Fuint through commit 57ec018 contains an insecure direct object reference vulner... |
medium | 4.3 | — | — | 2026-10-16 | 2026-10-19 |
| CVE-2026-111670 ClickVisual through 1.1.2 contains a missing authorization vulnerability in the... |
medium | 4.3 | — | — | 2026-10-16 | 2026-10-19 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.