October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
22,768
Critical
3,176
High
7,280
Medium
7,128
Low
648
Severity not reported
4,536
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1426), linux (722), google (413), ibm (323), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-111891 phpMyFAQ from 4.2.0-alpha.2 before 4.2.0-beta contains a privilege escalation vu... |
medium | 5.5 | — | — | 2026-10-17 | 2026-10-19 |
| CVE-2026-111896 phpMyFAQ from 4.2.0-alpha before 4.2.0-beta contains a stored cross-site scripti... |
medium | 5.4 | — | — | 2026-10-17 | 2026-10-19 |
| CVE-2026-111902 phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an authorization bypass vulnerab... |
medium | 5.3 | — | — | 2026-10-17 | 2026-10-19 |
| CVE-2026-111875 A vulnerability has been found in David-Crty Databasement up to 1.8.1. |
medium | 4.7 | — | — | 2026-10-18 | 2026-10-19 |
| CVE-2026-111845 Missing Authorization vulnerability in YITH YITH WooCommerce Product Bundles yit... |
medium | 5.3 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-110898 Incorrect Privilege Assignment vulnerability in WPDeveloper Essential Addons for... |
medium | 6.4 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-95184 Improper certificate validation in gnutls v3.8.13 causes the application to reje... |
medium | 5.9 | — | — | 2026-10-08 | 2026-10-19 |
| CVE-2026-95210 Improper certificate validation in gnutls v3.8.13 causes the application to acce... |
medium | 4.8 | — | — | 2026-10-08 | 2026-10-19 |
| CVE-2026-95209 An issue in gnutls v3.8.13 causes legitimate CA certificates to be rejected, lea... |
medium | 5.9 | — | — | 2026-10-08 | 2026-10-19 |
| CVE-2026-88647 A hostname verification bypass in GnuTLS v3.8.13 allows attackers to circumvent... |
medium | 6.5 | — | — | 2026-10-08 | 2026-10-19 |
| CVE-2026-46471 An issue was discovered in GStreamer gst-plugins-good before 1.28.2. |
medium | 5.5 | — | — | 2026-10-16 | 2026-10-19 |
| CVE-2026-111793 Openwave Webtop Media Transcoder does not enforce administrator-defined file typ... |
medium | 4.3 | — | — | 2026-10-16 | 2026-10-19 |
| CVE-2026-111870 A security flaw has been discovered in itsmeravitejak Online-Examination-System... |
medium | 5.3 | — | — | 2026-10-18 | 2026-10-19 |
| CVE-2026-111942 A weakness has been identified in hrisikeshpal Blood_Bank_Management_System 1.0.... |
medium | 4.3 | — | — | 2026-10-18 | 2026-10-19 |
| CVE-2026-109131 The Hub collection module documentation renderer in the unified Ansible Automati... |
medium | 5.4 | — | — | 2026-10-15 | 2026-10-19 |
| CVE-2026-100793 JIT miscompilation in the JavaScript Engine component. |
medium | 6.5 | — | Mozilla / firefox | 2026-09-29 | 2026-10-19 |
| CVE-2026-100795 Denial-of-service in the Networking component. |
medium | 6.5 | — | Mozilla / firefox | 2026-09-29 | 2026-10-19 |
| CVE-2026-89098 A flaw was found in nfs-utils. |
medium | 5.5 | — | — | 2026-10-16 | 2026-10-19 |
| CVE-2026-85977 A flaw was found in libtirpc. |
medium | 5.3 | — | — | 2026-10-16 | 2026-10-19 |
| CVE-2026-112222 Missing Authorization vulnerability in Surfer Surfer surferseo allows Exploiting... |
medium | 5.4 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-112266 SGLang through 0.5.22 contains a denial of service vulnerability that allows API... |
medium | 5.9 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-112144 A weakness has been identified in satya-vinay Events-Management-System up to 437... |
medium | 5.3 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-111720 fish-island-backend through commit 7c61b78 contains an unauthenticated server-si... |
medium | 5.3 | — | — | 2026-10-16 | 2026-10-19 |
| CVE-2026-111890 phpMyFAQ from 4.2.0-alpha.2 before 4.2.0-beta contains a privilege escalation vu... |
medium | 5.5 | — | — | 2026-10-17 | 2026-10-19 |
| CVE-2026-111895 phpMyFAQ 3.2.0 before 4.0.0 and 4.0.2 before 4.2.0-beta contains an authenticati... |
medium | 6.8 | — | — | 2026-10-17 | 2026-10-19 |
| CVE-2026-111906 phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains a cross-site re... |
medium | 6.5 | — | — | 2026-10-17 | 2026-10-19 |
| CVE-2026-111831 Missing Authorization vulnerability in WP ManageNinja LLC FluentForm fluentform... |
medium | 5.3 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-111715 Arkon through 0.9.2 contains a missing authorization vulnerability in GET /api/w... |
medium | 4.3 | — | — | 2026-10-16 | 2026-10-19 |
| CVE-2026-111410 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-110902 Authorization Bypass Through User-Controlled Key vulnerability in Liquid Web / S... |
medium | 4.3 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-102066 A Improper Validation of Specified Quantity in Input vulnerability in the routin... |
medium | 6.5 | — | — | 2026-10-14 | 2026-10-19 |
| CVE-2026-107763 The Fastcache by Host.it plugin for WordPress is vulnerable to authorization byp... |
medium | 4.3 | — | — | 2026-10-17 | 2026-10-19 |
| CVE-2026-111601 The Hippoo Mobile App for WooCommerce plugin for WordPress is vulnerable to Refl... |
medium | 6.1 | — | — | 2026-10-17 | 2026-10-19 |
| CVE-2026-107744 The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin... |
medium | 6.5 | — | — | 2026-10-17 | 2026-10-19 |
| CVE-2026-107752 The Welcart e-Commerce plugin for WordPress is vulnerable to generic SQL Injecti... |
medium | 4.9 | — | — | 2026-10-17 | 2026-10-19 |
| CVE-2026-109368 The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to S... |
medium | 6.5 | — | — | 2026-10-17 | 2026-10-19 |
| CVE-2026-109369 The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to a... |
medium | 6.8 | — | — | 2026-10-17 | 2026-10-19 |
| CVE-2026-109985 The xSpeed Cache: AI-Powered Performance Hub with MCP, Caching & CDN plugin for... |
medium | 6.4 | — | — | 2026-10-17 | 2026-10-19 |
| CVE-2026-109989 The Themify Popup plugin for WordPress is vulnerable to Stored Cross-Site Script... |
medium | 6.4 | — | — | 2026-10-17 | 2026-10-19 |
| CVE-2026-110268 The Post Export Import with Media plugin for WordPress is vulnerable to Director... |
medium | 4.9 | — | — | 2026-10-17 | 2026-10-19 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.