October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
22,768
Critical
3,176
High
7,280
Medium
7,128
Low
648
Severity not reported
4,536
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1426), linux (722), google (413), ibm (323), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-111726 The Themify Builder plugin for WordPress is vulnerable to Stored Cross-Site Scri... |
medium | 6.4 | — | — | 2026-10-17 | 2026-10-19 |
| CVE-2026-92715 The Tutor LMS – eLearning and online course solution plugin for WordPress is vul... |
medium | 4.3 | — | — | 2026-10-17 | 2026-10-19 |
| CVE-2026-92978 The User Registration & Membership – Free & Paid Memberships, Subscriptions, Con... |
medium | 4.3 | — | — | 2026-10-17 | 2026-10-19 |
| CVE-2026-109983 The YMC Filter plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site... |
medium | 6.4 | — | — | 2026-10-17 | 2026-10-19 |
| CVE-2026-110253 The weForms – Easy Drag & Drop Contact Form Builder For WordPress plugin for Wor... |
medium | 5.4 | — | — | 2026-10-17 | 2026-10-19 |
| CVE-2026-110882 Missing Authorization vulnerability in Cozy Vision Technologies Pvt. |
medium | 4.3 | — | — | 2026-10-17 | 2026-10-19 |
| CVE-2026-111407 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-112107 A flaw has been found in ztxz16 fastllm up to 1.8.2. |
medium | 6.3 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-112140 A vulnerability was found in llSourcell Doctor-Dignity up to 3f2ffb6c892f13b50a7... |
medium | 6.3 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-111705 Fuint through commit 57ec018 contains an insecure direct object reference vulner... |
medium | 4.3 | — | — | 2026-10-16 | 2026-10-19 |
| CVE-2026-111670 ClickVisual through 1.1.2 contains a missing authorization vulnerability in the... |
medium | 4.3 | — | — | 2026-10-16 | 2026-10-19 |
| CVE-2026-111635 Helical Insight through 7.0.0 contains a path traversal vulnerability that allow... |
medium | 4.3 | — | — | 2026-10-16 | 2026-10-19 |
| CVE-2026-111640 DooTask through 1.9.66 contains a missing authorization vulnerability in WebSock... |
medium | 5.4 | — | — | 2026-10-16 | 2026-10-19 |
| CVE-2026-111645 MrDoc through 1.1.1 contains a missing object-level authorization vulnerability... |
medium | 5.4 | — | — | 2026-10-16 | 2026-10-19 |
| CVE-2026-111660 waynboot-mall through 2.0.0 contains a missing authentication vulnerability that... |
medium | 6.5 | — | — | 2026-10-16 | 2026-10-19 |
| CVE-2026-111665 Piranha CMS through 12.2 contains a missing authorization vulnerability in the P... |
medium | 5.4 | — | — | 2026-10-16 | 2026-10-19 |
| CVE-2026-111625 10up Distributor before 2.3.2 contains a missing authorization vulnerability in... |
medium | 5.0 | — | — | 2026-10-16 | 2026-10-19 |
| CVE-2026-111630 abp-next-admin 10.2.0 through 10.6.0 contains an insecure direct object referenc... |
medium | 5.4 | — | — | 2026-10-16 | 2026-10-19 |
| CVE-2026-59967 Tandoor Recipes is an application for managing recipes, planning meals, and buil... |
medium | 5.4 | — | — | 2026-10-16 | 2026-10-19 |
| CVE-2026-111620 O2OA through 10.0.2-ce contains an authorization bypass vulnerability in x_proce... |
medium | 5.3 | — | — | 2026-10-16 | 2026-10-19 |
| CVE-2026-111610 B3log Solo through 4.4.0 contains a missing authorization vulnerability in Artic... |
medium | 5.4 | — | — | 2026-10-16 | 2026-10-19 |
| CVE-2026-111615 Mall4cloud through 4.0 contains an insecure direct object reference vulnerabilit... |
medium | 6.5 | — | — | 2026-10-16 | 2026-10-19 |
| CVE-2026-102552 Improper verification of the source of a communication channel in the DNS resolv... |
medium | 5.9 | — | — | 2026-10-16 | 2026-10-19 |
| CVE-2026-69999 Out-of-bounds read in Windows Update allows an authorized attacker to disclose i... |
medium | 5.5 | — | Microsoft / windows 11 23h2 | 2026-10-13 | 2026-10-19 |
| CVE-2026-89069 Improper neutralization of input during web page generation ('cross-site scripti... |
medium | 5.4 | — | Progress / moveit transfer | 2026-10-14 | 2026-10-19 |
| CVE-2026-109721 Incorrect boundary conditions in the JavaScript Engine: JIT component. |
medium | 5.4 | — | — | 2026-10-13 | 2026-10-19 |
| CVE-2026-109731 Incorrect boundary conditions in the Graphics: Canvas2D component. |
medium | 5.4 | — | — | 2026-10-13 | 2026-10-19 |
| CVE-2026-98159 In the Linux kernel, the following vulnerability has been resolved:
wifi: mt76:... |
medium | 5.5 | — | Linux / linux kernel | 2026-09-25 | 2026-10-19 |
| CVE-2026-98160 In the Linux kernel, the following vulnerability has been resolved:
staging: rt... |
medium | 5.5 | — | Linux / linux kernel | 2026-09-25 | 2026-10-19 |
| CVE-2026-98152 In the Linux kernel, the following vulnerability has been resolved:
nvmet-rdma:... |
medium | 5.5 | — | Linux / linux kernel | 2026-09-25 | 2026-10-19 |
| CVE-2026-98138 In the Linux kernel, the following vulnerability has been resolved:
ntfs: do no... |
medium | 5.5 | — | Linux / linux kernel | 2026-09-25 | 2026-10-19 |
| CVE-2026-98139 In the Linux kernel, the following vulnerability has been resolved:
ntfs: only... |
medium | 5.5 | — | Linux / linux kernel | 2026-09-25 | 2026-10-19 |
| CVE-2026-98132 In the Linux kernel, the following vulnerability has been resolved:
bpf: don't... |
medium | 5.5 | — | Linux / linux kernel | 2026-09-25 | 2026-10-19 |
| CVE-2026-98133 In the Linux kernel, the following vulnerability has been resolved:
ntfs: leave... |
medium | 5.5 | — | Linux / linux kernel | 2026-09-25 | 2026-10-19 |
| CVE-2026-98135 In the Linux kernel, the following vulnerability has been resolved:
ntfs: rejec... |
medium | 5.5 | — | Linux / linux kernel | 2026-09-25 | 2026-10-19 |
| CVE-2026-98137 In the Linux kernel, the following vulnerability has been resolved:
ntfs: treat... |
medium | 5.5 | — | Linux / linux kernel | 2026-09-25 | 2026-10-19 |
| CVE-2026-98109 In the Linux kernel, the following vulnerability has been resolved:
Bluetooth:... |
medium | 4.7 | — | Linux / linux kernel | 2026-09-25 | 2026-10-19 |
| CVE-2026-98082 In the Linux kernel, the following vulnerability has been resolved:
btrfs: fix... |
medium | 5.5 | — | Linux / linux kernel | 2026-09-25 | 2026-10-19 |
| CVE-2026-98078 In the Linux kernel, the following vulnerability has been resolved:
ipvs: fix r... |
medium | 4.4 | — | Linux / linux kernel | 2026-09-25 | 2026-10-19 |
| CVE-2026-98080 In the Linux kernel, the following vulnerability has been resolved:
btrfs: do n... |
medium | 5.5 | — | Linux / linux kernel | 2026-09-25 | 2026-10-19 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.