October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
22,675
Critical
3,172
High
7,258
Medium
7,101
Low
646
Severity not reported
4,498
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (722), google (413), ibm (322), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-107917 Insufficient input validation vulnerability in the PPPoE Setup feature of NETGEA... |
medium | 4.5 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-107918 Insufficient input validation vulnerability in the LAN Setup feature of NETGEAR... |
medium | 4.5 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-109191 The Image Hub – Free Images from Unsplash, Pixabay, Pexels, Openverse & Giphy pl... |
medium | 4.3 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-107748 The User Profile Builder – Beautiful User Registration Forms, User Profiles & Us... |
medium | 6.4 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-107646 The HUSKY – Products Filter for WooCommerce Professional plugin for WordPress is... |
medium | 5.3 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-107770 The Photo Engine (Media Organizer & Lightroom) plugin for WordPress is vulnerabl... |
medium | 6.8 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-107649 The Events Made Easy plugin for WordPress is vulnerable to Stored Cross-Site Scr... |
medium | 5.4 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-106604 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-105973 The Visual Form Builder WordPress plugin through 3.1 does not perform authorizat... |
medium | 4.3 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-105974 The Visual Form Builder WordPress plugin through 3.1 does not perform an authori... |
medium | 4.3 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-104755 The WP Compress – Instant Performance & Speed Optimization plugin for WordPress... |
medium | 4.8 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-104003 The WP User Avatar / ProfilePress plugin for WordPress is vulnerable to Arbitrar... |
medium | 5.4 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-104726 The Name Directory plugin for WordPress is vulnerable to Stored Cross-Site Scrip... |
medium | 6.4 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-103518 The FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler plugin for... |
medium | 4.9 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-103481 The Gwolle Guestbook plugin for WordPress is vulnerable to Reflected Cross-Site... |
medium | 6.1 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-103911 The The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plug... |
medium | 6.5 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-104001 The The Slim SEO – AI SEO Plugin, Lightweight, Fast & Automated plugin for WordP... |
medium | 5.4 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-103696 The Mobile builder WordPress plugin through 1.4.2 does not sanitise and escape a... |
medium | 6.8 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-100159 The Popup Box plugin for WordPress is vulnerable to Arbitrary Shortcode Executio... |
medium | 4.8 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-101335 The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin f... |
medium | 6.5 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-100158 The SQL Chart Builder plugin for WordPress is vulnerable to Stored Cross-Site Sc... |
medium | 6.4 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-100106 The FiboSearch – Ajax Search for WooCommerce plugin for WordPress is vulnerable... |
medium | 6.4 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-100108 The Social Share Buttons plugin for WordPress is vulnerable to Stored Cross-Site... |
medium | 6.4 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-106559 Backstage is an open framework for building developer portals. |
medium | 6.5 | — | Linuxfoundation / backstage\/plugin-scaffolder-backend-module-confluence-to-markdown | 2026-10-07 | 2026-10-16 |
| CVE-2026-106560 Backstage is an open framework for building developer portals. |
medium | 6.5 | — | Linuxfoundation / backstage\/plugin-scaffolder-backend-module-confluence-to-markdown | 2026-10-07 | 2026-10-16 |
| CVE-2026-106561 Backstage is an open framework for building developer portals. |
medium | 5.0 | — | Linuxfoundation / backstage\/plugin-kubernetes-backend | 2026-10-07 | 2026-10-16 |
| CVE-2026-106562 Backstage is an open framework for building developer portals. |
medium | 4.3 | — | Linuxfoundation / backstage\/plugin-search-backend | 2026-10-07 | 2026-10-16 |
| CVE-2026-110107 RuoYi-Cloud-Plus through 6.0.0 contains an insecure direct object reference vuln... |
medium | 4.2 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-110114 FJ-OMS oms-erp through PRE contains a missing authentication vulnerability that... |
medium | 6.5 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-110120 Yshopmall through 2.0.0 contains an insecure direct object reference vulnerabili... |
medium | 5.4 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-110703 The GeoDirectory – WP Business Directory Plugin and Classified Listings Director... |
medium | 6.4 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-106563 Backstage is an open framework for building developer portals. |
medium | 6.5 | — | Linuxfoundation / backstage\/plugin-kubernetes-backend | 2026-10-07 | 2026-10-16 |
| CVE-2026-9218 Insufficient input validation vulnerability in time server (NTP) setting of the... |
medium | 4.5 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-88132 Origin validation error in Azure Key Vault allows an unauthorized attacker to di... |
medium | 5.9 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-85873 Improper authorization in Skype for Business and Microsoft Lync allows an author... |
medium | 6.5 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-111386 Nezha from 1.7.0 before 2.3.15 contains an information disclosure vulnerability... |
medium | 4.3 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-108794 A security vulnerability has been detected in ZKTeco BioTime 9.5.6 Build 2026013... |
medium | 6.3 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-108795 A vulnerability was detected in ZKTeco BioTime 9.5.6 Build 20260130.3206. |
medium | 4.3 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-108796 A flaw has been found in ZKTeco BioTime 9.5.6 Build 20260130.3206. |
medium | 4.3 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-108797 A vulnerability has been found in ZKTeco BioTime 9.5.6 Build 20260130.3206. |
medium | 4.3 | — | — | 2026-10-12 | 2026-10-16 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.