October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
22,620
Critical
3,170
High
7,238
Medium
7,074
Low
640
Severity not reported
4,498
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (722), google (413), ibm (322), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-104643 The Easy HTTPS Redirection (SSL) WordPress plugin before 2.0.2 does not perform... |
medium | 4.2 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-106031 The Spin Wheel WordPress plugin before 2.2.1 does not verify that a visitor actu... |
medium | 6.5 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-92428 The Rede Itaú for WooCommerce WordPress plugin before 5.5.3 does not verify the... |
medium | 5.3 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-92429 The Rede Itaú for WooCommerce WordPress plugin before 5.5.3 does not verify the... |
medium | 5.3 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-110669 A security vulnerability has been detected in cemtan sar2html 4.0.0. |
medium | 6.5 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-110694 A vulnerability has been found in OAID Tengine up to 1.12.0. |
medium | 6.3 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-8145 The WholesaleX – B2B & Wholesale Plugin for WooCommerce with Wholesale Prices pl... |
medium | 5.4 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-92156 F´ (F Prime) is a framework that enables development and deployment of spaceflig... |
medium | 6.5 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-69191 FileRise is a self-hosted web-based file manager with multi-file upload, editing... |
medium | 5.4 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-110807 A weakness has been identified in sgl-project SGLang up to 0.5.19. |
medium | 4.3 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-108931 A vulnerability was found in Netcore NR268 1.7.121109. |
medium | 4.3 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-109377 ERPNext 9.0.0 through 16.50.0 contains a missing authorization vulnerability tha... |
medium | 4.3 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-108922 A flaw has been found in KusalkaSilva Learning-Management-System up to ffeb873f8... |
medium | 6.3 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-108927 A weakness has been identified in itsourcecode Baptism Information Management Sy... |
medium | 6.3 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-104105 FileRise is a self-hosted web-based file manager with multi-file upload, editing... |
medium | 6.4 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-102635 ImageMagick versions before 7.1.2-32 and 6.9.13-57 contain uninitialized heap me... |
medium | 5.3 | — | Imagemagick / imagemagick | 2026-09-29 | 2026-10-15 |
| CVE-2026-102673 Electron is a framework for writing cross-platform desktop applications using Ja... |
medium | 6.1 | — | Electronjs / electron | 2026-09-29 | 2026-10-15 |
| CVE-2026-102674 Electron is a framework for writing cross-platform desktop applications using Ja... |
medium | 6.1 | — | Electronjs / electron | 2026-09-29 | 2026-10-15 |
| CVE-2026-94254 The SellKit WordPress plugin before 2.8.0 does not validate a client-supplied pr... |
medium | 5.3 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-90989 The Tainacan WordPress plugin before 1.4.0 does not restrict its reports REST en... |
medium | 4.3 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-91076 The Robokassa payment gateway for Woocommerce WordPress plugin before 1.9.0 does... |
medium | 5.3 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-92409 The Donation Thermometer WordPress plugin before 2.3.0 does not escape a colour... |
medium | 6.8 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-92426 The YITH WooCommerce Popup WordPress plugin before 1.60.0 does not check the cap... |
medium | 4.9 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-106469 The Gutenverse Form WordPress plugin before 3.0.11 does not sanitize SVG icon ma... |
medium | 6.8 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-101215 Dell Unisphere for PowerMax vApp, version(s) 9.2.4.x, contain(s) an Improper Neu... |
medium | 6.6 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-101216 Dell Unisphere for PowerMax vApp, version(s) 9.2.4.x, contain(s) an Improper Neu... |
medium | 6.6 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-60010 Gitea's repository-side team-link API allows a repository administrator who is n... |
medium | 6.5 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-109362 Heym v0.0.5 before v0.0.113 contains a broken access control vulnerability that... |
medium | 5.4 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-109337 SurrealDB before 3.3.0 contains an authorization bypass vulnerability that allow... |
medium | 4.3 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-109342 SurrealDB from 3.0.0 before 3.3.0 contains a missing authentication vulnerabilit... |
medium | 5.4 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-109200 LogicalDOC Community Edition through 9.3 contains a server-side request forgery... |
medium | 6.4 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-101029 Gitea's repository migration and pull mirror egress checks could be bypassed wit... |
medium | 4.3 | — | Gitea / gitea | 2026-10-06 | 2026-10-15 |
| CVE-2026-103667 Gitea's container registry served blob downloads with a `Content-Type` taken fro... |
medium | 5.4 | — | Gitea / gitea | 2026-10-06 | 2026-10-15 |
| CVE-2026-33387 A template injection vulnerability was discovered in the Dashboards functionalit... |
medium | 4.6 | — | — | 2026-09-08 | 2026-10-15 |
| CVE-2026-33391 An access control vulnerability was discovered in the Smart Polling configuratio... |
medium | 5.4 | — | — | 2026-09-08 | 2026-10-15 |
| CVE-2026-106499 Backstage is an open framework for building developer portals. |
medium | 4.9 | — | Linuxfoundation / backstage\/plugin-scaffolder-backend | 2026-10-06 | 2026-10-15 |
| CVE-2024-50302 Linux Kernel Use of Uninitialized Resource Vulnerability |
medium | 5.5 | Listed | Linux / Kernel | 2024-11-19 | 2026-10-15 |
| CVE-2026-105846 Payload is a free and open source headless content management system. |
medium | 6.1 | — | Payloadcms / payload | 2026-10-06 | 2026-10-15 |
| CVE-2026-105847 Payload is a free and open source headless content management system. |
medium | 6.5 | — | Payloadcms / payload | 2026-10-06 | 2026-10-15 |
| CVE-2026-105853 Payload is a free and open source headless content management system. |
medium | 6.5 | — | Payloadcms / payload | 2026-10-06 | 2026-10-15 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.