October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
22,618
Critical
3,170
High
7,236
Medium
7,074
Low
640
Severity not reported
4,498
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (722), google (413), ibm (322), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-108883 JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the ed... |
medium | 6.5 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-108888 JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the Sy... |
medium | 4.3 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-108609 JeecgBoot through 3.9.5 contains an insecure direct object reference vulnerabili... |
medium | 4.3 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-108866 JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allo... |
medium | 4.3 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-108871 JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the sa... |
medium | 5.4 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-108876 JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the pu... |
medium | 4.3 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-108881 JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the ge... |
medium | 4.3 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-108886 JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the Sy... |
medium | 4.3 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-109174 MoguBlog through 6.2 contains an information disclosure vulnerability that allow... |
medium | 6.5 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-109175 MoguBlog through 6.2 contains an insecure direct object reference vulnerability... |
medium | 4.3 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-109169 LogicalDOC Community Edition through 9.3 contains a sql injection vulnerability... |
medium | 6.5 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-109170 LogicalDOC Community Edition through 9.3 contains an HQL injection vulnerability... |
medium | 6.5 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-109202 LogicalDOC Community Edition through 9.3 contains a missing authorization vulner... |
medium | 6.5 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-109203 LogicalDOC Community Edition through 9.3 contains a missing authorization vulner... |
medium | 6.5 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-109206 LogicalDOC Community Edition through 9.3 contains a username enumeration vulnera... |
medium | 5.3 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-109396 Thelia before 3.1.2 and 3.2.x before 3.2.1 contains a CSV formula injection vuln... |
medium | 4.2 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-108867 JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the Sy... |
medium | 4.3 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-108872 JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the ba... |
medium | 4.3 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-108877 JeecgBoot through 3.9.5 contains a missing authorization vulnerability in AiragP... |
medium | 5.4 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-108882 JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the Sy... |
medium | 5.4 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-108887 JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the Sy... |
medium | 4.3 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-109283 Open WebUI from 0.11.1 before 0.11.4 contains an authorization bypass in the OAu... |
medium | 5.4 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-109284 Open WebUI from 0.11.0 before 0.11.4 contains an improper authorization vulnerab... |
medium | 4.3 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-109288 Open WebUI before 0.11.4 contains a stored cross-site scripting vulnerability in... |
medium | 6.4 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-109289 Open WebUI from 0.8.8 before 0.11.4 contains an improper authorization vulnerabi... |
medium | 6.3 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-109293 Open WebUI from 0.11.0 before 0.11.4 contains an information disclosure vulnerab... |
medium | 6.5 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-109303 Parse Server before 8.6.93 and 9.0.0 before 9.10.1-alpha.13 does not enforce ide... |
medium | 4.3 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-109954 Parse Server 5.4.0 before 8.6.96 and 9.0.0 before 9.10.2-alpha.5 shares transact... |
medium | 6.5 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-74030 Wazuh from 3.9.0 before 4.14.8 contains an uncontrolled YAML alias expansion vul... |
medium | 4.9 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-104753 The Rank Math SEO WordPress plugin before 1.0.280 does not properly sanitise and... |
medium | 4.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-105976 The Portfolio Filter Gallery WordPress plugin before 2.2.1 does not perform prop... |
medium | 4.7 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-105989 The Accept PayPal Payments using Contact Form 7 WordPress plugin before 4.0.7 do... |
medium | 5.3 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-105990 The Accept PayPal Payments using Contact Form 7 WordPress plugin before 4.0.7 do... |
medium | 5.3 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-105995 The Booking Package WordPress plugin before 1.7.30 does not perform authorizatio... |
medium | 5.3 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-107120 The Contest Gallery WordPress plugin before 33.0.1 does not limit the number of... |
medium | 5.3 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-107321 The W3 Total Cache WordPress plugin before 2.10.6 does not confine a media-impor... |
medium | 5.4 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-107323 The Gallery PhotoBlocks WordPress plugin before 1.3.6 does not sanitize and esca... |
medium | 6.8 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-85571 The Tutor LMS WordPress plugin before 4.1.1 does not verify that the posts named... |
medium | 6.5 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-12980 The Post Snippets WordPress plugin through 4.2.4 does not properly escape variab... |
medium | 6.8 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-81153 The Robo Gallery WordPress plugin before 5.2.6 does not sanitise and escape some... |
medium | 6.8 | — | — | 2026-10-11 | 2026-10-13 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.