October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
22,616
Critical
3,170
High
7,236
Medium
7,072
Low
640
Severity not reported
4,498
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (722), google (413), ibm (322), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-62028 Missing Authorization vulnerability in bPlugins Before After Image Comparison –... |
medium | 5.4 | — | — | 2026-10-09 | 2026-10-11 |
| CVE-2026-107419 Missing Authorization vulnerability in Cool Plugins AI Translation for Polylang... |
medium | 5.4 | — | — | 2026-10-09 | 2026-10-11 |
| CVE-2026-106602 Authentication Bypass Using an Alternate Path or Channel vulnerability in Automa... |
medium | 4.8 | — | — | 2026-10-09 | 2026-10-11 |
| CVE-2026-94667 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-09 | 2026-10-11 |
| CVE-2026-62036 Exposure of Sensitive System Information to an Unauthorized Control Sphere vulne... |
medium | 4.3 | — | — | 2026-10-09 | 2026-10-11 |
| CVE-2026-62039 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-09 | 2026-10-11 |
| CVE-2026-42695 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-09 | 2026-10-11 |
| CVE-2026-19494 IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access... |
medium | 6.5 | — | Ibm / security verify access | 2026-10-08 | 2026-10-10 |
| CVE-2026-62128 Missing Authorization vulnerability in Creator LMS Creator LMS creatorlms allows... |
medium | 5.3 | — | — | 2026-10-08 | 2026-10-10 |
| CVE-2026-105079 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-08 | 2026-10-10 |
| CVE-2026-105891 Missing Authorization vulnerability in Liquid Web / StellarWP Event Tickets even... |
medium | 4.3 | — | — | 2026-10-08 | 2026-10-10 |
| CVE-2026-105829 League CommonMark from 1.3.0 before 2.10.2 contains a cross-site scripting vulne... |
medium | 6.1 | — | — | 2026-10-08 | 2026-10-10 |
| CVE-2026-107634 Dislocker through 0.7.3 contains a heap out-of-bounds read vulnerability in get_... |
medium | 6.1 | — | — | 2026-10-08 | 2026-10-10 |
| CVE-2026-46437 wger is a free, open-source workout and fitness manager. |
medium | 4.8 | — | — | 2026-10-07 | 2026-10-10 |
| CVE-2026-17538 The LatePoint - Appointment Booking & Reservation plugin for WordPress is vulner... |
medium | 5.4 | — | — | 2026-10-08 | 2026-10-10 |
| CVE-2026-107151 Missing authentication has been found in remote-execution task updates in the sm... |
medium | 5.9 | — | — | 2026-10-07 | 2026-10-10 |
| CVE-2026-107162 Express Gateway through 1.16.11 contains an authentication bypass vulnerability... |
medium | 6.8 | — | — | 2026-10-07 | 2026-10-10 |
| CVE-2026-107169 A flaw was found in m17n-lib. |
medium | 6.2 | — | — | 2026-10-07 | 2026-10-10 |
| CVE-2026-101886 Cisco Jabber for Android (com.cisco.im) before 15.3.1.311364 contains a path tra... |
medium | 4.0 | — | — | 2026-10-07 | 2026-10-10 |
| CVE-2026-95589 Missing Authorization vulnerability in Magepeople inc. |
medium | 6.5 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-79363 Cloudron 9.1.7 and 9.2 contain a stored cross-site scripting (XSS) vulnerability... |
medium | 5.9 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-62049 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-62042 Missing Authorization vulnerability in unFocus Projects Scripts n Styles scripts... |
medium | 5.3 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2016-20098 Moderator Toolbox (reddit-moderator-toolbox) before 4.0.14 contains a stored cro... |
medium | 5.4 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-97075 Missing Authorization vulnerability in WP Media WP Rocket wp-rocket allows Explo... |
medium | 6.5 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-96337 Missing Authorization vulnerability in properfraction ProfilePress wp-user-avata... |
medium | 6.5 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-78407 IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access... |
medium | 5.4 | — | Ibm / security verify access | 2026-10-08 | 2026-10-09 |
| CVE-2026-75597 pyLoad is a free and open-source download manager written in Python. |
medium | 5.3 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-62041 Missing Authorization vulnerability in Ashok Dudhat WP Event Manager wp-event-ma... |
medium | 5.4 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-62029 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-108124 Improper neutralization of special elements used in an SQL command ('SQL injecti... |
medium | 4.9 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-108105 Open5GS through 2.8.0 contains a reachable assertion vulnerability in mme_gn_han... |
medium | 5.9 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-107803 ProcessMaker is an open source workflow management software suite. |
medium | 6.5 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-107783 Insertion of sensitive information into log file in AWS Tools for PowerShell bef... |
medium | 5.9 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-106261 Uninitialized resource in Video in Google Chrome prior to 155.0.8059.39 allowed... |
medium | 6.5 | — | Google / chrome | 2026-10-06 | 2026-10-09 |
| CVE-2026-106280 Incorrect authorization in PermissionElement in Google Chrome prior to 155.0.805... |
medium | 6.5 | — | Google / chrome | 2026-10-06 | 2026-10-09 |
| CVE-2026-106289 Missing authorization in FedCM in Google Chrome prior to 155.0.8059.39 allowed a... |
medium | 6.5 | — | Google / chrome | 2026-10-06 | 2026-10-09 |
| CVE-2026-106389 Incorrect authorization in USB in Google Chrome prior to 155.0.8059.39 allowed a... |
medium | 6.5 | — | Google / chrome | 2026-10-06 | 2026-10-09 |
| CVE-2026-106397 Incorrect authorization in Mobile in Google Chrome on on iOS prior to 155.0.8059... |
medium | 6.1 | — | Google / chrome | 2026-10-06 | 2026-10-09 |
| CVE-2026-106422 Incorrect authorization in API in Google Chrome prior to 155.0.8059.39 allowed a... |
medium | 4.3 | — | Google / chrome | 2026-10-06 | 2026-10-09 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.