October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
22,608
Critical
3,170
High
7,235
Medium
7,072
Low
640
Severity not reported
4,491
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (722), google (413), ibm (322), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-107396 Indico is an event management system that uses Flask-Multipass, a multi-backend... |
medium | 5.4 | — | — | 2026-10-08 | 2026-10-09 |
| CVE-2026-107719 fast-jwt provides fast JSON Web Token (JWT) implementation. |
medium | 4.2 | — | — | 2026-10-08 | 2026-10-09 |
| CVE-2026-107721 fast-jwt provides fast JSON Web Token (JWT) implementation. |
medium | 5.9 | — | — | 2026-10-08 | 2026-10-09 |
| CVE-2026-107299 msgpack5 is a msgpack v5 implementation for node.js and the browser. |
medium | 5.9 | — | — | 2026-10-08 | 2026-10-09 |
| CVE-2026-107380 savg-sanitizer is a PHP SVG/XML sanitizer. |
medium | 5.4 | — | — | 2026-10-08 | 2026-10-09 |
| CVE-2026-107394 Indico is an event management system that uses Flask-Multipass, a multi-backend... |
medium | 6.8 | — | — | 2026-10-08 | 2026-10-09 |
| CVE-2026-106601 Authentication Bypass Using an Alternate Path or Channel vulnerability in Automa... |
medium | 5.4 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-106384 Missing authorization in SiteIsolation in Google Chrome prior to 155.0.8059.39 a... |
medium | 6.5 | — | Google / chrome | 2026-10-06 | 2026-10-09 |
| CVE-2026-106386 Uninitialized resource in WebAudio in Google Chrome prior to 155.0.8059.39 allow... |
medium | 6.5 | — | Google / chrome | 2026-10-06 | 2026-10-09 |
| CVE-2026-106404 Incorrect authorization in FontAccess in Google Chrome prior to 155.0.8059.39 al... |
medium | 6.5 | — | Google / chrome | 2026-10-06 | 2026-10-09 |
| CVE-2026-102410 Missing Authorization (CWE-862) in Kibana can lead to information disclosure via... |
medium | 4.3 | — | Elastic / kibana | 2026-10-06 | 2026-10-09 |
| CVE-2026-102411 Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch... |
medium | 6.5 | — | Elastic / elasticsearch | 2026-10-06 | 2026-10-09 |
| CVE-2026-102412 Incorrect Authorization (CWE-863) in Kibana can lead to sensitive information di... |
medium | 6.5 | — | Elastic / kibana | 2026-10-06 | 2026-10-09 |
| CVE-2026-103005 Memory Allocation with Excessive Size Value (CWE-789) in Elasticsearch can lead... |
medium | 6.5 | — | Elastic / elasticsearch | 2026-10-06 | 2026-10-09 |
| CVE-2026-105239 Improper Neutralization of Null Byte or NUL Character vulnerability in the Event... |
medium | 5.3 | — | Apache / log4net | 2026-10-06 | 2026-10-09 |
| CVE-2026-105240 Improper Neutralization of Null Byte or NUL Character vulnerability in the Outpu... |
medium | 5.3 | — | Apache / log4net | 2026-10-06 | 2026-10-09 |
| CVE-2026-105241 Improper Handling of Unicode Encoding vulnerability in the SmtpPickupDirAppender... |
medium | 5.3 | — | Apache / log4net | 2026-10-06 | 2026-10-09 |
| CVE-2026-105242 Improper Handling of Exceptional Conditions vulnerability in the aspnet-request... |
medium | 5.3 | — | Apache / log4net | 2026-10-06 | 2026-10-09 |
| CVE-2026-105243 Insufficient Logging vulnerability in the EventLogAppender of Apache log4net. |
medium | 5.3 | — | Apache / log4net | 2026-10-06 | 2026-10-09 |
| CVE-2026-105244 Improper Encoding or Escaping of Output vulnerability in the RemoteSyslogAppende... |
medium | 5.3 | — | Apache / log4net | 2026-10-06 | 2026-10-09 |
| CVE-2026-88931 The Social Web Suite WordPress plugin through 4.1.12 does not restrict which of... |
medium | 5.3 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-92989 The SendPress Newsletters WordPress plugin through 1.26.1.20 does not check the... |
medium | 4.3 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-92990 The SendPress Newsletters WordPress plugin through 1.26.1.20 protects a logging... |
medium | 5.3 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-89235 The Testimonials by BestWebSoft WordPress plugin through 1.0.8 does not sanitise... |
medium | 6.8 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-86850 The SKU Error Fixer for WooCommerce WordPress plugin through 1.0 does not perfor... |
medium | 6.5 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-87841 The UnitechPay WordPress plugin through 1.0.6.3 does not verify the authenticity... |
medium | 5.3 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-85348 The GDPR Data Request Form WordPress plugin through 1.7.1 does not have CSRF pro... |
medium | 4.3 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-86851 The Livees Checkout WordPress plugin through 7.0.2 does not perform any capabili... |
medium | 6.5 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-87846 The Shipping for Nova Poshta WordPress plugin through 1.19.8 does not perform an... |
medium | 5.3 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-84220 The Kirki WordPress plugin before 6.3.2 does not prevent shortcodes held in comm... |
medium | 4.8 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-84224 The Kirki WordPress plugin before 6.3.2 does not validate the host of a URL it i... |
medium | 4.1 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-108102 Open5GS through 2.8.0 contains a heap out-of-bounds read vulnerability in ogs_pf... |
medium | 5.3 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-106097 The Code Snippets WordPress plugin before 3.10.0 does not sanitise and escape a... |
medium | 6.8 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-103329 The Super Payments WordPress plugin before 1.43.1 does not properly verify the a... |
medium | 5.3 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-20528 In ccci, there is a possible out of bounds write and read due to a missing bound... |
medium | 6.7 | — | Mediatek / mt2735 firmware | 2026-10-05 | 2026-10-09 |
| CVE-2026-20529 In battery, there is a possible out of bounds write due to a missing bounds chec... |
medium | 6.7 | — | Mediatek / mt6761 firmware | 2026-10-05 | 2026-10-09 |
| CVE-2026-20530 In display, there is a possible out of bounds write due to a missing bounds chec... |
medium | 6.7 | — | Mediatek / mt2718 firmware | 2026-10-05 | 2026-10-09 |
| CVE-2026-20532 In apu, there is a possible application crash due to double free. |
medium | 6.2 | — | Mediatek / mt6899 firmware | 2026-10-05 | 2026-10-09 |
| CVE-2026-20533 In display, there is a possible escalation of privilege due to an integer overfl... |
medium | 6.7 | — | Mediatek / mt6739 firmware | 2026-10-05 | 2026-10-09 |
| CVE-2026-20534 In Modem, there is a possible out of bounds read due to an incorrect bounds chec... |
medium | 5.3 | — | Mediatek / mt2716 firmware | 2026-10-05 | 2026-10-09 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.