October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
22,423
Critical
3,147
High
7,191
Medium
7,024
Low
633
Severity not reported
4,428
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (722), google (413), ibm (322), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-18132 IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remot... |
medium | 6.5 | — | Ibm / financial transaction manager | 2026-09-22 | 2026-10-07 |
| CVE-2026-18133 IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remot... |
medium | 6.5 | — | Ibm / financial transaction manager | 2026-09-22 | 2026-10-07 |
| CVE-2026-5132 Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.... |
medium | 6.5 | — | Mattermost / mattermost server | 2026-09-14 | 2026-10-07 |
| CVE-2026-106232 UI misrepresentation in Browser in Google Chrome prior to 155.0.8059.39 allowed... |
medium | 5.4 | — | Google / chrome | 2026-10-06 | 2026-10-07 |
| CVE-2026-81164 Missing Authorization vulnerability in Drupal Entity PDF allows Forceful Browsin... |
medium | 5.4 | — | Entity Pdf Project / entity pdf | 2026-09-02 | 2026-10-07 |
| CVE-2026-107168 A flaw was found in m17n-lib. |
medium | 6.2 | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-105139 Obot 0.26.0 before 0.26.2 contains an authorization bypass vulnerability that al... |
medium | 4.3 | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-102258 Post-authentication Stored Cross-Site Scripting (XSS) vulnerability has been ide... |
medium | 6.1 | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-58834 In setPermissionGrantState of DevicePolicyManagerService.java, there is a possib... |
medium | 5.5 | — | Google / android | 2026-10-05 | 2026-10-07 |
| CVE-2026-106236 UI misrepresentation in Chromoting in Google Chrome on on Windows prior to 155.0... |
medium | 5.4 | — | Google / chrome | 2026-10-06 | 2026-10-07 |
| CVE-2026-55265 In multiple functions of PduParser.java, there is a possible out of bounds read... |
medium | 6.5 | — | Google / android | 2026-10-05 | 2026-10-07 |
| CVE-2026-75036 A security vulnerability was discovered in Fleet's Helm template preprocessing w... |
medium | 4.3 | — | Suse / rancher fleet | 2026-09-03 | 2026-10-07 |
| CVE-2026-102144 A resource exhaustion vulnerability in Kiteworks Email Protection Gateway allowe... |
medium | 5.3 | — | Accellion / kiteworks | 2026-09-30 | 2026-10-07 |
| CVE-2026-102139 An authorization check in the large file exchange feature of Kiteworks Email Pro... |
medium | 6.5 | — | Accellion / kiteworks | 2026-09-30 | 2026-10-07 |
| CVE-2026-103323 The Integration for Epos Now and WooCommerce WordPress plugin before 4.11.2 does... |
medium | 5.9 | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-103378 The Geliver Akıllı Kargo Pazaryeri WordPress plugin before 3.1.1 does not preven... |
medium | 6.5 | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-103681 The Frontend Dashboard WordPress plugin before 3.0.0 does not perform a capabili... |
medium | 4.3 | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-104049 The Academy LMS WordPress plugin before 4.0.0 does not verify course enrollment... |
medium | 4.3 | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-104050 The Academy LMS WordPress plugin before 4.0.0 does not verify that a quiz questi... |
medium | 4.3 | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-104651 The Yaad Sarig Payment Gateway For WC WordPress plugin before 2.2.13 does not ve... |
medium | 4.3 | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-104652 The Envira Gallery WordPress plugin before 1.16.1 does not sanitise and escape a... |
medium | 6.8 | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-104653 The Envira Gallery WordPress plugin before 1.16.1 does not sanitise or escape us... |
medium | 6.8 | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-104667 The Animated Number Counters WordPress plugin before 3.1 does not sanitise or es... |
medium | 6.8 | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-104953 The MPG WordPress plugin before 4.2.3 does not properly validate the structure o... |
medium | 6.8 | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-105322 The Magee Shortcodes WordPress plugin through 2.1.1 does not restrict the recipi... |
medium | 5.3 | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-86816 The WPCafe WordPress plugin before 3.0.21 does not restrict access to some of it... |
medium | 5.3 | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-86833 The MetForm WordPress plugin before 4.3.1 does not sanitize or escape submitted... |
medium | 5.4 | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-96530 The Optimole WordPress plugin before 4.2.15 does not perform a capability check... |
medium | 6.5 | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-97331 The User Private Files WordPress plugin before 2.1.9 does not validate that a su... |
medium | 4.3 | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-97354 The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.17.11 doe... |
medium | 4.1 | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-90996 A flaw was found in sssd. |
medium | 5.5 | — | Fedoraproject / sssd | 2026-09-14 | 2026-10-07 |
| CVE-2026-57173 vLLM is an inference and serving engine for large language models. |
medium | 6.5 | — | Vllm / vllm | 2026-09-16 | 2026-10-07 |
| CVE-2026-69147 vLLM is an inference and serving engine for large language models. |
medium | 6.5 | — | Vllm / vllm | 2026-09-16 | 2026-10-07 |
| CVE-2026-102134 Kiteworks Core did not apply its gateway-level API security controls to every re... |
medium | 5.4 | — | Accellion / kiteworks | 2026-09-30 | 2026-10-07 |
| CVE-2026-102122 Kiteworks did not correctly enforce which roles a shared folder's manager was pe... |
medium | 4.3 | — | Accellion / kiteworks | 2026-09-30 | 2026-10-07 |
| CVE-2026-106444 Handlebars provides the power necessary to let users build semantic templates. |
medium | 4.7 | — | — | 2026-10-06 | 2026-10-07 |
| CVE-2026-106452 yawkat LZ4 Java provides LZ4 compression for Java. |
medium | 5.3 | — | — | 2026-10-06 | 2026-10-07 |
| CVE-2026-102111 Kiteworks did not enforce the maximum permitted value for a configurable securit... |
medium | 4.9 | — | Accellion / kiteworks | 2026-09-30 | 2026-10-07 |
| CVE-2026-102107 Kiteworks Core contains a business logic flaw in a Kiteworks file-request featur... |
medium | 4.6 | — | Accellion / kiteworks | 2026-09-30 | 2026-10-07 |
| CVE-2026-106260 Incorrect authorization in DevTools in Google Chrome prior to 155.0.8059.39 allo... |
medium | 4.3 | — | Google / chrome | 2026-10-06 | 2026-10-07 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.