October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
22,304
Critical
3,140
High
7,177
Medium
6,986
Low
625
Severity not reported
4,376
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (722), google (413), ibm (322), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-105121 OpenAM before 16.1.3 contains an improper authorization vulnerability that allow... |
medium | 4.9 | — | — | 2026-10-03 | 2026-10-06 |
| CVE-2026-105122 OpenAM before 16.1.3 contains a server-side request forgery vulnerability that a... |
medium | 5.4 | — | — | 2026-10-03 | 2026-10-06 |
| CVE-2026-104118 The Razorpay for WooCommerce WordPress plugin before 4.8.8 does not perform owne... |
medium | 5.3 | — | — | 2026-10-04 | 2026-10-06 |
| CVE-2026-17005 The Horizontal scrolling announcements WordPress plugin through 2.6 does not san... |
medium | 6.8 | — | — | 2026-10-04 | 2026-10-06 |
| CVE-2026-86817 The Five Star Business Profile and Schema WordPress plugin before 2.4.0 does not... |
medium | 4.9 | — | — | 2026-10-04 | 2026-10-06 |
| CVE-2026-13607 The File Uploads Addon for WooCommerce WordPress plugin through 1.7.6 stores cus... |
medium | 5.9 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-78371 The File Uploads Addon for WooCommerce WordPress plugin before 1.7.6 does not ve... |
medium | 5.9 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-84169 The UPI QR Code Payment Gateway WordPress plugin through 1.4.3 does not verify t... |
medium | 5.3 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-86786 The Slider Pro WordPress plugin through 1.0.0 does not perform any capability or... |
medium | 5.3 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-89289 The Fast Courier WordPress plugin through 5.2.3 does not restrict an unauthentic... |
medium | 5.3 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-94270 The Deema Payment Gateway WordPress plugin through 1.1.2 does not verify the aut... |
medium | 5.3 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-94271 The Deema Payment Gateway WordPress plugin through 1.1.2 does not verify the pay... |
medium | 5.3 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-94278 The File Media Renamer WordPress plugin through 1.3 does not verify that the req... |
medium | 5.5 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-94299 The elegro Crypto Payment WordPress plugin through 1.0.1 does not require a shar... |
medium | 6.5 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-105789 Microsoft UFO is an open-source framework for intelligent automation across devi... |
medium | 5.4 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-92821 A flaw was found in SSSD. |
medium | 6.8 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-71297 A flaw was found in the maestro gRPC broker. |
medium | 5.4 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-77050 An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 be... |
medium | 5.3 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-84429 An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 be... |
medium | 5.3 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-105676 Ghost is a Node.js content management system. |
medium | 4.9 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-105681 Ghost is a Node.js content management system. |
medium | 6.5 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-105687 Penpot is an open-source design and prototyping platform. |
medium | 4.9 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-105692 Penpot is an open-source design and prototyping platform. |
medium | 5.4 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-105644 Ghost is a Node.js content management system. |
medium | 6.8 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-104043 A flaw was found in SSSD. |
medium | 5.5 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-104034 A flaw was found in SSSD. |
medium | 4.7 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-93474 Charging station authentication identifiers are publicly accessible via web-base... |
medium | 6.5 | — | — | 2026-10-02 | 2026-10-06 |
| CVE-2026-94594 Armatura One's message broker logs client connection credentials and the associa... |
medium | 4.0 | — | — | 2026-10-02 | 2026-10-06 |
| CVE-2026-105302 A flaw was found in the User Session Note mapper of the Keycloak identity and ac... |
medium | 5.7 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-105306 A flaw was found in the Dynamic Client Registration flow of the Keycloak identit... |
medium | 6.5 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-78412 Velociraptor's WatchEvent gRPC API can specify the OrgId of the org from which e... |
medium | 4.9 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-102295 A flaw was found in Quay. |
medium | 5.4 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-102576 A flaw was found in Quay. |
medium | 4.2 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-78411 Velociraptor's SetClientMetadata used the wrong permission check to enforce sett... |
medium | 6.5 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-78413 Velociraptor allows collection of VQL queries packaged into Artifacts from endpo... |
medium | 5.5 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-104036 A flaw was found in SSSD's NFS idmap plugin. |
medium | 5.8 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-104037 A flaw was found in SSSD. |
medium | 5.5 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-105305 A flaw was found in the OIDC implementation of Keycloak, specifically within the... |
medium | 5.4 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-100180 The Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates f... |
medium | 5.4 | — | — | 2026-10-03 | 2026-10-06 |
| CVE-2026-92243 The Ivory Search – WordPress Search Plugin plugin for WordPress is vulnerable to... |
medium | 6.1 | — | — | 2026-10-03 | 2026-10-06 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.