October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
22,304
Critical
3,140
High
7,177
Medium
6,986
Low
625
Severity not reported
4,376
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (722), google (413), ibm (322), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-105180 A vulnerability was determined in Jeebase 0.0.1. |
medium | 6.3 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-105181 A vulnerability was identified in itsourcecode Online Admission System 1.0. |
medium | 6.3 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-105187 A vulnerability has been found in itsourcecode Online Admission System 1.0. |
medium | 6.3 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-105225 A vulnerability was identified in osCommerce osCommerce2 up to 2.3.4.1. |
medium | 4.3 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-105233 A vulnerability has been found in kishor-23 food-waste-management-system 411989e... |
medium | 6.3 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-105248 A security flaw has been discovered in vgmstream up to r2117. |
medium | 6.3 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-105250 A security vulnerability has been detected in vgmstream up to r2117. |
medium | 4.3 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-105251 A vulnerability was detected in vgmstream up to r2117. |
medium | 6.3 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-105287 A flaw has been found in feelec-yishu feelcrm-os 1.0.0. |
medium | 6.3 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-105288 A vulnerability has been found in feelec-yishu feelcrm-os 1.0.0. |
medium | 4.3 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-105291 A vulnerability was identified in feelec-yishu feelcrm-os 1.0.0. |
medium | 4.3 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-105315 A vulnerability has been found in django-haystack up to 3.3.0. |
medium | 4.7 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-105388 A weakness has been identified in feelec-yishu feelcrm-os 1.0.0. |
medium | 6.3 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-105444 A security flaw has been discovered in dotnet eShop .NET 8. |
medium | 6.3 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-105572 A vulnerability has been found in PickMall Lilishop up to 4.2.4. |
medium | 4.3 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-105706 A weakness has been identified in SourceCodester Drug Recommendation System 1.0. |
medium | 4.3 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-105708 A flaw has been found in imgproxy up to 4.0.17. |
medium | 4.3 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-105809 A vulnerability was identified in SourceCodester Simple Student Information Syst... |
medium | 4.3 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-97308 Unauthenticated Bypass Vulnerability in Login Lockdown <= 2.17 versions. |
medium | 4.8 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-104402 Insertion of Sensitive Information Into Sent Data vulnerability in farvisun Mind... |
medium | 4.3 | — | — | 2026-10-04 | 2026-10-06 |
| CVE-2026-102393 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-102914 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-103078 Authorization Bypass Through User-Controlled Key vulnerability in Ahmad JS Help... |
medium | 4.3 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-103079 Authorization Bypass Through User-Controlled Key vulnerability in Ahmad JS Help... |
medium | 5.4 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-103084 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-103351 Improper Validation of Specified Quantity in Input vulnerability in Magepeople i... |
medium | 5.3 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-104386 Missing Authorization vulnerability in WPFunnels Team WP VR wpvr allows Exploiti... |
medium | 6.5 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-104388 Missing Authorization vulnerability in Blubrry Podcasting PowerPress Podcasting... |
medium | 5.3 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-104396 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-104397 Missing Authorization vulnerability in Jeroen Peters Name Directory name-directo... |
medium | 5.3 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-104400 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-104401 Exposure of Sensitive System Information to an Unauthorized Control Sphere vulne... |
medium | 4.3 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-104404 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-104409 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-104673 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-104675 Missing Authorization vulnerability in Liquid Web / StellarWP Event Tickets even... |
medium | 4.3 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-105055 Missing Authorization vulnerability in WP Mailster WP Mailster wp-mailster allow... |
medium | 5.3 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-105056 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-105060 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-105062 Missing Authorization vulnerability in Brandtoss WP Admin Audit wp-admin-audit a... |
medium | 4.3 | — | — | 2026-10-05 | 2026-10-06 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.