October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
22,258
Critical
3,140
High
7,172
Medium
6,972
Low
624
Severity not reported
4,350
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (722), google (413), ibm (322), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-39599 Contributor Broken Access Control in WDS MCP Content Manager <= 3.10.4 versions. |
medium | 4.3 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-97300 Unauthenticated Broken Access Control in WP Event Solution <= 4.1.25 versions. |
medium | 6.5 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-100518 Unauthenticated Broken Authentication in Advanced Google reCAPTCHA <= 5.40 versi... |
medium | 5.3 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-105057 Unauthenticated Bypass Vulnerability in Zero Spam <= 5.7.11 versions. |
medium | 5.3 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-105879 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-32571 Subscriber Cross Site Scripting (XSS) in Ohio Extra <= 3.6.8 versions. |
medium | 6.5 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-39727 Subscriber Cross Site Scripting (XSS) in WC Fields Factory <= 4.1.12 versions. |
medium | 6.5 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-39749 Subscriber Broken Access Control in App for Cloudflare® <= 1.10.1 versions. |
medium | 6.5 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-39754 Contributor Arbitrary File Download in Piotnet Addons For Elementor <= 7.1.71 ve... |
medium | 6.5 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-39756 Unauthenticated Insecure Direct Object References (IDOR) in Wappointment <= 2.7.... |
medium | 6.5 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-39762 Missing Authorization vulnerability in Patterns In The Cloud Autoship Cloud for... |
medium | 6.5 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-39767 Subscriber Denial of Service Attack in WPBase Cache <= 5.5.6 versions. |
medium | 6.5 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-39772 Unauthenticated Bypass Vulnerability in Captcha by BestWebSoft <= 5.2.8 versions... |
medium | 5.3 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-39787 Unauthenticated Broken Access Control in 10Web Social Photo Feed <= 1.4.35 versi... |
medium | 6.5 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-39788 Subscriber Cross Site Scripting (XSS) in Front End PM <= 11.4.6 versions. |
medium | 6.5 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-39791 Unauthenticated Sensitive Data Exposure in Mailjet Email Marketing <= 6.2.3 vers... |
medium | 5.3 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-39798 Unauthenticated Settings Change in TrueBooker <= 1.2.9 versions. |
medium | 6.5 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-42637 Unauthenticated Settings Change in PayPlug for WooCommerce (Official) <= 3.1.0 v... |
medium | 6.5 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-105645 Ghost is a Node.js content management system. |
medium | 4.9 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-105647 Ghost is a Node.js content management system. |
medium | 4.0 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-104380 Punk versions from 0.48 before 0.55 for Perl route Extended CONNECT requests to... |
medium | 5.3 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-105698 Langflow is a tool for building and deploying AI-powered agents and workflows. |
medium | 5.4 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-92030 Mitigation bypass in the DOM: Copy & Paste and Drag & Drop component. |
medium | 5.4 | — | Mozilla / firefox | 2026-09-15 | 2026-10-06 |
| CVE-2026-92031 Information disclosure in the Graphics: ImageLib component. |
medium | 6.5 | — | Mozilla / firefox | 2026-09-15 | 2026-10-06 |
| CVE-2026-96420 Toshiba file parser crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of... |
medium | 5.5 | — | Wireshark / wireshark | 2026-09-29 | 2026-10-06 |
| CVE-2026-96421 USB HID protocol dissector infinite loop and memory leak in 4.6.0 to 4.6.8 and 4... |
medium | 5.5 | — | Wireshark / wireshark | 2026-09-29 | 2026-10-06 |
| CVE-2026-92005 Use-after-free in the Audio/Video: Web Codecs component. |
medium | 5.3 | — | Mozilla / firefox | 2026-09-15 | 2026-10-06 |
| CVE-2026-96422 Frame protocol metadissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows... |
medium | 5.5 | — | Wireshark / wireshark | 2026-09-29 | 2026-10-06 |
| CVE-2026-66083 The /datasources/unauth-datasource endpoint does not properly enforce data sourc... |
medium | 6.5 | — | Apache / dolphinscheduler | 2026-09-29 | 2026-10-06 |
| CVE-2026-100817 Other issue in the JavaScript: WebAssembly component. |
medium | 5.4 | — | Mozilla / firefox | 2026-09-29 | 2026-10-06 |
| CVE-2026-87890 An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 be... |
medium | 5.3 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-87975 An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 be... |
medium | 4.3 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-105784 Joplin is an open source note-taking and to-do application that organises notes... |
medium | 4.6 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-105688 Penpot is an open-source design and prototyping platform. |
medium | 6.7 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-105693 Penpot is an open-source design and prototyping platform. |
medium | 5.3 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-105621 A security flaw has been discovered in jishenghua jshERP up to 3.5. |
medium | 5.4 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-42528 A memory calculation bug in mod_dav in Apache httpd 2.4.67 and earlier allows an... |
medium | 4.3 | — | Apache / http server | 2026-10-01 | 2026-10-06 |
| CVE-2026-94251 A vulnerability in Apache Sling Security Bundle: ContentDispositionFilter mediat... |
medium | 6.5 | — | Apache / sling security | 2026-09-23 | 2026-10-06 |
| CVE-2026-105487 A vulnerability was found in yogeshojha reNgine up to 2.2.0. |
medium | 6.3 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-105610 A vulnerability was found in chillzhuang SpringBlade up to 5.0.1. |
medium | 4.7 | — | — | 2026-10-06 | 2026-10-06 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.