October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
22,224
Critical
3,140
High
7,170
Medium
6,970
Low
624
Severity not reported
4,320
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (722), google (413), ibm (322), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-100501 Flame through 2.4.0 contains an improper restriction of excessive authentication... |
medium | 6.5 | — | — | 2026-09-25 | 2026-10-05 |
| CVE-2026-103629 Integer overflow in Skia in Google Chrome prior to 154.0.8037.97 allowed a remot... |
medium | 4.3 | — | Google / chrome | 2026-10-02 | 2026-10-05 |
| CVE-2026-103621 Integer overflow in Compositing in Google Chrome prior to 154.0.8037.97 allowed... |
medium | 4.3 | — | Google / chrome | 2026-10-02 | 2026-10-05 |
| CVE-2026-103004 Next.js versions from 16.3.0 to 16.3.7 warm `use cache` handlers using `next/roo... |
medium | 5.3 | — | Vercel / next.js | 2026-10-01 | 2026-10-05 |
| CVE-2026-94486 Next.js is a React framework for building full-stack web applications. |
medium | 5.4 | — | Vercel / next.js | 2026-10-02 | 2026-10-05 |
| CVE-2026-94485 Next.js is a React framework for building full-stack web applications. |
medium | 5.3 | — | Vercel / next.js | 2026-10-02 | 2026-10-05 |
| CVE-2026-73511 Envoy is an open source edge and service proxy designed for cloud-native applica... |
medium | 5.3 | — | Envoyproxy / envoy | 2026-09-21 | 2026-10-05 |
| CVE-2026-37604 pH7Software pH7Builder (pH7 Social Dating CMS) through 18.2.0 resolves the clien... |
medium | 6.5 | — | — | 2026-09-22 | 2026-10-05 |
| CVE-2026-105263 A security flaw has been discovered in Shaarli up to 0.16.3. |
medium | 4.7 | — | — | 2026-10-05 | 2026-10-05 |
| CVE-2026-105205 SiYuan before 3.8.5 contains an information disclosure vulnerability that allows... |
medium | 5.3 | — | — | 2026-10-04 | 2026-10-05 |
| CVE-2026-50572 Envoy is an open source edge and service proxy designed for cloud-native applica... |
medium | 5.9 | — | Envoyproxy / envoy | 2026-09-21 | 2026-10-05 |
| CVE-2026-48521 Envoy is an open source edge and service proxy designed for cloud-native applica... |
medium | 5.9 | — | Envoyproxy / envoy | 2026-09-21 | 2026-10-05 |
| CVE-2026-73549 Envoy is an open source edge and service proxy designed for cloud-native applica... |
medium | 5.3 | — | Envoyproxy / envoy | 2026-09-21 | 2026-10-05 |
| CVE-2026-73551 Envoy is an open source edge and service proxy designed for cloud-native applica... |
medium | 5.3 | — | Envoyproxy / envoy | 2026-09-21 | 2026-10-05 |
| CVE-2026-103679 A flaw was found in tnef. |
medium | 6.5 | — | Tnef Project / tnef | 2026-10-01 | 2026-10-05 |
| CVE-2026-96869 Information disclosure in the Networking component. |
medium | 4.3 | — | Mozilla / firefox | 2026-09-29 | 2026-10-05 |
| CVE-2026-100783 Uninitialized memory in the Audio/Video component. |
medium | 4.3 | — | Mozilla / firefox | 2026-09-29 | 2026-10-05 |
| CVE-2026-103680 A flaw was found in tnef. |
medium | 6.5 | — | Tnef Project / tnef | 2026-10-01 | 2026-10-05 |
| CVE-2026-58415 Internal state files accessible to external parties in mod_dav_fs in Apache Soft... |
medium | 5.3 | — | Apache / http server | 2026-10-01 | 2026-10-05 |
| CVE-2026-5782 Improper neutralization of input during web page generation ('cross-site scripti... |
medium | 5.2 | — | — | 2026-10-02 | 2026-10-05 |
| CVE-2026-103489 In JetBrains YouTrack before 2026.2.19422 hTML injection in VCS command failure... |
medium | 5.4 | — | Jetbrains / youtrack | 2026-10-01 | 2026-10-05 |
| CVE-2026-81793 Missing Authorization vulnerability in Dimitri Grassi Salon booking system salon... |
medium | 6.5 | — | — | 2026-09-10 | 2026-10-05 |
| CVE-2026-104470 YesWiki before 4.6.7 contains a server-side request forgery vulnerability that a... |
medium | 5.0 | — | — | 2026-10-02 | 2026-10-04 |
| CVE-2026-100630 AVideo before 29.1.0 contains a stored cross-site scripting vulnerability in the... |
medium | 5.4 | — | — | 2026-09-26 | 2026-10-04 |
| CVE-2026-97652 The WP Statistics – Simple, privacy-friendly Google Analytics alternative plugin... |
medium | 6.1 | — | — | 2026-10-02 | 2026-10-03 |
| CVE-2026-97258 Subscriber Broken Access Control in Aruba Migration Tool <= 1.0.4 versions. |
medium | 6.5 | — | — | 2026-10-01 | 2026-10-03 |
| CVE-2026-97338 The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scr... |
medium | 6.4 | — | — | 2026-10-02 | 2026-10-03 |
| CVE-2026-96647 The Listdom: AI-powered Business Directory with Classifieds Ads Listings plugin... |
medium | 6.4 | — | — | 2026-10-02 | 2026-10-03 |
| CVE-2026-96613 The Meari IoT Cloud Platform OpenAPI Service is vulnerable to an authorization f... |
medium | 6.5 | — | — | 2026-10-02 | 2026-10-03 |
| CVE-2026-96256 The Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns pl... |
medium | 6.4 | — | — | 2026-10-01 | 2026-10-03 |
| CVE-2026-94432 The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress... |
medium | 5.3 | — | — | 2026-10-02 | 2026-10-03 |
| CVE-2026-92548 The WP Popular Posts plugin for WordPress is vulnerable to Sensitive Information... |
medium | 5.3 | — | — | 2026-10-01 | 2026-10-03 |
| CVE-2026-91109 The Simply Schedule Appointments plugin for WordPress is vulnerable to Insecure... |
medium | 6.5 | — | — | 2026-10-01 | 2026-10-03 |
| CVE-2026-88999 The Redux Framework plugin for WordPress is vulnerable to authorization bypass i... |
medium | 4.3 | — | — | 2026-10-01 | 2026-10-03 |
| CVE-2026-89047 The Social Media Share Buttons & Social Sharing Icons plugin for WordPress is vu... |
medium | 6.1 | — | — | 2026-10-01 | 2026-10-03 |
| CVE-2026-89427 The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to... |
medium | 6.1 | — | — | 2026-10-01 | 2026-10-03 |
| CVE-2026-85492 The All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Loca... |
medium | 6.1 | — | — | 2026-10-02 | 2026-10-03 |
| CVE-2026-75432 An issue in yaml-cpp 0.9.0 allows a remote attacker to obtain sensitive informat... |
medium | 5.1 | — | — | 2026-09-22 | 2026-10-03 |
| CVE-2026-78471 The Autoptimize plugin for WordPress is vulnerable to Stored Cross-Site Scriptin... |
medium | 5.4 | — | — | 2026-10-02 | 2026-10-03 |
| CVE-2026-32585 Missing Authorization vulnerability in airano Airano MCP Bridge airano-mcp-bridg... |
medium | 6.5 | — | — | 2026-10-02 | 2026-10-03 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.