October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
22,171
Critical
3,135
High
7,164
Medium
6,958
Low
623
Severity not reported
4,291
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (722), google (413), ibm (321), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-92899 Apache WSS4J remembers the Nonce of each UsernameToken it accepts, so a captured... |
medium | 4.8 | — | Apache / wss4j | 2026-09-30 | 2026-10-02 |
| CVE-2026-84925 The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is v... |
medium | 6.1 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-104054 A security flaw has been discovered in calcom cal.diy up to 6.2.0. |
medium | 6.3 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-95275 Incorrect reference resolution in MediaStream in Google Chrome prior to 154.0.80... |
medium | 6.5 | — | Google / chrome | 2026-09-29 | 2026-10-02 |
| CVE-2026-95303 Incomplete cleanup in SmartCard in Google Chrome prior to 154.0.8037.57 allowed... |
medium | 6.5 | — | Google / chrome | 2026-09-29 | 2026-10-02 |
| CVE-2026-51895 Ragflow 0.24.0 and prior contains improper access control in update_metadata_set... |
medium | 6.5 | — | — | 2026-10-01 | 2026-10-02 |
| CVE-2026-104002 A fail-open error handling issue within the data masking utility of Powertools f... |
medium | 5.3 | — | — | 2026-10-01 | 2026-10-02 |
| CVE-2026-104356 PictShare before version 3.7.1 contains a weak randomness vulnerability where th... |
medium | 5.9 | — | — | 2026-10-01 | 2026-10-02 |
| CVE-2026-104053 A vulnerability was identified in itsourcecode Pet Shop Management System 1.0. |
medium | 6.3 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-15442 In all builds that make use of (D)TLS, including default builds, there is a seri... |
medium | 5.3 | — | Wolfssl / wolfssl | 2026-09-27 | 2026-10-02 |
| CVE-2026-89133 wolfSSL versions 5.9.2 and earlier contain a flaw in the X.509 certificate valid... |
medium | 5.3 | — | Wolfssl / wolfssl | 2026-09-27 | 2026-10-02 |
| CVE-2026-89135 A failed X509_verify_cert call permanently plants an unverified attacker CA in t... |
medium | 6.5 | — | Wolfssl / wolfssl | 2026-09-27 | 2026-10-02 |
| CVE-2026-104058 Podgrab contains a missing authentication vulnerability in which the /ws WebSock... |
medium | 5.3 | — | — | 2026-10-01 | 2026-10-02 |
| CVE-2026-93832 A component of one of the Motorola system applications was
exported without perm... |
medium | 4.4 | — | — | 2026-10-01 | 2026-10-02 |
| CVE-2026-104183 stream-json is a micro-library of stream components for processing JSON and JSON... |
medium | 5.1 | — | — | 2026-10-01 | 2026-10-02 |
| CVE-2026-75101 An authorization bypass vulnerability was identified in GitHub Enterprise Server... |
medium | 6.5 | — | Github / enterprise server | 2026-09-22 | 2026-10-02 |
| CVE-2026-97876 A local attacker with control over GRUB's configuration can bypass lockdown rest... |
medium | 6.4 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-104844 PostCSS Selector Parser is a CSS selector parser that integrates with PostCSS bu... |
medium | 5.9 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-77912 A stored cross-site scripting (XSS) vulnerability was identified in GitHub Enter... |
medium | 5.4 | — | Github / enterprise server | 2026-09-22 | 2026-10-02 |
| CVE-2026-97634 The Event Tickets and Registration plugin for WordPress is vulnerable to generic... |
medium | 6.5 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-97286 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-09-30 | 2026-10-02 |
| CVE-2026-93880 The Greenshift – animation and page builder blocks plugin for WordPress is vulne... |
medium | 6.1 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-94180 Authorization Bypass Through User-Controlled Key vulnerability in Monetizemore A... |
medium | 4.3 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-85209 Missing Authorization vulnerability in AVEZ Electronics Communication Training a... |
medium | 6.5 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-104606 A security flaw has been discovered in itsourcecode Online Admission System Proj... |
medium | 6.3 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-77387 geopy is a geocoding library for Python. |
medium | 4.0 | — | — | 2026-10-01 | 2026-10-02 |
| CVE-2026-69562 Out-of-bounds read in SQL Server allows an unauthorized attacker to disclose inf... |
medium | 6.5 | — | Microsoft / sql server 2017 | 2026-09-08 | 2026-10-02 |
| CVE-2026-67630 Out-of-bounds read in SQL Server allows an authorized attacker to disclose infor... |
medium | 6.5 | — | Microsoft / sql server 2017 | 2026-09-08 | 2026-10-02 |
| CVE-2026-67629 Out-of-bounds read in SQL Server allows an authorized attacker to disclose infor... |
medium | 6.5 | — | Microsoft / sql server 2017 | 2026-09-08 | 2026-10-02 |
| CVE-2026-101889 The Prime Mover plugin for WordPress before 2.2.1 contains a path traversal vuln... |
medium | 6.5 | — | — | 2026-10-01 | 2026-10-02 |
| CVE-2026-101890 The Prime Mover plugin for WordPress before 2.2.1 contains a stored cross-site s... |
medium | 5.4 | — | — | 2026-10-01 | 2026-10-02 |
| CVE-2026-103760 Mooncake transfer engine through 0.3.13.post1 contains a denial of service vulne... |
medium | 5.9 | — | — | 2026-10-01 | 2026-10-02 |
| CVE-2026-13718 The Tabs Responsive WordPress plugin through 2.5 does not sanitize the content o... |
medium | 6.8 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-81740 The Paytm Payment Gateway WordPress plugin before 2.8.9 does not verify that pay... |
medium | 5.3 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-85004 The Popup Maker WordPress plugin through 1.4.5 does not perform a capability che... |
medium | 4.3 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-85016 The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not esc... |
medium | 6.8 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-90988 The Request a Quote WordPress plugin through 2.5.6 does not perform an authoriza... |
medium | 5.3 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-91022 The Motors WordPress plugin before 1.4.124 does not sanitise and escape a listin... |
medium | 6.8 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-94298 The BuildKit WordPress plugin before 1.0.29 does not properly sanitise and escap... |
medium | 6.2 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-97317 The Giveaways and Contests by RafflePress WordPress plugin before 1.12.27 does n... |
medium | 5.3 | — | — | 2026-10-02 | 2026-10-02 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.