October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
22,171
Critical
3,135
High
7,164
Medium
6,958
Low
623
Severity not reported
4,291
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (722), google (413), ibm (321), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-97318 The Giveaways and Contests by RafflePress WordPress plugin before 1.12.27 does n... |
medium | 6.1 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-13413 The CMP – Coming Soon & Maintenance WordPress plugin before 4.1.20 does not corr... |
medium | 5.3 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-1661 The WP Mail Logging WordPress plugin before 1.17.0 does not properly restrict th... |
medium | 4.3 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-79618 The WP User Frontend WordPress plugin before 4.3.12 does not enforce its subscri... |
medium | 4.3 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-84740 The Events Calendar WordPress plugin before 6.17.5.1 does not validate or saniti... |
medium | 6.5 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-85005 The Popup Maker WP WordPress plugin through 1.4.5 does not perform authorization... |
medium | 5.4 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-90952 The WP Edit Password Protected WordPress plugin before 2.0.7 does not enforce it... |
medium | 5.3 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-90987 The Easy PayPal & Stripe Buy Now Button WordPress plugin before 2.0.6 does not d... |
medium | 5.3 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-91020 The WebToffee Gift Cards for WooCommerce WordPress plugin before 1.3.1 does not... |
medium | 5.3 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-92924 The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not che... |
medium | 5.4 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-97219 The MStore API WordPress plugin before 4.22.1 does not restrict which fields of... |
medium | 4.3 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-67624 Out-of-bounds read in SQL Server allows an authorized attacker to disclose infor... |
medium | 6.5 | — | Microsoft / sql server 2019 | 2026-09-08 | 2026-10-02 |
| CVE-2026-104417 Ghost from 1.20.0 before 6.64.0 contains a path traversal vulnerability in theme... |
medium | 4.9 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-104421 Zebra before 6.2.1 contains an incomplete cleanup vulnerability that allows unau... |
medium | 5.3 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-104425 ZcashFoundation Zebra before 6.1.0 contains a resource exhaustion vulnerability... |
medium | 5.3 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-104426 Zebra before 6.1.0 contains an inefficient algorithmic complexity vulnerability... |
medium | 5.9 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-104429 Zebra (zebrad) 5.0.0 before 6.0.0-rc.0 does not apply its per-peer mempool admis... |
medium | 5.3 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-104434 ZcashFoundation Zebra zebra-rpc before 8.0.0 and zebrad before 4.5.0 contain a r... |
medium | 6.5 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-104613 A vulnerability was determined in CodeAstro Simple Pharmacy Management System 1.... |
medium | 6.3 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-104614 A vulnerability was identified in CodeAstro Simple Pharmacy Management System 1.... |
medium | 6.3 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-104638 A security vulnerability has been detected in onetwothreeneth HospitalManagement... |
medium | 5.3 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-32584 Insertion of Sensitive Information Into Sent Data vulnerability in Chiranjit Haz... |
medium | 5.3 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-39439 Missing Authorization vulnerability in Kiera Howe WebSamurai websamurai allows E... |
medium | 6.5 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-39444 Authorization Bypass Through User-Controlled Key vulnerability in PublishPress P... |
medium | 5.4 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-79685 Dell PowerStore contains an Argument Injection vulnerability. |
medium | 6.5 | — | Dell / powerstoreos | 2026-09-01 | 2026-10-02 |
| CVE-2026-103243 LightLLM through 1.2.0 fails to validate image_url and audio_url parameters in m... |
medium | 5.8 | — | — | 2026-09-30 | 2026-10-02 |
| CVE-2026-103397 OpenSave before 2.4.0-beta.1 fails to validate sender identity in WAN relay requ... |
medium | 5.6 | — | — | 2026-09-30 | 2026-10-02 |
| CVE-2026-103115 A security flaw has been discovered in OS4ED openSIS-Classic up to 9.3. |
medium | 6.3 | — | — | 2026-09-30 | 2026-10-02 |
| CVE-2026-103118 A vulnerability was detected in GraphicsMagick up to 1.3.47. |
medium | 4.3 | — | — | 2026-09-30 | 2026-10-02 |
| CVE-2026-103227 A weakness has been identified in GPAC up to 26.07.0. |
medium | 6.3 | — | — | 2026-09-30 | 2026-10-02 |
| CVE-2026-101879 OpenClaw Windows Node before 2026.7.1-3 contains a missing authorization vulnera... |
medium | 6.5 | — | — | 2026-09-30 | 2026-10-02 |
| CVE-2026-101883 OpenClaw Windows Node through 2026.9.4 contains a server-side request forgery vu... |
medium | 5.4 | — | — | 2026-09-30 | 2026-10-02 |
| CVE-2026-100265 In JetBrains Rider before 2026.2.1 aI Assistant could auto-update third-party sk... |
medium | 6.5 | — | Jetbrains / rider | 2026-09-30 | 2026-10-02 |
| CVE-2026-100266 In JetBrains Hub before 2026.2.52366 missing authorisation allowed authenticated... |
medium | 6.5 | — | Jetbrains / hub | 2026-09-30 | 2026-10-02 |
| CVE-2026-100272 In JetBrains YouTrack before 2026.2.19197 missing authorisation in the notificat... |
medium | 4.9 | — | Jetbrains / youtrack | 2026-09-30 | 2026-10-02 |
| CVE-2026-100274 In JetBrains YouTrack before 2026.2.19197 project Admin could trigger DoS via a... |
medium | 6.5 | — | Jetbrains / youtrack | 2026-09-30 | 2026-10-02 |
| CVE-2026-104438 YesWiki before 4.6.7 contains a missing authorization vulnerability in the listp... |
medium | 5.3 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-104442 YesWiki before 4.6.7 contains an unauthenticated server-side request forgery vul... |
medium | 5.8 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-103763 SiYuan before v3.8.5 contains an information disclosure vulnerability that allow... |
medium | 5.8 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-100278 In JetBrains YouTrack before 2026.2.19197 users with restricted permission could... |
medium | 4.9 | — | Jetbrains / youtrack | 2026-09-30 | 2026-10-02 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.