October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
22,064
Critical
3,133
High
7,120
Medium
6,940
Low
617
Severity not reported
4,254
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (722), google (413), ibm (321), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-100269 In JetBrains YouTrack before 2026.2.19197 helpdesk project's Authorized Reporter... |
medium | 4.3 | — | Jetbrains / youtrack | 2026-09-30 | 2026-10-01 |
| CVE-2026-102588 A flaw was found in Moodle. |
medium | 6.5 | — | Moodle / moodle | 2026-09-30 | 2026-10-01 |
| CVE-2026-102586 A flaw was found in Moodle. |
medium | 6.1 | — | Moodle / moodle | 2026-09-30 | 2026-10-01 |
| CVE-2026-100267 In JetBrains YouTrack before 2026.2.19197 reDoS attack was possible via mailbox... |
medium | 5.9 | — | Jetbrains / youtrack | 2026-09-30 | 2026-10-01 |
| CVE-2026-102581 A flaw was found in Moodle. |
medium | 5.4 | — | Moodle / moodle | 2026-09-30 | 2026-10-01 |
| CVE-2026-102582 A flaw was found in Moodle. |
medium | 4.3 | — | Moodle / moodle | 2026-09-30 | 2026-10-01 |
| CVE-2026-92537 The Newsletter – Send awesome emails from WordPress plugin for WordPress is vuln... |
medium | 5.3 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-89424 The Duplicate Post plugin for WordPress is vulnerable to Stored Cross-Site Scrip... |
medium | 6.4 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-47096 AJA HELO Plus firmware before 2.1.7 contains a stored cross-site scripting vulne... |
medium | 6.1 | — | — | 2026-09-30 | 2026-10-01 |
| CVE-2026-103590 QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in... |
medium | 5.4 | — | — | 2026-09-30 | 2026-10-01 |
| CVE-2026-103538 A security flaw has been discovered in ZongXR SuperMarket 1.0.0.0. |
medium | 6.5 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-103541 A vulnerability was detected in formtools.org Form Tools up to 3.1.1. |
medium | 6.3 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-103544 A vulnerability was found in datadrivenconstruction OpenConstructionERP up to 14... |
medium | 6.3 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-103533 A vulnerability was found in David-Crty databasement up to 1.7.1. |
medium | 4.1 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-103282 Ghost versions 0.5.0 before 6.23.0 contain a concurrency issue in the staff invi... |
medium | 4.3 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-103245 n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2... |
medium | 5.3 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-103261 Tornado before 6.5.9 fails to limit the number of query string fields in HTTPSer... |
medium | 5.3 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-103269 Ghost versions 5.3.0 before 6.62.0 contain a missing authorization vulnerability... |
medium | 5.3 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-103274 Ghost versions 5.3.0 before 6.58.0 fail to properly enforce access controls on c... |
medium | 5.3 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-101102 A vulnerability was found in deepseek-ai deepseek-harness up to 0.1.0-rc.7. |
medium | 6.3 | — | — | 2026-09-28 | 2026-10-01 |
| CVE-2026-101070 A security vulnerability has been detected in dbgate up to 7.3.1. |
medium | 5.3 | — | — | 2026-09-28 | 2026-10-01 |
| CVE-2026-101082 A weakness has been identified in PMWeb 7.x/8.x/2025.x. |
medium | 5.3 | — | — | 2026-09-28 | 2026-10-01 |
| CVE-2026-101099 A vulnerability was detected in ag-ui-protocol ag-ui up to 2026-09-23. |
medium | 4.3 | — | — | 2026-09-28 | 2026-10-01 |
| CVE-2026-101040 A security flaw has been discovered in Ricoh SP 330DN, SP 221, SP C252SF and Afi... |
medium | 6.5 | — | — | 2026-09-28 | 2026-10-01 |
| CVE-2026-101054 A vulnerability was identified in Thinkware U3000 up to 1.02.04. |
medium | 5.3 | — | — | 2026-09-28 | 2026-10-01 |
| CVE-2026-101003 A weakness has been identified in Cesanta Mongoose up to 7.21. |
medium | 5.3 | — | — | 2026-09-28 | 2026-10-01 |
| CVE-2026-101006 A flaw has been found in Frappe HR up to 16.15.0. |
medium | 4.3 | — | — | 2026-09-28 | 2026-10-01 |
| CVE-2026-101018 A vulnerability was determined in dayrui XunruiCMS up to 4.7.2. |
medium | 4.7 | — | — | 2026-09-28 | 2026-10-01 |
| CVE-2026-100900 A vulnerability has been found in DevaslanPHP project-management 1.2.1/1.2.2/1.2... |
medium | 5.5 | — | — | 2026-09-28 | 2026-10-01 |
| CVE-2026-100903 A vulnerability was identified in ООО НПО Ритм GEOritm up to 2.45.1. |
medium | 5.3 | — | — | 2026-09-28 | 2026-10-01 |
| CVE-2026-100907 A flaw has been found in Eyeplus 57.0.0.0308. |
medium | 5.3 | — | — | 2026-09-28 | 2026-10-01 |
| CVE-2026-100179 The Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Q... |
medium | 6.1 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-95290 Missing authorization in NFC in Google Chrome prior to 154.0.8037.57 allowed a r... |
medium | 5.4 | — | Google / chrome | 2026-09-29 | 2026-10-01 |
| CVE-2026-66247 iControl is affected by an insecure Cross-Origin Resource Sharing (CORS) policy... |
medium | 4.3 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-95297 Missing authorization in Contextual Tasks in Google Chrome prior to 154.0.8037.5... |
medium | 6.5 | — | Google / chrome | 2026-09-29 | 2026-10-01 |
| CVE-2026-95300 Missing authorization in DevTools in Google Chrome prior to 154.0.8037.57 allowe... |
medium | 4.8 | — | Google / chrome | 2026-09-29 | 2026-10-01 |
| CVE-2026-103273 Ghost versions 4.3.0 before 6.58.0 contain an authentication bypass vulnerabilit... |
medium | 4.3 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-103276 Ghost versions before 6.20.0 contain a file extension filtering bypass vulnerabi... |
medium | 5.3 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-103280 Ghost from version 0.8.0 before 6.23.0 contains an information disclosure vulner... |
medium | 5.3 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-103281 Ghost (npm package 'ghost') versions from 3.23.0 up to, but not including, 6.23.... |
medium | 5.4 | — | — | 2026-10-01 | 2026-10-01 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.