October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
22,064
Critical
3,133
High
7,120
Medium
6,940
Low
617
Severity not reported
4,254
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (722), google (413), ibm (321), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-103284 Ghost versions from 5.125.1 before 6.57.1 contain an information disclosure vuln... |
medium | 4.3 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-103285 Ghost versions from 5.19.0 before 6.57.1 contain a cross-site request forgery vu... |
medium | 4.3 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-103288 Ghost, an open-source publishing platform, contains an input validation flaw in... |
medium | 6.5 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-103289 Ghost from 5.9.0 before 6.44.1 contains an input validation issue in the comment... |
medium | 6.5 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-95340 Incorrect authorization in PictureInPicture in Google Chrome prior to 154.0.8037... |
medium | 4.3 | — | Google / chrome | 2026-09-29 | 2026-10-01 |
| CVE-2026-95342 Missing authorization in V8 in Google Chrome prior to 154.0.8037.57 allowed a re... |
medium | 4.3 | — | Google / chrome | 2026-09-29 | 2026-10-01 |
| CVE-2026-102584 A flaw was found in Moodle. |
medium | 4.3 | — | Moodle / moodle | 2026-09-30 | 2026-10-01 |
| CVE-2026-102585 A flaw was found in Moodle. |
medium | 4.3 | — | Moodle / moodle | 2026-09-30 | 2026-10-01 |
| CVE-2026-102580 A flaw was found in Moodle. |
medium | 4.3 | — | Moodle / moodle | 2026-09-30 | 2026-10-01 |
| CVE-2026-102381 Missing Authorization vulnerability in Ahmad Majestic Support majestic-support a... |
medium | 5.3 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-102382 Authorization Bypass Through User-Controlled Key vulnerability in Ahmad Majestic... |
medium | 4.3 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-102390 Missing Authorization vulnerability in VillaTheme AFFI – Affiliate Marketing for... |
medium | 5.3 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-102394 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-103063 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-103064 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-103339 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-103341 Missing Authorization vulnerability in Unlimited Elements Unlimited Elements For... |
medium | 5.3 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-103343 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-103345 Insertion of Sensitive Information Into Sent Data vulnerability in Shamim Rajani... |
medium | 5.3 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-62058 Insertion of Sensitive Information Into Sent Data vulnerability in WPExperts CF7... |
medium | 5.3 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-62061 Authorization Bypass Through User-Controlled Key vulnerability in Metagauss Prof... |
medium | 5.3 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-62063 Missing Authorization vulnerability in Magepeople inc. |
medium | 5.4 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-103491 In JetBrains YouTrack before 2026.2.19422 iDOR in the issue activities API allow... |
medium | 6.5 | — | Jetbrains / youtrack | 2026-10-01 | 2026-10-01 |
| CVE-2026-103497 In JetBrains YouTrack before 2026.2.19422 sSRF was possible via the GitHub VCS i... |
medium | 5.5 | — | Jetbrains / youtrack | 2026-10-01 | 2026-10-01 |
| CVE-2026-103496 In JetBrains YouTrack before 2026.2.19422 iDOR in inbox threads allowed reading... |
medium | 5.4 | — | Jetbrains / youtrack | 2026-10-01 | 2026-10-01 |
| CVE-2026-103495 In JetBrains YouTrack before 2026.2.19422 missing authorisation allowed reloadin... |
medium | 4.3 | — | Jetbrains / youtrack | 2026-10-01 | 2026-10-01 |
| CVE-2026-95366 Use of released resource in Core in Google Chrome prior to 154.0.8037.57 allowed... |
medium | 6.5 | — | Google / chrome | 2026-09-29 | 2026-10-01 |
| CVE-2026-102579 A flaw was found in Moodle. |
medium | 4.3 | — | Moodle / moodle | 2026-09-30 | 2026-10-01 |
| CVE-2026-103492 In JetBrains YouTrack before 2026.2.19422 doS attack was possible via crafted PS... |
medium | 6.5 | — | Jetbrains / youtrack | 2026-10-01 | 2026-10-01 |
| CVE-2026-103336 Insertion of Sensitive Information Into Sent Data vulnerability in Smackcoders I... |
medium | 5.3 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-103260 n8n versions before 2.39.6 and 2.40.0 before 2.40.1 contain an approval bypass v... |
medium | 4.0 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-100894 A vulnerability was identified in mathurvishal CloudClassroom-PHP-Project up to... |
medium | 6.3 | — | — | 2026-09-28 | 2026-10-01 |
| CVE-2026-100897 A security vulnerability has been detected in fuzui StudentInfo up to fcc42a639e... |
medium | 5.5 | — | — | 2026-09-28 | 2026-10-01 |
| CVE-2026-102577 A flaw was found in Moodle. |
medium | 4.3 | — | Moodle / moodle | 2026-09-30 | 2026-10-01 |
| CVE-2026-95370 Inappropriate implementation in NFC in Google Chrome prior to 154.0.8037.57 allo... |
medium | 5.4 | — | Google / chrome | 2026-09-29 | 2026-10-01 |
| CVE-2026-95375 Incorrect authorization in BrowserTag in Google Chrome prior to 154.0.8037.57 al... |
medium | 6.3 | — | Google / chrome | 2026-09-29 | 2026-10-01 |
| CVE-2026-95364 Improper input validation in Passwords in Google Chrome prior to 154.0.8037.57 a... |
medium | 5.4 | — | Google / chrome | 2026-09-29 | 2026-10-01 |
| CVE-2026-95367 Information leak in DataTransfer in Google Chrome prior to 154.0.8037.57 allowed... |
medium | 5.3 | — | Google / chrome | 2026-09-29 | 2026-10-01 |
| CVE-2026-95368 Incorrect authorization in DevTools in Google Chrome prior to 154.0.8037.57 allo... |
medium | 4.3 | — | Google / chrome | 2026-09-29 | 2026-10-01 |
| CVE-2026-81158 Incorrect Authorization vulnerability in Drupal Entity API allows Forceful Brows... |
medium | 5.3 | — | Entity Api Project / entity api | 2026-09-02 | 2026-10-01 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.