October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
21,967
Critical
3,122
High
7,084
Medium
6,906
Low
609
Severity not reported
4,246
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (722), google (413), ibm (321), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2025-15693 The JCH Optimize WordPress plugin before 5.0.1 does not properly restrict a dire... |
low | 2.7 | — | — | 2026-09-05 | 2026-10-19 |
| CVE-2025-15694 The Joli Table Of Contents WordPress plugin before 2.8.1 does not sanitise and e... |
low | 3.5 | — | — | 2026-09-05 | 2026-10-19 |
| CVE-2025-15614 ugrep before 7.6.0 contains a heap buffer over-read vulnerability in the LZW dec... |
low | 3.3 | — | — | 2026-09-05 | 2026-10-19 |
| CVE-2025-52651 HCL MyXalytics was affected by Improper Input validation Vulnerability. |
low | 3.5 | — | — | 2026-09-07 | 2026-10-19 |
| CVE-2025-52652 HCL MyXalytics was affected by Content Spoofing Vulnerability. |
low | 3.5 | — | — | 2026-09-07 | 2026-10-19 |
| CVE-2025-52657 HCL MyXalytics was affected by Potential DOS Vulnerability. |
low | 3.5 | — | — | 2026-09-07 | 2026-10-19 |
| CVE-2025-15703 The HireZoot WordPress plugin before 4.0.0 does not sanitise and escape one of i... |
low | 3.5 | — | — | 2026-10-12 | 2026-10-19 |
| CVE-2026-97204 Deleting a label compared the ID of the repository in the request against the or... |
low | 3.1 | — | — | 2026-10-18 | 2026-10-19 |
| CVE-2026-112050 Gitify before 7.10.0 contains a login cross-site request forgery vulnerability t... |
low | 3.1 | — | — | 2026-10-18 | 2026-10-19 |
| CVE-2026-111935 NoteGen through 0.38.3 contains an external control of file path vulnerability i... |
low | 2.6 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-112274 libtins through 4.6 contains an out-of-bounds read vulnerability in DNS::soa_rec... |
low | 3.7 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-112284 libaribcaption 1.1.0 through 1.1.2 contains a global out-of-bounds read in Decod... |
low | 3.3 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-92431 The Patreon WordPress plugin before 1.10.0 does not perform an authorization che... |
low | 3.7 | — | — | 2026-10-17 | 2026-10-19 |
| CVE-2026-110034 The Salon Booking System WordPress plugin before 10.31.11 does not enforce a min... |
low | 3.7 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-91831 The Subscribe to Comments WordPress plugin before 2.3.3 does not sanitise newlin... |
low | 3.8 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-111926 Coder from 2.10.0 before 2.34.8 has an unauthenticated agent debug HTTP server o... |
low | 3.3 | — | — | 2026-10-17 | 2026-10-19 |
| CVE-2026-112105 A vulnerability has been found in GlitterWare Passy up to 1.10.1. |
low | 3.7 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-112029 A vulnerability has been found in diem-project diem up to 5.1.3. |
low | 2.5 | — | — | 2026-10-18 | 2026-10-19 |
| CVE-2026-112037 A flaw has been found in diem-project diem up to 116974edfb9a5b8bd69cb13586dc62b... |
low | 3.7 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-112041 A vulnerability was identified in diem-project diem up to 116974edfb9a5b8bd69cb1... |
low | 3.7 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-112096 A vulnerability has been found in SourceCodester Inventory System 1.0. |
low | 3.5 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-112097 A vulnerability was found in SourceCodester Inventory System 1.0. |
low | 3.5 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-112106 A security vulnerability has been detected in TufayelLUS TikTok-Video-Downloader... |
low | 3.7 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-112031 A vulnerability was determined in Chamilo LMS up to 1.11.40/2.0.3/3.0.1. |
low | 3.5 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-112039 A vulnerability was found in diem-project diem up to 116974edfb9a5b8bd69cb13586d... |
low | 2.4 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-111993 A flaw has been found in Soarkey StudentManagement up to e08f7f1d5015af407aa4cca... |
low | 3.3 | — | — | 2026-10-18 | 2026-10-19 |
| CVE-2026-111874 A flaw has been found in OpenCATS 0.10.0. |
low | 3.7 | — | — | 2026-10-18 | 2026-10-19 |
| CVE-2026-111602 The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress... |
low | 3.7 | — | — | 2026-10-17 | 2026-10-19 |
| CVE-2026-112103 A vulnerability has been found in f3-factory fatfree-core up to 3.9.2. |
low | 3.7 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-111655 ThinkAdmin think-plugs-admin through 1.0.81 contains an insecure direct object r... |
low | 3.8 | — | — | 2026-10-16 | 2026-10-19 |
| CVE-2026-111888 phpMyFAQ from 4.0.0 before 4.1.9 contains an incorrect authorization vulnerabili... |
low | 2.7 | — | — | 2026-10-17 | 2026-10-18 |
| CVE-2026-108754 GPT-Load through 1.4.11 contains a cleartext logging vulnerability that exposes... |
low | 3.3 | — | — | 2026-10-11 | 2026-10-18 |
| CVE-2026-108723 answer-me-with-html through 0.5.0 contains a link following vulnerability in the... |
low | 2.5 | — | — | 2026-10-11 | 2026-10-18 |
| CVE-2026-110232 Fossify File Manager through 1.6.2 contains a path traversal vulnerability that... |
low | 3.3 | — | — | 2026-10-13 | 2026-10-17 |
| CVE-2026-109854 A flaw was found in m17n-lib. |
low | 2.5 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-109526 A vulnerability has been found in HBAI-Ltd Toonflow-app up to 1.1.8. |
low | 3.3 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-109410 A vulnerability has been found in macrozheng mall 1.0.3 dcaa93b. |
low | 2.4 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-109839 IBM Db2 Genius Hub 1.0 could allow a remote authenticated attacker to bypass sec... |
low | 3.1 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-108388 Indico is a feature-rich event management system. |
low | 3.5 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-49206 rapidcsv is a C++ CSV parser library. |
low | 2.9 | — | — | 2026-10-14 | 2026-10-16 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.