October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
24,528
Critical
3,289
High
7,924
Medium
7,616
Low
740
Severity not reported
4,959
In CISA KEV
191
Most affected vendors (by CPE data where available): microsoft (1424), google (825), linux (722), ibm (323), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (116), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-88391 Northstar (dromara/northstar, quantitative trading platform) <= 9.1.1 enables th... |
critical | 9.8 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-105105 CWE-306: Missing Authentication for Critical Function in the ait.core.server tel... |
critical | 9.8 | — | — | 2026-10-03 | 2026-10-06 |
| CVE-2026-84031 IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to... |
critical | 9.0 | — | Ibm / guardium data protection | 2026-09-18 | 2026-10-06 |
| CVE-2026-82967 IBM Guardium Data Protection 12.2 is vulnerable to an authentication bypass that... |
critical | 9.8 | — | Ibm / guardium data protection | 2026-09-18 | 2026-10-06 |
| CVE-2026-84078 IBM Guardium Data Protection 12.2 is vulnerable to a missing authentication vuln... |
critical | 9.9 | — | Ibm / guardium data protection | 2026-09-18 | 2026-10-06 |
| CVE-2026-84082 IBM Guardium Data Protection 12.2 could allow a remote attacker to execute arbit... |
critical | 9.8 | — | Ibm / guardium data protection | 2026-09-18 | 2026-10-06 |
| CVE-2026-81478 Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Use... |
critical | 9.8 | — | Dell / openmanage server administrator | 2026-09-17 | 2026-10-06 |
| CVE-2026-82042 UTMStack before 11.2.16 contains an authentication bypass vulnerability that all... |
critical | 9.8 | — | — | 2026-10-02 | 2026-10-06 |
| CVE-2026-105639 Plane is an open-source project management tool. |
critical | 9.8 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-95102 WebSocket endpoints lack proper authentication mechanisms, enabling attackers to... |
critical | 9.4 | — | — | 2026-10-02 | 2026-10-06 |
| CVE-2026-84411 The web management service in affected RouterOS versions contains an integer und... |
critical | 9.8 | — | — | 2026-10-02 | 2026-10-06 |
| CVE-2026-79820 A remote user validation failure vulnerability exists in HPE Integrated Lights-O... |
critical | 9.0 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-87115 The VikAppointments Services Booking Calendar plugin for WordPress is vulnerable... |
critical | 9.1 | — | — | 2026-10-03 | 2026-10-06 |
| CVE-2026-92084 The The Beaver Builder Page Builder – Drag and Drop Website Builder plugin for W... |
critical | 9.1 | — | — | 2026-10-03 | 2026-10-06 |
| CVE-2026-105284 A weakness has been identified in Totolink A3002MU 1.0.0-B20230403.1455. |
critical | 10.0 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-105285 A security vulnerability has been detected in Totolink A3002MU 1.0.0-B20230403.1... |
critical | 10.0 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-105484 A security vulnerability has been detected in TOTOLINK X6000R 9.4.0cu.652_B20230... |
critical | 10.0 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-103355 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
critical | 9.3 | — | — | 2026-10-04 | 2026-10-06 |
| CVE-2026-103352 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
critical | 9.3 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-97283 Deserialization of Untrusted Data vulnerability in Liquid Web / StellarWP Advanc... |
critical | 9.8 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-32568 Subscriber Remote Code Execution (RCE) in WooCommerce Designer Pro <= 1.9.33 ver... |
critical | 9.9 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-32579 Unauthenticated Arbitrary File Upload in Kognetiks Chatbot for WordPress <= 2.4.... |
critical | 10.0 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-39753 Unauthenticated Privilege Escalation in Taskbot <= 6.6 versions. |
critical | 9.8 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-39755 Subscriber Arbitrary File Upload in WP Duplicate <= 1.1.11 versions. |
critical | 9.9 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-39757 Subscriber Arbitrary File Upload in Taskbot <= 6.6 versions. |
critical | 9.9 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-39759 Employer / Sales Representative Arbitrary File Upload in Workreap Core <= 3.4.5... |
critical | 9.9 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-39761 Unauthenticated Privilege Escalation in Meta Box AIO <= 3.7.1 versions. |
critical | 9.8 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-39764 Unauthenticated SQL Injection in Radius Booking — Booking Calendar for Appointme... |
critical | 9.3 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-39770 Unauthenticated Arbitrary File Upload in Doctreat <= 1.7.0 versions. |
critical | 10.0 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-39773 Unauthenticated Privilege Escalation in Doctreat Core <= 1.7.0 versions. |
critical | 10.0 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-39797 Unauthenticated PHP Object Injection in GDPR Framework By Data443 <= 2.5.0 versi... |
critical | 9.8 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-41555 Unauthenticated SQL Injection in Newsletter Subscription Form – User Subscriptio... |
critical | 9.3 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-42415 Unauthenticated SQL Injection in Porto Theme - Functionality <= 3.9.3 versions. |
critical | 9.3 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-42417 Unauthenticated SQL Injection in ARMember Premium <= 7.8 versions. |
critical | 9.3 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-82989 There is an input injection in vCast exposed network services in ViewSonic ViewB... |
critical | 9.8 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-103956 Missing authentication for critical function in the authentication dependency in... |
critical | 10.0 | — | — | 2026-10-02 | 2026-10-06 |
| CVE-2026-92018 Sandbox escape in the DOM: Core & HTML component. |
critical | 9.6 | — | Mozilla / firefox | 2026-09-15 | 2026-10-06 |
| CVE-2026-100770 Sandbox escape due to use-after-free in the DOM: Content Processes component. |
critical | 9.6 | — | Mozilla / firefox | 2026-09-29 | 2026-10-06 |
| CVE-2026-100775 Sandbox escape in the Graphics component. |
critical | 9.6 | — | Mozilla / firefox | 2026-09-29 | 2026-10-06 |
| CVE-2026-80441 IBM Guardium Data Protection 12.2 is vulnerable to an unauthenticated second-ord... |
critical | 9.8 | — | Ibm / guardium data protection | 2026-09-18 | 2026-10-06 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.