October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,456
Critical
1,335
High
5,835
Medium
6,248
Low
648
Severity not reported
3,390
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1307), google (756), oracle (156), ibm (140), adobe (138), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-73798 A security vulnerability in HPE NonStop DNS 9.2.3 Non Secure Version could cause... |
high | 8.2 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-107431 Missing Authorization vulnerability in Crocoblock JetFormBuilder jetformbuilder... |
high | 7.5 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-105067 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
high | 8.5 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-103905 The authentication middleware of the JTL-Shop
administration backend processes t... |
high | 7.5 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-104795 The insights-runtime-extractor runs as a privileged DaemonSet (`hostPID: true`)... |
high | 8.8 | — | — | 2026-10-14 | 2026-10-30 |
| CVE-2026-103358 Improper Control of Generation of Code ('Code Injection') vulnerability in Villa... |
high | 7.5 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-88829 A flaw was found in BusyBox httpd's reverse proxy feature. |
high | 7.2 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-90954 A flaw was found in BusyBox's dpkg-deb archive extraction. |
high | 7.8 | — | — | 2026-10-14 | 2026-10-19 |
| CVE-2026-73793 HPE NonStop Middleware software has secret key handling and data deserialization... |
high | 7.9 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-86476 A flaw was found in gst-plugins-base. |
high | 8.4 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-107428 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-73790 A vulnerability in HPE NonStop iTP WebServer can cause memory corruption and sys... |
high | 8.2 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-109901 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
high | 8.5 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-110284 The LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes plugin for WordP... |
high | 7.5 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-92392 During an upload, curl mishandles HTTP/2 `RST_STREAM` received from the server
(... |
high | 8.1 | — | — | 2026-10-14 | 2026-10-18 |
| CVE-2026-107631 The Record of Consent Extension for Complianz plugin for WordPress is vulnerable... |
high | 7.2 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-107751 The Mang Board plugin for WordPress is vulnerable to Stored Cross-Site Scripting... |
high | 7.2 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-104764 The Post Export Import with Media plugin for WordPress is vulnerable to PHP Obje... |
high | 7.2 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-104909 The Mang Board plugin for WordPress is vulnerable to Local File Inclusion in all... |
high | 8.1 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-105106 Koha is vulnerable to OS command injection in the Task Scheduler deletion path. |
high | 8.8 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-105107 Koha is vulnerable to SQL injection in the Most-circulated items report. |
high | 7.6 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-100163 The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress... |
high | 7.4 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-103366 The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress... |
high | 7.5 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-103367 The ShopMagic – email automation for WordPress plugin for WordPress is vulnerabl... |
high | 8.1 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-89288 The Fast Courier WordPress plugin before 5.2.4 does not sanitize and escape a va... |
high | 8.6 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-86787 The affiliate-toolkit WordPress plugin before 3.9.1 does not prevent a low-privi... |
high | 7.2 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-86799 The Forms WordPress plugin before 3.0.2 does not sanitise submitted form values... |
high | 8.8 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-107126 The WP Booking System WordPress plugin before 2.1.0.1 does not sanitise and esca... |
high | 8.8 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-107508 The Ultimate Multisite WordPress plugin before 2.17.2 does not validate a user-s... |
high | 8.6 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-103307 The Walletdoc Payment Gateway for WooCommerce WordPress plugin before 1.8.5 does... |
high | 8.6 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-110459 A malicious actor with access to the network could exploit an Improper Access Co... |
high | 8.6 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-50218 Akamai GPA (Guardicore Platform Agent) client on all platforms before 7.4 improp... |
high | 8.5 | — | — | 2026-10-14 | 2026-10-19 |
| CVE-2026-110455 A malicious actor with access to the network and under certain conditions could... |
high | 8.1 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-106931 EG Secure Solutions SiteGuard Server Edition OS Command Injection Vulnerability |
high | 7.8 | Listed | EG Secure Solutions / SiteGuard Server Edition | 2026-10-14 | 2026-10-21 |
| CVE-2026-105429 Improper neutralization of special elements in the NetBird client SSH configurat... |
high | 8.0 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-110450 Nix before 2.35.3 and Lix before 2.95.4 allow privilege escalation via a repair... |
high | 8.0 | — | — | 2026-10-14 | 2026-10-19 |
| CVE-2026-101924 The NewStatPress plugin for WordPress is vulnerable to Stored Cross-Site Scripti... |
high | 7.2 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-97398 The FV Flowplayer Video Player plugin for WordPress is vulnerable to Stored Cros... |
high | 7.2 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-96661 The Gmedia Photo Gallery plugin for WordPress is vulnerable to time-based SQL In... |
high | 7.5 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-95808 The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugi... |
high | 7.5 | — | — | 2026-10-14 | 2026-10-14 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.