October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,456
Critical
1,335
High
5,835
Medium
6,248
Low
648
Severity not reported
3,390
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1307), google (756), oracle (156), ibm (140), adobe (138), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-95816 The Smart Forms – when you need more than just a contact form plugin for WordPre... |
high | 7.2 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-94377 The Verified Reviews (Avis Vérifiés) plugin for WordPress is vulnerable to Store... |
high | 7.2 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-93885 The Cryptocurrency Donation Box – Bitcoin & Crypto Donations plugin for WordPres... |
high | 7.2 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-83592 The Contact Form DB for Enfold plugin for WordPress is vulnerable to Stored Cros... |
high | 7.2 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-77114 The Document Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scr... |
high | 7.2 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-78193 The JTL-Connector for WooCommerce plugin for WordPress is vulnerable to time-bas... |
high | 7.5 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-110449 Nix before 2.35.3 and Lix before 2.95.4 have an integer overflow and resultant o... |
high | 7.5 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-100153 The NewStatPress plugin for WordPress is vulnerable to Stored Cross-Site Scripti... |
high | 7.2 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-14765 Epic Games Unreal Engine versions up to and including 5.8.0 ship with an insecur... |
high | 7.7 | — | — | 2026-10-14 | 2026-10-18 |
| CVE-2026-110444 TeamPlus Messenger developed by Teamplus Technology has a Code Injection vulnera... |
high | 8.8 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-110445 TeamPlus Messenger developed by Teamplus Technology has a Code Injection vulnera... |
high | 8.8 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-103422 The AnyComment plugin for WordPress is vulnerable to Stored Cross-Site Scripting... |
high | 7.2 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-102251 The Abandoned Cart Pro for WooCommerce plugin for WordPress is vulnerable to gen... |
high | 7.5 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-82715 Insecure Temporary File vulnerability in Hitachi Disk Array Driver for AIX and H... |
high | 7.9 | — | — | 2026-10-14 | 2026-10-18 |
| CVE-2026-17092 The Directorist: AI-Powered Business Directory, Listings & Classified Ads plugin... |
high | 8.1 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-104749 The Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email... |
high | 7.5 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-104767 The Membership & User Roles for WooCommerce (Automatic Role Changer) plugin for... |
high | 7.5 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-104995 The BP Profile Search plugin for WordPress is vulnerable to Local File Inclusion... |
high | 8.1 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-103423 The Booking Package plugin for WordPress is vulnerable to authorization bypass i... |
high | 7.5 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-110359 Hyland Desktop Host for Windows before 25.1.1 is vulnerable to local privilege e... |
high | 7.8 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-92817 The Ignition Perspective module does not properly validate session privileges wh... |
high | 8.8 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-94453 Libreswan's pluto daemon has a use-after-free vulnerability when a client connec... |
high | 7.5 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-95632 CAI Content Credentials is affected by an Improper Verification of Cryptographic... |
high | 7.5 | — | Adobe / c2pa | 2026-10-13 | 2026-10-15 |
| CVE-2026-95633 CAI Content Credentials is affected by an Improper Verification of Cryptographic... |
high | 7.5 | — | Adobe / c2pa | 2026-10-13 | 2026-10-17 |
| CVE-2026-95634 CAI Content Credentials is affected by a Server-Side Request Forgery (SSRF) vuln... |
high | 8.6 | — | Adobe / c2pa | 2026-10-13 | 2026-10-15 |
| CVE-2026-77207 Libreswan has a null pointer dereference bug in the PKCS#7 handling code for IKE... |
high | 7.5 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-77206 Libreswan's IKEv2 state machine has a null pointer dereference bug in the EAP ha... |
high | 7.5 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-110171 Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote... |
high | 8.8 | — | Google / chrome | 2026-10-13 | 2026-10-15 |
| CVE-2026-110172 Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote... |
high | 8.8 | — | Google / chrome | 2026-10-13 | 2026-10-15 |
| CVE-2026-110162 Use after free in Desktop in Google Chrome prior to 155.0.8059.79 allowed a remo... |
high | 8.8 | — | Google / chrome | 2026-10-13 | 2026-10-15 |
| CVE-2026-110163 Use after free in DOM in Google Chrome prior to 155.0.8059.79 allowed a remote a... |
high | 8.8 | — | Google / chrome | 2026-10-13 | 2026-10-15 |
| CVE-2026-110164 Use after free in DOM in Google Chrome prior to 155.0.8059.79 allowed a remote a... |
high | 8.8 | — | Google / chrome | 2026-10-13 | 2026-10-15 |
| CVE-2026-110166 Buffer overflow in Animation in Google Chrome prior to 155.0.8059.79 allowed a r... |
high | 8.8 | — | Google / chrome | 2026-10-13 | 2026-10-15 |
| CVE-2026-110167 Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote... |
high | 8.8 | — | Google / chrome | 2026-10-13 | 2026-10-15 |
| CVE-2026-110168 Use after free in V8 in Google Chrome prior to 155.0.8059.79 allowed a remote at... |
high | 8.8 | — | Google / chrome | 2026-10-13 | 2026-10-15 |
| CVE-2026-110169 Use after free in V8 in Google Chrome prior to 155.0.8059.79 allowed a remote at... |
high | 8.8 | — | Google / chrome | 2026-10-13 | 2026-10-15 |
| CVE-2026-110153 Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote... |
high | 8.8 | — | Google / chrome | 2026-10-13 | 2026-10-15 |
| CVE-2026-110154 Use after free in Canvas in Google Chrome prior to 155.0.8059.79 allowed a remot... |
high | 8.8 | — | Google / chrome | 2026-10-13 | 2026-10-15 |
| CVE-2026-110155 Buffer overflow in PDFium in Google Chrome prior to 155.0.8059.79 allowed a remo... |
high | 8.8 | — | Google / chrome | 2026-10-13 | 2026-10-15 |
| CVE-2026-110156 Incorrect reference resolution in Extensions in Google Chrome on on Mac prior to... |
high | 8.3 | — | Google / chrome | 2026-10-13 | 2026-10-15 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.