October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 29, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
16,216
Critical
1,207
High
5,399
Medium
5,736
Low
602
Severity not reported
3,272
In CISA KEV
17
Most affected vendors (by CPE data where available): microsoft (1078), google (711), ibm (140), oracle (117), adobe (110), broadcom (61), apache (45), freerdp (42), linuxfoundation (41), dell (40)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-103904 The public consent endpoint of JTL-Shop accepts arbitrary
consent names from una... |
critical | 9.3 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-104748 The SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifica... |
critical | 9.8 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-89310 A parameter taken from the request body is inserted into
a T-SQL statement witho... |
critical | 9.9 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-107594 The File Upload to Order WordPress plugin before 1.1.4 does not validate or conf... |
critical | 10.0 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-87855 The JTL-Connector for WooCommerce plugin for WordPress is vulnerable to Arbitrar... |
critical | 9.8 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-104800 The AGE-GATE plugin for WordPress is vulnerable to Remote Code Execution in all... |
critical | 9.8 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-97657 The Abandoned Cart Pro for WooCommerce plugin for WordPress is vulnerable to Aut... |
critical | 9.8 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-97668 The Abandoned Cart Pro for WooCommerce plugin for WordPress is vulnerable to SQL... |
critical | 9.8 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-110447 Collabora Online – Built-in CODE Server OS Command Injection Vulnerability |
critical | 9.8 | Listed | Collabora / Collabora Online – Built-in CODE Server | 2026-10-14 | 2026-10-26 |
| CVE-2026-110002 The Snazzy Social Media Feed plugin for WordPress is vulnerable to Arbitrary Fil... |
critical | 9.8 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-92097 The Click to Chat for WhatsApp plugin for WordPress is vulnerable to Arbitrary S... |
critical | 9.1 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-93388 The Printcart Store (PCDesigner / NB Designer) plugin for WooCommerce is vulnera... |
critical | 9.8 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-110392 Improper neutralization of special elements used in an OS command ('OS command i... |
critical | 9.8 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-97381 Legacy Update is a tool for activating and installing updates on legacy Windows... |
critical | 9.9 | — | — | 2026-10-13 | 2026-10-17 |
| CVE-2026-110161 Use after free in Network in Google Chrome prior to 155.0.8059.79 allowed a remo... |
critical | 9.6 | — | Google / chrome | 2026-10-13 | 2026-10-15 |
| CVE-2026-110165 Use after free in Core in Google Chrome on on Android prior to 155.0.8059.79 all... |
critical | 9.6 | — | Google / chrome | 2026-10-13 | 2026-10-15 |
| CVE-2026-110152 Buffer overflow in ANGLE in Google Chrome on on Android prior to 155.0.8059.79 a... |
critical | 9.6 | — | Google / chrome | 2026-10-13 | 2026-10-15 |
| CVE-2026-110159 Incorrect authorization in Updater in Google Chrome prior to 155.0.8059.79 allow... |
critical | 9.6 | — | Google / chrome | 2026-10-13 | 2026-10-15 |
| CVE-2026-110149 Use after free in Browser in Google Chrome prior to 155.0.8059.79 allowed a remo... |
critical | 9.6 | — | Google / chrome | 2026-10-13 | 2026-10-15 |
| CVE-2026-110136 Use after free in PDF in Google Chrome prior to 155.0.8059.79 allowed a remote a... |
critical | 9.6 | — | Google / chrome | 2026-10-13 | 2026-10-15 |
| CVE-2026-110142 Use after free in FileSystem in Google Chrome prior to 155.0.8059.79 allowed a r... |
critical | 9.6 | — | Google / chrome | 2026-10-13 | 2026-10-15 |
| CVE-2026-95695 IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could all... |
critical | 9.1 | — | Ibm / websphere application server | 2026-10-13 | 2026-10-22 |
| CVE-2026-90530 ColdFusion RDS is affected by an Improper Limitation of a Pathname to a Restrict... |
critical | 9.3 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-93895 IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could all... |
critical | 9.1 | — | Ibm / websphere application server | 2026-10-13 | 2026-10-22 |
| CVE-2026-93909 IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 is vulnera... |
critical | 9.1 | — | Ibm / websphere application server | 2026-10-13 | 2026-10-22 |
| CVE-2026-75994 ColdFusion is affected by an Incorrect Authorization vulnerability that could re... |
critical | 9.6 | — | Adobe / coldfusion | 2026-10-13 | 2026-10-20 |
| CVE-2026-49950 Xorbits Xoscar through 0.11.2 contains an unauthenticated deserialization vulner... |
critical | 9.8 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-106619 ColdFusion is affected by an Improper Input Validation vulnerability that could... |
critical | 9.0 | — | Adobe / coldfusion | 2026-10-13 | 2026-10-15 |
| CVE-2026-106620 ColdFusion is affected by an Incorrect Authorization vulnerability that could re... |
critical | 9.6 | — | Adobe / coldfusion | 2026-10-13 | 2026-10-15 |
| CVE-2026-106621 ColdFusion is affected by an Improper Control of Generation of Code ('Code Injec... |
critical | 9.1 | — | Adobe / coldfusion | 2026-10-13 | 2026-10-15 |
| CVE-2026-106622 ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability tha... |
critical | 10.0 | — | Adobe / coldfusion | 2026-10-13 | 2026-10-15 |
| CVE-2026-106624 ColdFusion is affected by an Improper Control of Generation of Code ('Code Injec... |
critical | 10.0 | — | Adobe / coldfusion | 2026-10-13 | 2026-10-15 |
| CVE-2026-106612 ColdFusion is affected by an Incorrect Authorization vulnerability that could re... |
critical | 9.9 | — | Adobe / coldfusion | 2026-10-13 | 2026-10-16 |
| CVE-2026-105899 ColdFusion is affected by an Unrestricted Upload of File with Dangerous Type vul... |
critical | 10.0 | — | Adobe / coldfusion | 2026-10-13 | 2026-10-20 |
| CVE-2026-105903 ColdFusion is affected by an Improper Control of Generation of Code ('Code Injec... |
critical | 9.9 | — | Adobe / coldfusion | 2026-10-13 | 2026-10-16 |
| CVE-2026-90531 Adobe Experience Manager is affected by an Improper Restriction of XML External... |
critical | 9.6 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-90532 Adobe Experience Manager is affected by an Incorrect Authorization vulnerability... |
critical | 10.0 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-83662 Adobe Experience Manager is affected by a reflected Cross-Site Scripting (XSS) v... |
critical | 9.3 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-75732 Adobe Experience Manager is affected by an Incorrect Authorization vulnerability... |
critical | 9.9 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-63146 Omnispace Agora Project before 26.10.0 contains a code injection vulnerability w... |
critical | 9.8 | — | — | 2026-10-13 | 2026-10-17 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.