October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,479
Critical
1,340
High
5,869
Medium
6,256
Low
648
Severity not reported
3,366
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1307), google (756), oracle (156), ibm (140), adobe (138), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-94064 Deserialization of Untrusted Data vulnerability in BuddhaThemes Neo | Barber Sho... |
high | 8.8 | — | — | 2026-10-09 | 2026-10-11 |
| CVE-2026-94065 Deserialization of Untrusted Data vulnerability in BuddhaThemes ColorFolio color... |
high | 8.8 | — | — | 2026-10-09 | 2026-10-11 |
| CVE-2026-94066 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-94063 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-62026 Cross-Site Request Forgery (CSRF) vulnerability in MIGHTYminnow Dashboard Notes... |
high | 7.1 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-104629 A component loading mechanism in openPDC and openHistorian will construct and ru... |
high | 8.8 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-105281 The internal data publisher on openPDC accepts network connections without authe... |
high | 7.5 | — | — | 2026-10-09 | 2026-10-11 |
| CVE-2026-94061 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-09 | 2026-10-11 |
| CVE-2026-94062 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP... |
high | 8.1 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-94058 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-94059 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-94060 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-09 | 2026-10-11 |
| CVE-2026-105883 Missing Authorization vulnerability in ThemeHunk Th Shop Mania th-shop-mania all... |
high | 7.1 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-104392 Deserialization of Untrusted Data vulnerability in ExpressTech Quiz And Survey M... |
high | 8.8 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-105318 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-105870 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-09 | 2026-10-11 |
| CVE-2026-105872 Deserialization of Untrusted Data vulnerability in mklacroix Product Configurato... |
high | 7.2 | — | — | 2026-10-09 | 2026-10-11 |
| CVE-2026-103412 Improper limitation of a pathname to a restricted directory ('path traversal') v... |
high | 8.8 | — | — | 2026-10-09 | 2026-10-15 |
| CVE-2026-103413 Improper input validation vulnerability in Apache Camel Karavan. |
high | 8.8 | — | — | 2026-10-09 | 2026-10-15 |
| CVE-2026-86463 Apache CXF's FIQL query parser has a vulnerability in how it searches for operat... |
high | 7.5 | — | Apache / cxf | 2026-10-09 | 2026-10-20 |
| CVE-2026-97791 In Apache CXF, STSTokenValidator checks whether a SAML assertion is signed by a... |
high | 7.5 | — | Apache / cxf | 2026-10-09 | 2026-10-20 |
| CVE-2026-107937 In Apache CXF, the parser for multipart/MTOM attachment part headers did not ful... |
high | 7.5 | — | Apache / cxf | 2026-10-09 | 2026-10-16 |
| CVE-2026-108039 By default, StaxUtils placed no limit on the total number of elements or the tot... |
high | 7.5 | — | Apache / cxf | 2026-10-09 | 2026-10-16 |
| CVE-2026-73179 Improper enforcement of single-use authorization code semantics in the JPA OAuth... |
high | 8.1 | — | Apache / cxf | 2026-10-09 | 2026-10-20 |
| CVE-2026-78384 CompressionUtils.inflate() decompressed attacker-controlled DEFLATE data with no... |
high | 7.5 | — | Apache / cxf | 2026-10-09 | 2026-10-20 |
| CVE-2026-100227 Improper Verification of Cryptographic Signature vulnerability in Apache CXF's J... |
high | 7.5 | — | Apache / cxf | 2026-10-09 | 2026-10-16 |
| CVE-2026-96461 Missing Authorization vulnerability in TMS Amelia ameliabooking allows Exploitin... |
high | 7.5 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-96553 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-09 | 2026-10-11 |
| CVE-2026-96607 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-96671 Cross-Site Request Forgery (CSRF) vulnerability in fifu.app Featured Image from... |
high | 8.8 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-96761 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-96332 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-96333 Authentication Bypass by Spoofing vulnerability in Liquid Web / StellarWP GiveWP... |
high | 7.5 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-96336 Authentication Bypass by Spoofing vulnerability in WPMU DEV Forminator forminato... |
high | 7.5 | — | — | 2026-10-09 | 2026-10-11 |
| CVE-2026-95608 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-09 | 2026-10-11 |
| CVE-2026-95609 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-09 | 2026-10-11 |
| CVE-2026-95610 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
high | 8.5 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-96329 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
high | 8.5 | — | — | 2026-10-09 | 2026-10-11 |
| CVE-2026-95591 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-95596 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-09 | 2026-10-11 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.