October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,479
Critical
1,340
High
5,869
Medium
6,256
Low
648
Severity not reported
3,366
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1307), google (756), oracle (156), ibm (140), adobe (138), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-93548 The FooSales WordPress plugin before 1.43.3 does not verify that an authenticate... |
high | 8.8 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-97076 Executable Regular Expression Error vulnerability in WP Media WP Rocket wp-rocke... |
high | 7.5 | — | — | 2026-10-09 | 2026-10-11 |
| CVE-2026-81929 The Ocean Pro Demos and Ocean eComm Treasure Box plugins for WordPress is vulner... |
high | 7.2 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2025-15700 The AWP Classifieds WordPress plugin before 4.4.9 does not validate the type of... |
high | 8.8 | — | — | 2026-10-09 | 2026-10-19 |
| CVE-2026-107910 An improper authentication vulnerability in the is_authenticated function (src/b... |
high | 8.1 | — | — | 2026-10-09 | 2026-10-15 |
| CVE-2026-107911 A type confusion vulnerability in the _read_flags function (src/commands/cmd_dis... |
high | 7.5 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-107914 Backdrop CMS 1.34 before 1.34.5 and 1.35 before 1.35.1 doesn't sufficiently prot... |
high | 7.8 | — | — | 2026-10-09 | 2026-10-14 |
| CVE-2026-7827 A stack-based buffer overflow in the _RdbLoadEntity function of the RDB graph de... |
high | 8.1 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-97031 Multiple ECH outer extension references are not permitted under RFC 9849; previo... |
high | 7.5 | — | — | 2026-10-08 | 2026-10-09 |
| CVE-2026-97032 HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK en... |
high | 7.5 | — | — | 2026-10-08 | 2026-10-15 |
| CVE-2026-94444 Previously, a user operating inside of a malicious Go project that defines a bog... |
high | 7.8 | — | — | 2026-10-08 | 2026-10-15 |
| CVE-2026-94447 Previously, a user operating inside of a malicious Go project that defines a bog... |
high | 7.8 | — | — | 2026-10-08 | 2026-10-15 |
| CVE-2026-78669 A malicious HTTP/2 peer can cause excessive CPU consumption in the client or ser... |
high | 7.5 | — | — | 2026-10-08 | 2026-10-09 |
| CVE-2026-83943 Exposure of sensitive information to an unauthorized actor in Azure API Center a... |
high | 8.7 | — | — | 2026-10-08 | 2026-10-31 |
| CVE-2026-94439 When an HTTP server handler sends a 2xx response to an HTTP/1 CONNECT request an... |
high | 7.5 | — | — | 2026-10-08 | 2026-10-09 |
| CVE-2026-94440 Parsing a multipart form can bypass memory limits and read an arbitrarily long l... |
high | 7.5 | — | — | 2026-10-08 | 2026-10-09 |
| CVE-2026-78659 When "Trailer" headers are sent by a client, the HTTP server internally uses the... |
high | 7.5 | — | — | 2026-10-08 | 2026-10-09 |
| CVE-2026-78660 Historically, we have been rather lax about malformed framing-related headers in... |
high | 7.5 | — | — | 2026-10-08 | 2026-10-09 |
| CVE-2026-78667 When parsing a Range header containing a large number of small ranges, FileServe... |
high | 7.5 | — | — | 2026-10-08 | 2026-10-09 |
| CVE-2026-69435 Missing authorization in Azure SRE Agent allows an authorized attacker to elevat... |
high | 8.1 | — | Microsoft / azure sre agent | 2026-10-08 | 2026-10-15 |
| CVE-2026-56866 When http.Transport sends an HTTP/1 CONNECT request with a non-empty Request.Bod... |
high | 7.5 | — | — | 2026-10-08 | 2026-10-09 |
| CVE-2026-107728 Strawberry GraphQL is a library for creating GraphQL APIs. |
high | 7.5 | — | — | 2026-10-08 | 2026-10-14 |
| CVE-2026-89091 A flaw was found in ansible-core. |
high | 8.8 | — | — | 2026-10-08 | 2026-10-09 |
| CVE-2026-84875 IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker... |
high | 8.8 | — | Ibm / guardium data protection | 2026-10-08 | 2026-10-15 |
| CVE-2026-84891 IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker... |
high | 7.5 | — | Ibm / guardium data protection | 2026-10-08 | 2026-10-15 |
| CVE-2026-84032 IBM Guardium Data Protection 12.2.2 could allow a remote attacker to conduct a m... |
high | 8.1 | — | Ibm / guardium data protection | 2026-10-08 | 2026-10-14 |
| CVE-2026-107720 fast-jwt provides fast JSON Web Token (JWT) implementation. |
high | 7.4 | — | — | 2026-10-08 | 2026-10-09 |
| CVE-2026-107723 fast-jwt provides fast JSON Web Token (JWT) implementation. |
high | 8.1 | — | — | 2026-10-08 | 2026-10-14 |
| CVE-2026-107724 fast-jwt provides fast JSON Web Token (JWT) implementation. |
high | 7.4 | — | — | 2026-10-08 | 2026-10-09 |
| CVE-2026-95116 An issue in libming through 0.4.8 allows a remote attacker to cause a denial of... |
high | 7.5 | — | — | 2026-10-08 | 2026-10-10 |
| CVE-2026-78388 IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access... |
high | 8.8 | — | Ibm / security verify access | 2026-10-08 | 2026-10-12 |
| CVE-2026-19491 IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access... |
high | 7.5 | — | Ibm / security verify access | 2026-10-08 | 2026-10-10 |
| CVE-2026-19493 IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access... |
high | 7.5 | — | Ibm / security verify access | 2026-10-08 | 2026-10-12 |
| CVE-2026-19498 IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access... |
high | 7.5 | — | Ibm / security verify access | 2026-10-08 | 2026-10-09 |
| CVE-2026-16823 IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access... |
high | 7.5 | — | Ibm / security verify access | 2026-10-08 | 2026-10-10 |
| CVE-2026-16916 IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access... |
high | 8.8 | — | Ibm / security verify access | 2026-10-08 | 2026-10-10 |
| CVE-2026-18740 IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access... |
high | 8.8 | — | Ibm / security verify access | 2026-10-08 | 2026-10-10 |
| CVE-2026-19482 IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access... |
high | 8.8 | — | Ibm / security verify access | 2026-10-08 | 2026-10-10 |
| CVE-2026-12109 IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access... |
high | 7.2 | — | Ibm / security verify access | 2026-10-08 | 2026-10-10 |
| CVE-2026-11888 IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access... |
high | 7.5 | — | Ibm / security verify access | 2026-10-08 | 2026-10-10 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.