October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,479
Critical
1,340
High
5,869
Medium
6,256
Low
648
Severity not reported
3,366
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1307), google (756), oracle (156), ibm (140), adobe (138), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-42710 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
high | 7.6 | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-106056 Rundeck before 6.2.0 contains an OS command injection vulnerability that allows... |
high | 7.5 | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-106057 patool before 4.0.6 contains an OS command injection vulnerability on Windows be... |
high | 7.8 | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-106058 GitAhead through 2.7.1 contains an OS command injection vulnerability in src/git... |
high | 7.5 | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-42713 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
high | 7.6 | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-42714 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
high | 7.6 | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-103668 An SQL Injection vulnerability exists in the Site Search function of Movable Typ... |
high | 8.6 | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-42720 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
high | 7.6 | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-42721 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
high | 7.6 | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-15894 The Bluetooth Mesh On-Demand Private Proxy solicitation handler in subsys/blueto... |
high | 8.8 | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-19186 ieee802154_decipher_data_frame() in subsys/net/l2/ieee802154/ieee802154_frame.c... |
high | 8.1 | — | — | 2026-10-07 | 2026-10-15 |
| CVE-2026-89417 The OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. |
high | 7.2 | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-97188 The String locator WordPress plugin before 2.6.8 does not restrict the classes a... |
high | 8.8 | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-82211 The Nexi XPay Build WordPress plugin through 7.6.2 does not verify the payment r... |
high | 8.2 | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-82212 The Nexi XPay Build WordPress plugin through 7.6.2 does not correctly validate t... |
high | 7.5 | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-87782 The Koinonia Link WordPress plugin before 1.1.5 does not check that a user is al... |
high | 8.8 | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-87971 The If-So Dynamic Content WordPress plugin before 1.10.2 does not validate the U... |
high | 7.1 | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-105316 The Magee Shortcodes WordPress plugin through 2.1.1 does not sanitise and escape... |
high | 7.1 | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-104677 The WP Coder WordPress plugin before 4.5.2 does not restrict access to its PHP c... |
high | 7.2 | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-59347 VMware Workstation and Fusion contain a stack-based buffer-overflow vulnerabilit... |
high | 8.1 | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-102173 The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordP... |
high | 7.2 | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-83540 When password or public key authentication is used with the Windows port of wolf... |
high | 8.8 | — | Wolfssh / wolfssh | 2026-10-07 | 2026-10-13 |
| CVE-2026-83742 Unsigned integer underflow in wstrncat() in src/port.c in wolfSSL wolfSSH from v... |
high | 8.8 | — | Wolfssh / wolfssh | 2026-10-07 | 2026-10-13 |
| CVE-2026-16516 wolfSSH does not validate that the ECDSA curve identifier in a KEXDH_REPLY host... |
high | 7.4 | — | Wolfssh / wolfssh | 2026-10-07 | 2026-10-13 |
| CVE-2026-106471 A flaw was found in Candlepin. |
high | 8.1 | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-97673 IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacke... |
high | 8.8 | — | Langflow / langflow | 2026-10-07 | 2026-10-08 |
| CVE-2026-97674 IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacke... |
high | 8.1 | — | Langflow / langflow | 2026-10-07 | 2026-10-08 |
| CVE-2026-97676 IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacke... |
high | 8.8 | — | Langflow / langflow | 2026-10-07 | 2026-10-08 |
| CVE-2026-97678 IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacke... |
high | 8.8 | — | Langflow / langflow | 2026-10-07 | 2026-10-08 |
| CVE-2026-97679 IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacke... |
high | 8.8 | — | Langflow / langflow | 2026-10-07 | 2026-10-08 |
| CVE-2026-97680 IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacke... |
high | 8.3 | — | Langflow / langflow | 2026-10-07 | 2026-10-08 |
| CVE-2026-93449 IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacke... |
high | 8.8 | — | Langflow / langflow | 2026-10-07 | 2026-10-08 |
| CVE-2026-93678 IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacke... |
high | 7.6 | — | Langflow / langflow | 2026-10-07 | 2026-10-09 |
| CVE-2026-97655 IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote attacker to execute a... |
high | 8.8 | — | Langflow / langflow | 2026-10-07 | 2026-10-08 |
| CVE-2026-88962 IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacke... |
high | 8.8 | — | Langflow / langflow | 2026-10-07 | 2026-10-08 |
| CVE-2026-93443 IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacke... |
high | 8.8 | — | Langflow / langflow | 2026-10-07 | 2026-10-08 |
| CVE-2026-93445 IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacke... |
high | 8.8 | — | Langflow / langflow | 2026-10-07 | 2026-10-08 |
| CVE-2026-93447 IBM Langflow OSS 1.0.0 through 1.12.2 could allow an attacker with access to the... |
high | 7.5 | — | Langflow / langflow | 2026-10-07 | 2026-10-08 |
| CVE-2026-104335 IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacke... |
high | 8.8 | — | Langflow / langflow | 2026-10-07 | 2026-10-09 |
| CVE-2026-106583 In ssh in OpenSSH before 10.6, a $ or \ character can occur in a command-line us... |
high | 7.8 | — | Openbsd / openssh | 2026-10-07 | 2026-10-15 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.