October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,479
Critical
1,340
High
5,869
Medium
6,256
Low
648
Severity not reported
3,366
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1307), google (756), oracle (156), ibm (140), adobe (138), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-98229 In the Linux kernel, the following vulnerability has been resolved:
xfrm: save... |
high | 7.8 | — | — | 2026-10-06 | 2026-10-19 |
| CVE-2026-98230 In the Linux kernel, the following vulnerability has been resolved:
xfrm: use h... |
high | 7.0 | — | — | 2026-10-06 | 2026-10-19 |
| CVE-2026-98216 In the Linux kernel, the following vulnerability has been resolved:
IB/hfi1: Fi... |
high | 7.1 | — | — | 2026-10-06 | 2026-10-19 |
| CVE-2026-98197 In the Linux kernel, the following vulnerability has been resolved:
hwmon: (w83... |
high | 7.0 | — | — | 2026-10-06 | 2026-10-19 |
| CVE-2026-98180 In the Linux kernel, the following vulnerability has been resolved:
drm/msm: RC... |
high | 7.1 | — | — | 2026-10-06 | 2026-10-19 |
| CVE-2026-98173 In the Linux kernel, the following vulnerability has been resolved:
smb: client... |
high | 7.5 | — | — | 2026-10-06 | 2026-10-30 |
| CVE-2026-98174 In the Linux kernel, the following vulnerability has been resolved:
smb: client... |
high | 7.5 | — | — | 2026-10-06 | 2026-10-19 |
| CVE-2026-98175 In the Linux kernel, the following vulnerability has been resolved:
smb: client... |
high | 7.5 | — | — | 2026-10-06 | 2026-10-19 |
| CVE-2026-98166 In the Linux kernel, the following vulnerability has been resolved:
drm/ttm: fi... |
high | 7.8 | — | — | 2026-10-06 | 2026-10-26 |
| CVE-2026-98169 In the Linux kernel, the following vulnerability has been resolved:
smb: client... |
high | 7.1 | — | — | 2026-10-06 | 2026-10-30 |
| CVE-2026-98171 In the Linux kernel, the following vulnerability has been resolved:
smb: client... |
high | 8.8 | — | — | 2026-10-06 | 2026-10-30 |
| CVE-2026-94675 Unauthenticated Cross Site Scripting (XSS) in Fluent Forms Pro Add On Pack <= 6.... |
high | 7.1 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-95526 Unauthenticated Broken Access Control in BEAR <= 1.2.2 versions. |
high | 7.3 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-95594 Incorrect Privilege Assignment vulnerability in Cozy Vision Technologies Pvt. |
high | 8.1 | — | — | 2026-10-06 | 2026-10-12 |
| CVE-2026-62072 Subscriber Broken Access Control in Progress Planner <= 1.10.0 versions. |
high | 8.8 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-42634 Unauthenticated Cross Site Scripting (XSS) in Video Background Block – Use video... |
high | 7.1 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-42635 Unauthenticated Cross Site Scripting (XSS) in WooCommerce Simple Auctions <= 3.0... |
high | 7.1 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-42636 Unauthenticated Cross Site Scripting (XSS) in WP Cookie Notice for GDPR, CCPA &... |
high | 7.1 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-42638 Missing Authorization vulnerability in Awesomemotive Easy Digital Downloads easy... |
high | 7.5 | — | — | 2026-10-06 | 2026-10-07 |
| CVE-2026-48197 Incorrect Privilege Assignment vulnerability in PublishPress PublishPress Capabi... |
high | 7.2 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-48199 Unauthenticated Broken Access Control in Sermon'e <= 1.0.2 versions. |
high | 7.5 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-41562 Unauthenticated Sensitive Data Exposure in Norvis Backup <= 1.1.0 versions. |
high | 7.5 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-42413 Unauthenticated Sensitive Data Exposure in Snapshotify – All-in-One Backup & Res... |
high | 7.5 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-42414 Subscriber SQL Injection in ListingPro <= 2.9.12 versions. |
high | 8.5 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-42416 Subscriber SQL Injection in UDesign Core <= 4.15.0 versions. |
high | 8.5 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-42418 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-06 | 2026-10-07 |
| CVE-2026-40806 Unauthenticated Cross Site Scripting (XSS) in Blog, Posts and Category Filter fo... |
high | 7.1 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-40807 Unauthenticated Cross Site Scripting (XSS) in CF7 Views – Complete Entry Managem... |
high | 7.1 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-41559 Unauthenticated Sensitive Data Exposure in SafeSnap – Verified WordPress Backup... |
high | 7.5 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-41560 Unauthenticated Broken Access Control in WXD Backup Lite <= 1.0.2 versions. |
high | 7.5 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-41561 Unauthenticated Sensitive Data Exposure in Museder RestoreOne <= 2.7.276 version... |
high | 7.5 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-39792 Unauthenticated Arbitrary File Deletion in Simple File List <= 6.3.11 versions. |
high | 8.6 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-39793 Subscriber Broken Authentication in Simple JWT Login 4.0.0 versions. |
high | 8.8 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-39794 Unauthenticated Broken Access Control in WooCommerce Multivendor Marketplace – R... |
high | 7.5 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-39796 Unauthenticated Broken Access Control in Advanced Posts Listing – Show Post List... |
high | 7.5 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-39790 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-06 | 2026-10-08 |
| CVE-2026-39774 Unauthenticated Privilege Escalation in Tourfic Pro <= 1.17.3 versions. |
high | 8.8 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-39775 Subscriber Privilege Escalation in JobZilla - Job Board WordPress Theme <= 2.2 v... |
high | 8.8 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-39776 Editor Remote Code Execution (RCE) in Tabs <= 2.5 versions. |
high | 8.0 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-39778 Unauthenticated Cross Site Scripting (XSS) in Ansar Import – One Click Starter S... |
high | 7.1 | — | — | 2026-10-06 | 2026-10-06 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.