October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,479
Critical
1,340
High
5,869
Medium
6,256
Low
648
Severity not reported
3,366
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1307), google (756), oracle (156), ibm (140), adobe (138), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-104406 Unauthenticated Broken Access Control in picu <= 3.10.1 versions. |
high | 7.3 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-104670 Unauthenticated Cross Site Scripting (XSS) in LearnPress <= 4.4.9 versions. |
high | 7.1 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-104672 Unauthenticated Cross Site Scripting (XSS) in GiveWP <= 4.17.0 versions. |
high | 7.1 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-104747 Unauthenticated PHP Object Injection in Haaken <= 1.5 versions. |
high | 8.1 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-104757 Editor Privilege Escalation in Import and export users and customers <= 2.5.5 ve... |
high | 7.2 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-104814 Unauthenticated Cross Site Scripting (XSS) in Form Block <= 1.8.1 versions. |
high | 7.1 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-104387 Unauthenticated Broken Access Control in PowerPress Podcasting <= 11.17.9 versio... |
high | 7.2 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-104394 Unauthenticated Cross Site Scripting (XSS) in Charitable <= 1.8.12.3 versions. |
high | 7.1 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-104395 Unauthenticated Cross Site Scripting (XSS) in picu <= 3.10.1 versions. |
high | 7.1 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-102387 Unauthenticated Sensitive Data Exposure in Xserver Migrator <= 1.6.6 versions. |
high | 7.5 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-102915 Subscriber Broken Access Control in WPO365 <= 44.1 versions. |
high | 8.5 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-103346 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-104385 Unauthenticated Sensitive Data Exposure in Groundhogg <= 4.8.3 versions. |
high | 7.5 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-105807 A vulnerability was found in SourceCodester Simple Student Information System 1.... |
high | 7.3 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-57559 Memory corruption while processing service requests. |
high | 7.8 | — | Qualcomm / cologne firmware | 2026-10-06 | 2026-10-09 |
| CVE-2026-25302 Cryptographic Issue when processing non-ELF partitions, authentication and signa... |
high | 7.1 | — | Qualcomm / xrv9209 firmware | 2026-10-06 | 2026-10-09 |
| CVE-2026-57537 Memory Corruption when accessing and modifying geographic mapping data concurren... |
high | 7.8 | — | Qualcomm / congo firmware | 2026-10-06 | 2026-10-09 |
| CVE-2026-57545 Memory corruption when processing draw objects of incorrect type during graphics... |
high | 7.8 | — | Qualcomm / snapdragon g1 gen 2 gaming platform firmware | 2026-10-06 | 2026-10-09 |
| CVE-2026-57546 Transient DOS when processing a continuous receive command with a zero-sized glo... |
high | 7.5 | — | Qualcomm / congo firmware | 2026-10-06 | 2026-10-09 |
| CVE-2026-57554 Memory Corruption when asynchronous threads access shared performance counter da... |
high | 7.8 | — | Qualcomm / snapdragon g1 gen 2 gaming platform firmware | 2026-10-06 | 2026-10-09 |
| CVE-2026-57555 Memory Corruption when executing system service routines due to improper handlin... |
high | 7.8 | — | Qualcomm / cologne firmware | 2026-10-06 | 2026-10-09 |
| CVE-2026-25291 Memory corruption when performing concurrent operations on shared memory page li... |
high | 7.8 | — | Qualcomm / sar1165p firmware | 2026-10-06 | 2026-10-09 |
| CVE-2026-105701 The ACPT (Premium) plugin for WordPress is vulnerable to Remote Code Execution i... |
high | 8.8 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-105776 A flaw has been found in bhagya3929 Employee-Movement-Tracking-and-Monitoring-We... |
high | 7.3 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-25267 Memory corruption when non-secure loader rewrites page tables before secure memo... |
high | 7.8 | — | Qualcomm / qca6698au firmware | 2026-10-06 | 2026-10-09 |
| CVE-2026-39760 Unauthenticated Cross Site Scripting (XSS) in Real 3D FlipBook <= 5.5 versions. |
high | 7.1 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-39789 Unauthenticated Broken Access Control in Fluent Affiliate Pro <= 1.6.4 versions. |
high | 7.5 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-41558 Subscriber Bypass Vulnerability in WP Migration Plugin DB & Files – WP Synchro <... |
high | 7.5 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-41563 Unauthenticated Sensitive Data Exposure in Sitemovr <= 1.0.1 versions. |
high | 7.5 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-75962 The Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs,... |
high | 7.2 | — | — | 2026-10-06 | 2026-10-09 |
| CVE-2026-39723 Missing Authorization vulnerability in Green Invoice Morning for WooCommerce wc-... |
high | 7.5 | — | — | 2026-10-06 | 2026-10-08 |
| CVE-2026-105072 Unauthenticated Broken Access Control in FluentBooking Pro < 2.5.0 versions. |
high | 7.5 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-105704 A vulnerability was identified in SourceCodester Drug Recommendation System 1.0. |
high | 7.3 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-105486 A vulnerability was detected in OSSRS srs up to 7.0-a1. |
high | 7.3 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-105571 A flaw has been found in PickMall Lilishop up to 4.2.4. |
high | 7.3 | — | — | 2026-10-06 | 2026-10-08 |
| CVE-2026-82988 There exists an arbitrary file download in vCast APK delivery mechanism in ViewS... |
high | 7.5 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-105762 Dify is an open-source LLM app development platform. |
high | 8.3 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-105782 Scrapy is a high-level web crawling and scraping framework for Python. |
high | 7.5 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-105783 Joplin is an open source note-taking and to-do application that organises notes... |
high | 8.0 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-105471 A security flaw has been discovered in girishsaraf Online-Appointment-Booking-Sy... |
high | 7.3 | — | — | 2026-10-06 | 2026-10-06 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.