October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,479
Critical
1,340
High
5,869
Medium
6,256
Low
648
Severity not reported
3,366
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1307), google (756), oracle (156), ibm (140), adobe (138), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-104464 YesWiki before 4.6.7 contains a server-side request forgery vulnerability that a... |
high | 8.6 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-104456 YesWiki before 4.6.7 contains a second-order SQL injection vulnerability in AclS... |
high | 7.6 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-104457 YesWiki before 4.6.7 contains an SQL injection vulnerability in the Bazar filter... |
high | 8.6 | — | — | 2026-10-02 | 2026-10-06 |
| CVE-2026-104448 YesWiki before 4.6.7 contains a cross-site request forgery vulnerability in the... |
high | 8.1 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-104443 YesWiki before 4.6.7 contains an empty-filter scope bypass in the triples delete... |
high | 8.1 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-104444 YesWiki before 4.6.7 contains an authorization bypass vulnerability in the comme... |
high | 7.1 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-104445 YesWiki before 4.6.7 contains an authentication bypass vulnerability in the Acti... |
high | 8.2 | — | — | 2026-10-02 | 2026-10-06 |
| CVE-2026-104447 YesWiki before 4.6.7 contains a cross-site request forgery vulnerability in the... |
high | 7.1 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-104435 Zebra zebrad 4.4.0 and zebra-script 6.0.0 fail to enforce a ZIP-244 consensus ru... |
high | 7.4 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-104437 Zebra before 4.4.0 contains a consensus divergence vulnerability in V5 transpare... |
high | 7.4 | — | — | 2026-10-02 | 2026-10-06 |
| CVE-2026-104430 Zebra zebrad 4.5.0 and zebra-script 7.0.0 count P2SH redeem script signature ope... |
high | 7.5 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-104431 Zebra before 6.0.0 contains a denial of service vulnerability that allows unauth... |
high | 7.5 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-104422 The block sync download path in Zebra (zebrad) before 6.3.0 reads a block's heig... |
high | 7.5 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-104423 Zebra (zebrad) before 6.2.1 contains an asymmetric resource consumption vulnerab... |
high | 7.5 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-104414 Ghost from 2.5.0 before 6.64.0 contains a stored cross-site scripting vulnerabil... |
high | 8.1 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-104416 Ghost from 4.39.0 before 6.64.0 contains an information disclosure vulnerability... |
high | 7.5 | — | — | 2026-10-02 | 2026-10-06 |
| CVE-2026-104418 Ghost from 6.10.3 before 6.64.0 contains a remote code execution vulnerability t... |
high | 7.2 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-104410 SiYuan before 3.8.5 contains an information disclosure vulnerability that allows... |
high | 7.5 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-104411 Ghost from 6.22.1 before 6.64.0 contains a stored cross-site scripting vulnerabi... |
high | 7.3 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-104413 Ghost from 5.94.0 before 6.64.0 contains a stored cross-site scripting vulnerabi... |
high | 7.3 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-94651 improper handling of exceptional conditions, Missing release of resource after e... |
high | 7.5 | — | — | 2026-10-02 | 2026-10-07 |
| CVE-2026-85494 Improper handling of length parameter inconsistency, Uncaught exception, Ineffic... |
high | 7.5 | — | — | 2026-10-02 | 2026-10-07 |
| CVE-2026-80298 Improper neutralization of special elements used in an SQL command ('SQL injecti... |
high | 8.8 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-87920 The W3 Total Cache plugin for WordPress is vulnerable to Stored Cross-Site Scrip... |
high | 7.2 | — | — | 2026-10-02 | 2026-10-03 |
| CVE-2026-103552 Stack Overflow vulnerability in Apache Directory LDAP API. |
high | 7.3 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-103878 Cleartext transmission of sensitive information vulnerability in Apache Director... |
high | 7.5 | — | — | 2026-10-02 | 2026-10-05 |
| CVE-2026-103880 Asymmetric Resource Consumption vulnerability in Apache Directory LDAP API. |
high | 7.5 | — | — | 2026-10-02 | 2026-10-05 |
| CVE-2026-103885 Asymmetric Resource Consumption vulnerability in Apache Directory LDAP API. |
high | 7.5 | — | — | 2026-10-02 | 2026-10-08 |
| CVE-2026-102731 Memory allocation with excessive size value vulnerability in Apache Directory LD... |
high | 7.5 | — | — | 2026-10-02 | 2026-10-05 |
| CVE-2026-80443 Improper certificate validation vulnerability in HAVELSAN Inc. |
high | 7.4 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-97663 The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to Store... |
high | 7.2 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-97342 The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnera... |
high | 7.2 | — | — | 2026-10-02 | 2026-10-03 |
| CVE-2026-97641 The Relevanssi – A Better Search plugin for WordPress is vulnerable to Stored Cr... |
high | 7.2 | — | — | 2026-10-02 | 2026-10-03 |
| CVE-2026-96566 The Newsletter – Send awesome emails from WordPress plugin for WordPress is vuln... |
high | 7.2 | — | — | 2026-10-02 | 2026-10-03 |
| CVE-2026-96567 The MW WP Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting... |
high | 7.2 | — | — | 2026-10-02 | 2026-10-03 |
| CVE-2026-96578 The GSpeech TTS – WordPress Text To Speech Plugin plugin for WordPress is vulner... |
high | 7.2 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-96871 The Mang Board plugin for WordPress is vulnerable to Stored Cross-Site Scripting... |
high | 7.2 | — | — | 2026-10-02 | 2026-10-03 |
| CVE-2026-97336 The CMB2 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via '... |
high | 7.2 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-63578 Allocation of resources without limits in password-based private-key decryption... |
high | 7.5 | — | Bouncycastle / bc-csharp | 2026-10-02 | 2026-10-28 |
| CVE-2026-93756 The Smash Balloon Social Post Feed – Simple Social Feeds for WordPress plugin fo... |
high | 7.2 | — | — | 2026-10-02 | 2026-10-03 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.