October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,479
Critical
1,340
High
5,869
Medium
6,256
Low
648
Severity not reported
3,366
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1307), google (756), oracle (156), ibm (140), adobe (138), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-95670 The No External Links plugin for WordPress is vulnerable to Stored Cross-Site Sc... |
high | 7.2 | — | — | 2026-10-02 | 2026-10-03 |
| CVE-2026-95817 The DoFollow Case by Case plugin for WordPress is vulnerable to Stored Cross-Sit... |
high | 7.2 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-63572 Allocation of resources without limits in PKCS#12 keystore loading (Pkcs12Store.... |
high | 7.5 | — | Bouncycastle / bc-csharp | 2026-10-02 | 2026-10-28 |
| CVE-2026-63573 Observable discrepancy in the CMS RSA PKCS#1 v1.5 key-transport unwrap (KeyTrans... |
high | 7.5 | — | Bouncycastle / bc-csharp | 2026-10-02 | 2026-10-28 |
| CVE-2026-63574 Memory allocation with excessive size value in the OpenPGP signature and user at... |
high | 7.5 | — | Bouncycastle / bc-csharp | 2026-10-02 | 2026-10-28 |
| CVE-2026-63575 Loop with unreachable exit condition in the PKCS#12 key derivation (Pkcs12Parame... |
high | 7.5 | — | Bouncycastle / bc-csharp | 2026-10-02 | 2026-10-28 |
| CVE-2026-63576 Improper certificate validation in PkixNameConstraintValidator (ExtractHostFromU... |
high | 7.5 | — | Bouncycastle / bc-csharp | 2026-10-02 | 2026-10-28 |
| CVE-2026-63577 Improper certificate validation in the directoryName name-constraint check (Pkix... |
high | 7.5 | — | Bouncycastle / bc-csharp | 2026-10-02 | 2026-10-28 |
| CVE-2026-17507 In Bouncy Castle for Java before 1.86, the MLS implementation (org.bouncycastle.... |
high | 7.5 | — | Bouncycastle / bc-java | 2026-10-02 | 2026-10-14 |
| CVE-2026-63570 Loop with unreachable exit condition in Pkcs12Store.GetCertificateChain in Legio... |
high | 7.5 | — | Bouncycastle / bc-csharp | 2026-10-02 | 2026-10-28 |
| CVE-2026-63571 Improper verification of cryptographic signature in the attribute certificate pa... |
high | 7.5 | — | Bouncycastle / bc-csharp | 2026-10-02 | 2026-10-28 |
| CVE-2026-102772 The CMB2 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via t... |
high | 7.2 | — | — | 2026-10-02 | 2026-10-03 |
| CVE-2026-103426 The Relevanssi Premium plugin for WordPress is vulnerable to Stored Cross-Site S... |
high | 7.2 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-103600 Uncontrolled recursion in the ASN.1 parser (Asn1InputStream, Asn1StreamParser) i... |
high | 7.5 | — | Bouncycastle / bc-csharp | 2026-10-02 | 2026-10-28 |
| CVE-2026-103601 Release of unverified plaintext in the CCM (CcmBlockCipher) and DSTU 7624 CCM (K... |
high | 7.5 | — | Bouncycastle / bc-csharp | 2026-10-02 | 2026-10-28 |
| CVE-2026-103603 Memory allocation with excessive size value in the HSS/LMS signature code (HssPu... |
high | 7.5 | — | Bouncycastle / bc-csharp | 2026-10-02 | 2026-10-28 |
| CVE-2026-103604 Inefficient algorithmic complexity in X.509 distinguished name string conversion... |
high | 7.5 | — | Bouncycastle / bc-csharp | 2026-10-02 | 2026-10-28 |
| CVE-2026-100182 The Download Monitor plugin for WordPress is vulnerable to Stored Cross-Site Scr... |
high | 7.2 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-100107 The Kubio AI Page Builder plugin for WordPress is vulnerable to Stored Cross-Sit... |
high | 7.2 | — | — | 2026-10-02 | 2026-10-03 |
| CVE-2026-63567 Observable discrepancy in IesEngine.DecryptBlock in Legion of the Bouncy Castle... |
high | 7.5 | — | Bouncycastle / bc-csharp | 2026-10-02 | 2026-10-27 |
| CVE-2026-63568 Allocation of resources without limits or throttling in the CMP/CRMF password-ba... |
high | 7.5 | — | Bouncycastle / bc-csharp | 2026-10-02 | 2026-10-27 |
| CVE-2026-15999 Improper validation of integrity check value in the AES-CCM implementation (CcmP... |
high | 7.5 | — | Bouncycastle / bc-csharp | 2026-10-02 | 2026-10-27 |
| CVE-2026-16000 Missing cryptographic step in the DSTU 7624 CCM mode implementation (KCcmBlockCi... |
high | 7.5 | — | Bouncycastle / bc-csharp | 2026-10-02 | 2026-10-27 |
| CVE-2026-16001 Exposure of the message authentication key through the encryption keystream in t... |
high | 7.5 | — | Bouncycastle / bc-csharp | 2026-10-02 | 2026-10-27 |
| CVE-2026-63566 Memory allocation with excessive size value in the DTLS handshake reassembly (Dt... |
high | 7.5 | — | Bouncycastle / bc-csharp | 2026-10-02 | 2026-10-27 |
| CVE-2026-102565 The BA Book Everything plugin for WordPress is vulnerable to Stored Cross-Site S... |
high | 7.2 | — | — | 2026-10-02 | 2026-10-03 |
| CVE-2026-92174 The SiteOrigin Widgets Bundle plugin for WordPress is vulnerable to Local File I... |
high | 7.5 | — | — | 2026-10-02 | 2026-10-03 |
| CVE-2026-92820 The Ninja Forms - File Uploads plugin for WordPress is vulnerable to arbitrary f... |
high | 8.1 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-90438 The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPr... |
high | 7.2 | — | — | 2026-10-02 | 2026-10-03 |
| CVE-2026-91828 The OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. |
high | 7.5 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-15897 The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to... |
high | 8.8 | — | — | 2026-10-02 | 2026-10-03 |
| CVE-2026-10026 The CTX Feed Pro plugin for WordPress is vulnerable to Code Injection in all ver... |
high | 7.2 | — | — | 2026-10-02 | 2026-10-03 |
| CVE-2026-93367 The Visitors Traffic Real Time Statistics Pro plugin for WordPress is vulnerable... |
high | 7.2 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-104123 A vulnerability was detected in SourceCodester Online Reviewer Management System... |
high | 7.3 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-104120 A security vulnerability has been detected in modelcontextprotocol mcp-server-fe... |
high | 7.3 | — | — | 2026-10-02 | 2026-10-06 |
| CVE-2026-103097 An API key is
hardcoded and retrievable from the application package. |
high | 7.5 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-103098 Transmission of a sensitive key in the URL
over an unencrypted HTTP connection. |
high | 7.5 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-103096 API
key is hardcoded and retrievable from the application package. |
high | 7.5 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-103766 ClipBucket v5 through 5.5.3-#197 contains an sql injection vulnerability that al... |
high | 7.2 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-103761 Mooncake transfer engine through 0.3.13.post1 contains a memory exhaustion vulne... |
high | 7.5 | — | — | 2026-10-01 | 2026-10-06 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.