October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,479
Critical
1,340
High
5,869
Medium
6,256
Low
648
Severity not reported
3,366
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1307), google (756), oracle (156), ibm (140), adobe (138), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-103921 GraphQL Tools provides utilities for building, stitching, and mocking GraphQL sc... |
high | 7.4 | — | — | 2026-10-01 | 2026-10-02 |
| CVE-2026-12405 A flaw was found in rubygem-foreman_remote_execution. |
high | 8.8 | — | — | 2026-10-01 | 2026-10-07 |
| CVE-2026-12423 A flaw was found in Foreman. |
high | 7.5 | — | Redhat / satellite | 2026-10-01 | 2026-10-08 |
| CVE-2026-101888 The Prime Mover plugin for WordPress before 2.2.1 contains a Zip Slip path trave... |
high | 7.2 | — | — | 2026-10-01 | 2026-10-02 |
| CVE-2026-79896 Fortra BoKS Manager contains an out-of-bounds read vulnerability in the custom T... |
high | 7.5 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-46729 NULL Pointer Dereference vulnerability in Apache HTTP Servers mod_heartmonitor o... |
high | 7.5 | — | Apache / http server | 2026-10-01 | 2026-10-08 |
| CVE-2026-47360 Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apac... |
high | 7.5 | — | Apache / http server | 2026-10-01 | 2026-10-02 |
| CVE-2026-97273 Unauthenticated Cross Site Scripting (XSS) in Premmerce Wishlist for WooCommerce... |
high | 7.1 | — | — | 2026-10-01 | 2026-10-03 |
| CVE-2026-97277 Subscriber Broken Access Control in Social Boost <= 3.6.2 versions. |
high | 7.6 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-97284 Contributor PHP Object Injection in Icegram <= 3.1.31 versions. |
high | 8.8 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-97297 Subscriber Broken Access Control in Gratisfaction <= 4.6.3 versions. |
high | 7.6 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-97260 Unauthenticated Cross Site Scripting (XSS) in MaxGalleria <= 6.5.3 versions. |
high | 7.1 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-97268 Unauthenticated Cross Site Scripting (XSS) in Premmerce Wishlist for WooCommerce... |
high | 7.1 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-94390 Editor PHP Object Injection in Hide Shipping Method For WooCommerce <= 1.5.4 ver... |
high | 7.2 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-95588 Unauthenticated Arbitrary File Deletion in AcyMailing SMTP Newsletter <= 11.0.5... |
high | 8.6 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-67105 HCL BigFix Service Management is affected by an Insecure Communication vulnerabi... |
high | 7.4 | — | Hcltech / bigfix service management | 2026-10-01 | 2026-10-05 |
| CVE-2026-79899 Fortra BoKS Manager contains an insecure temporary file vulnerability in bccgeth... |
high | 7.9 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-56589 HCL BigFix Service Management is affected by a Stored Cross-Site Scripting (XSS)... |
high | 7.2 | — | Hcltech / bigfix service management | 2026-10-01 | 2026-10-05 |
| CVE-2026-62073 Unauthenticated Broken Access Control in WP Full Stripe Free <= 8.5.6 versions. |
high | 7.5 | — | — | 2026-10-01 | 2026-10-03 |
| CVE-2026-103687 A vulnerability has been found in rhukster dom-sanitizer up to 1.0.15. |
high | 7.3 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-103068 Subscriber Privilege Escalation in ByteCoreStack – MCP Connector for AI Tools <=... |
high | 8.8 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-102378 Unauthenticated Cross Site Scripting (XSS) in Parallax Section block <= 2.0.4 ve... |
high | 7.1 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2024-58388 Sharp (and Toshiba Tec rebranded) multifunction printers contain an unauthentica... |
high | 7.5 | — | — | 2026-10-01 | 2026-10-06 |
| CVE-2026-100514 Unauthenticated Insecure Direct Object References (IDOR) in REST API Log <= 1.7.... |
high | 7.5 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-100517 Unauthenticated Insecure Direct Object References (IDOR) in Photo Reviews for Wo... |
high | 7.5 | — | — | 2026-10-01 | 2026-10-30 |
| CVE-2026-66246 iControl is affected by a Broken Access Control vulnerability, which could allow... |
high | 8.8 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-102504 Imager versions before 1.037 for Perl exit the process reading a raw image with... |
high | 7.5 | — | Tonycoz / imager | 2026-10-01 | 2026-10-08 |
| CVE-2026-62059 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
high | 7.6 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-62060 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
high | 7.6 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-103067 Cross-Site Request Forgery (CSRF) vulnerability in Memberful Memberful - Members... |
high | 8.0 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-103338 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
high | 8.5 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-102379 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
high | 8.5 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-103678 A flaw was found in tnef. |
high | 8.1 | — | Tnef Project / tnef | 2026-10-01 | 2026-10-05 |
| CVE-2026-88789 Improper Restriction of XML External Entity Reference in the XSLT support extens... |
high | 8.6 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-103757 Budibase through 3.41.0 contains a server-side request forgery vulnerability in... |
high | 7.7 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-103758 Obot 0.21.1 through 0.24.1 contains an authorization bypass vulnerability that a... |
high | 8.1 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-103292 Ghost versions from 0.5.3 through versions prior to 6.50.0 fail to sanitize the... |
high | 8.0 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-103283 Ghost versions 6.20.0 before 6.57.1 contain a session handling vulnerability tha... |
high | 8.1 | — | — | 2026-10-01 | 2026-10-06 |
| CVE-2026-103286 Ghost versions from 2.21.0 before 6.56.0 contain a privilege escalation vulnerab... |
high | 7.3 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-103277 Ghost versions from 2.5.0 before 6.34.0 contain an untrusted script execution vu... |
high | 8.1 | — | — | 2026-10-01 | 2026-10-01 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.