October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,479
Critical
1,340
High
5,869
Medium
6,256
Low
648
Severity not reported
3,366
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1307), google (756), oracle (156), ibm (140), adobe (138), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-103278 Ghost versions 5.8.0 before 6.34.0 contain an input validation vulnerability in... |
high | 7.3 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-103268 Ghost versions before 6.62.0 contain an authentication bypass vulnerability that... |
high | 8.8 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-103271 Ghost versions from 4.0.0 before 6.63.0 contain a content API vulnerability that... |
high | 7.5 | — | — | 2026-10-01 | 2026-10-06 |
| CVE-2026-103272 Ghost versions from 2.10.0 before 6.63.0 contain a staff enumeration vulnerabili... |
high | 7.5 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-103262 Tornado versions before 6.5.9 contain an unbounded memory accumulation vulnerabi... |
high | 7.5 | — | — | 2026-10-01 | 2026-10-06 |
| CVE-2026-103266 Ghost versions 5.2.0 through versions prior to 6.62.0 allow a remote attacker, w... |
high | 7.1 | — | — | 2026-10-01 | 2026-10-06 |
| CVE-2026-103257 n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2... |
high | 7.7 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-103259 n8n versions before 2.39.6 and 2.40.0 before 2.40.1 contain a session token leak... |
high | 7.6 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-103252 n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2... |
high | 7.7 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-103253 n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2... |
high | 8.7 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-103256 n8n versions before 2.39.6 and 2.40.0 before 2.40.1 contain a credentials leak v... |
high | 7.1 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-103247 n8n versions before 1.123.80 contain a credential tampering vulnerability where... |
high | 8.5 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-103249 n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2... |
high | 7.6 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-103250 n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2... |
high | 8.1 | — | — | 2026-10-01 | 2026-10-06 |
| CVE-2026-103251 n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2... |
high | 7.1 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-103082 Server-Side Request Forgery (SSRF) vulnerability in LA-Studio LA-Studio Element... |
high | 7.2 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-103246 n8n versions before 2.39.6 and 2.40.0 before 2.40.1 fail to validate credential... |
high | 7.7 | — | — | 2026-10-01 | 2026-10-06 |
| CVE-2026-92144 The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin f... |
high | 7.2 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-96577 A flaw was found in oc-mirror. |
high | 7.1 | — | — | 2026-10-01 | 2026-10-15 |
| CVE-2026-103490 In JetBrains YouTrack before 2026.2.19422 privilege escalation was possible via... |
high | 7.2 | — | Jetbrains / youtrack | 2026-10-01 | 2026-10-05 |
| CVE-2026-103493 In JetBrains YouTrack before 2026.2.19422 stored XSS via Mermaid and LaTeX conte... |
high | 8.1 | — | Jetbrains / youtrack | 2026-10-01 | 2026-10-01 |
| CVE-2026-103488 In JetBrains YouTrack before 2026.2.19422 missing authorisation allowed authenti... |
high | 7.1 | — | Jetbrains / youtrack | 2026-10-01 | 2026-10-05 |
| CVE-2026-97661 The Business Essentials for Contact Form 7 plugin for WordPress is vulnerable to... |
high | 7.2 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-92244 The PDF Invoices & Packing Slips for WooCommerce plugin for WordPress is vulnera... |
high | 7.2 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-95687 The WPC Shop as a Customer for WooCommerce plugin for WordPress is vulnerable to... |
high | 8.8 | — | — | 2026-10-01 | 2026-10-03 |
| CVE-2026-96573 The Appointment Hour Booking – Booking Calendar plugin for WordPress is vulnerab... |
high | 7.2 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-96813 The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugi... |
high | 7.2 | — | — | 2026-10-01 | 2026-10-03 |
| CVE-2026-15983 The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to... |
high | 8.1 | — | — | 2026-10-01 | 2026-10-03 |
| CVE-2026-85235 The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin f... |
high | 7.2 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-14995 The Autoptimize plugin for WordPress is vulnerable to Stored Cross-Site Scriptin... |
high | 7.2 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-103431 colmux in collectl before 4.3.20.2 does not sanitize ANSI/VT100 terminal escape... |
high | 7.7 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-93882 The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin... |
high | 7.5 | — | — | 2026-10-01 | 2026-10-03 |
| CVE-2026-19807 The ByteCoreStack – MCP Connector for AI Tools plugin for WordPress is vulnerabl... |
high | 8.8 | — | — | 2026-10-01 | 2026-10-03 |
| CVE-2026-96255 The Payments for Hubtel WordPress plugin before 1.0.2 does not prevent public ac... |
high | 7.5 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-92412 The Five Star Restaurant Reviews WordPress plugin before 2.3.14 does not properl... |
high | 7.1 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-89296 The Pro Like Button WordPress plugin before 2.0 does not properly sanitize and e... |
high | 8.6 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-81809 The Paytm Payment Gateway WordPress plugin before 2.8.9 does not properly escape... |
high | 7.5 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-85679 The Extendify plugin for WordPress is vulnerable to Stored Cross-Site Scripting... |
high | 7.2 | — | — | 2026-10-01 | 2026-10-03 |
| CVE-2026-80276 Comelit Multi-User Gateway for VIP System (model 1456B) firmware versions 2.9.1... |
high | 7.5 | — | — | 2026-10-01 | 2026-10-05 |
| CVE-2026-81739 The Paytm Payment Gateway WordPress plugin before 2.8.9 does not sanitize and es... |
high | 7.5 | — | — | 2026-10-01 | 2026-10-01 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.