October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,479
Critical
1,340
High
5,869
Medium
6,256
Low
648
Severity not reported
3,366
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1307), google (756), oracle (156), ibm (140), adobe (138), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-112356 GFI KerioConnect (Kerio Connect) before 10.0.9 Patch 2 contains a cross-site scr... |
medium | 6.1 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-50541 Xibo is an open source digital signage platform with a web content management sy... |
medium | 6.5 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-93516 A use-after-free caused by lack of lifecycle management when adding / removing X... |
medium | 5.5 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-55369 Waline is a comment system with backend support. |
medium | 6.5 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-67077 HCL BigFix AEX is affected by a Server-Side Request Forgery vulnerability, which... |
medium | 4.2 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-67079 HCL BigFix AEX is affected by a Clickjacking vulnerability, which could allow an... |
medium | 6.4 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-67080 HCL BigFix AEX is affected by an Information Disclosure vulnerability due to imp... |
medium | 6.5 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-116404 Missing Authorization vulnerability in David Anderson Redux Framework redux-fram... |
medium | 6.5 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-115957 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-81472 Dell iDRAC Service Module (iSM) for Windows, Dell iDRAC Service Module (iSM) for... |
medium | 4.2 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-116855 Missing Authorization vulnerability in wphocus My auctions allegro my-auctions-a... |
medium | 5.4 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-87878 Linux binaries have executable stack attribute enabled. |
medium | 6.3 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-87879 Sensitive information disclosure due to improper token validation. |
medium | 5.9 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-87880 Sensitive information disclosure due to missing SSL certificate verification aff... |
medium | 6.8 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-87097 Sensitive information disclosure due to insufficiently protected credentials. |
medium | 5.3 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-87099 Cross-site scripting (XSS) vulnerability due to improper input validation. |
medium | 5.7 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-87101 Sensitive information disclosure due to improper token validation. |
medium | 6.2 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-115223 The Smart Popup by Supsystic WordPress plugin before 2.0.2 does not prevent temp... |
medium | 4.9 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-106648 The Royal Elementor Addons WordPress plugin before 1.7.1070 does not validate su... |
medium | 5.3 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-110508 The Essential Addons for Elementor WordPress plugin before 6.8.7 does not apply... |
medium | 5.3 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-103313 The BitPay Gateway for WooCommerce WordPress plugin through 4.1.3 does not bind... |
medium | 5.3 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-103330 The Sadad QA Payment WordPress plugin through 1.28 does not correctly verify the... |
medium | 5.3 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-92665 Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS... |
medium | 5.3 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-86388 Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS... |
medium | 5.3 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-86390 Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS... |
medium | 6.5 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-86391 Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.... |
medium | 6.4 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-86392 Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS... |
medium | 4.9 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-86383 Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS... |
medium | 6.8 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-86386 Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.... |
medium | 4.3 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-105457 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') v... |
medium | 6.5 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-90720 Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS... |
medium | 6.7 | — | — | 2026-10-28 | 2026-10-30 |
| CVE-2026-16020 Improper neutralization of input during web page generation ('cross-site scripti... |
medium | 5.4 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-85655 The Enable Media Replace plugin for WordPress is vulnerable to authorization byp... |
medium | 4.3 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-101935 The Echo Knowledge Base – Documentation, FAQs, Chat & Smart Search plugin for Wo... |
medium | 6.1 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-118435 Out-of-bounds write vulnerability in Samsung Open Source escargot allows Buffer... |
medium | 5.4 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-76780 The Beyondseo plugin for WordPress is vulnerable to unauthorized access in versi... |
medium | 6.3 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-77188 The Waitlist Woocommerce ( Back in stock notifier ) plugin for WordPress is vuln... |
medium | 6.4 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-77871 The Post Snippets – Custom WordPress Code Snippets Customizer plugin for WordPre... |
medium | 6.4 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-92098 The Webheadcoder Multi-Step Forms for Contact Form 7 plugin for WordPress is vul... |
medium | 6.1 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-118164 The If-So Dynamic Content – Elementor & All Page Builders Personalization plugin... |
medium | 6.4 | — | — | 2026-10-28 | 2026-10-28 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.