October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 29, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
16,216
Critical
1,207
High
5,399
Medium
5,736
Low
602
Severity not reported
3,272
In CISA KEV
17
Most affected vendors (by CPE data where available): microsoft (1078), google (711), ibm (140), oracle (117), adobe (110), broadcom (61), apache (45), freerdp (42), linuxfoundation (41), dell (40)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-85955 Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 1... |
critical | 9.9 | — | — | 2026-10-12 | 2026-10-14 |
| CVE-2026-85956 Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 1... |
critical | 9.6 | — | — | 2026-10-12 | 2026-10-14 |
| CVE-2026-85947 Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 1... |
critical | 9.9 | — | — | 2026-10-12 | 2026-10-14 |
| CVE-2026-85948 Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 1... |
critical | 9.9 | — | — | 2026-10-12 | 2026-10-14 |
| CVE-2026-108895 A weakness has been identified in Linksys E1700 1.0.0.4.003. |
critical | 9.9 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-108896 A vulnerability was found in Linksys E1700 1.0.0.4.003. |
critical | 9.9 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-109390 AnyDesk before 8.0.3 allows unauthenticated remote attackers to execute arbitrar... |
critical | 9.8 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-108892 A vulnerability was determined in Linksys E1700 1.0.0.4.003. |
critical | 10.0 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-108893 A vulnerability was identified in Linksys E1700 up to 1.0.0.4.003. |
critical | 9.9 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-108894 A security flaw has been discovered in Linksys E1700 1.0.0.4.003. |
critical | 9.9 | — | — | 2026-10-12 | 2026-10-14 |
| CVE-2026-85499 Improper Authorization vulnerability in Apache SkyWalking BanyanDB. |
critical | 9.1 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-78357 Previously issued authentication tokens are not immediately invalidated when an... |
critical | 9.1 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-93582 The HTTP Basic Authentication modules in ((OTRS)) Community Edition 6 and prior... |
critical | 9.4 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-108804 A vulnerability was detected in TRENDnet TEW-751DR, TEW-752DRU and TEW733GR 1.03... |
critical | 10.0 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-66086 In the modem OTA stack, there is a possible stack-based buffer overflow due to i... |
critical | 9.8 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-108860 BotSharp through 5.2.0 contains an authentication bypass vulnerability that allo... |
critical | 9.1 | — | — | 2026-10-11 | 2026-10-16 |
| CVE-2026-108753 Agnaistic agnai through 1.0.555 contains a hard-coded credentials vulnerability... |
critical | 9.4 | — | — | 2026-10-11 | 2026-10-16 |
| CVE-2026-108576 A vulnerability was found in TOZED X300 up to 6.01.3. |
critical | 10.0 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-85121 The Insurify WordPress plugin through 1.0 does not have authorisation and nonce... |
critical | 9.1 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-86706 The Quick quotes WordPress plugin through 1.0.0 does not perform any capability... |
critical | 9.1 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-86717 The Insurify WordPress plugin through 1.0 does not have authorisation and nonce... |
critical | 9.1 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-84253 The click5 CRM add-on to Gravity Forms WordPress plugin through 1.0.3 does not h... |
critical | 9.8 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-84254 The click5 CRM add-on to Contact Form 7 WordPress plugin through 1.0.4 does not... |
critical | 9.8 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-84734 The Mindstien Quick Login WordPress plugin through 1.0 does not correctly valida... |
critical | 9.8 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-84737 The Freeton WP WordPress plugin through 1.0.0 does not correctly validate the ac... |
critical | 9.8 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-85118 The AI Content Generator Marketing WordPress plugin through 1.0.0 does not enfor... |
critical | 9.8 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-81649 The Fundiin cho WooCommerce WordPress plugin through 3.4.0 does not have proper... |
critical | 9.1 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-84251 The click5 CRM add-on to Ninja Forms WordPress plugin through 1.0.1 does not hav... |
critical | 9.8 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-84252 The click5 CRM add-on to WPForms WordPress plugin through 1.0.3 does not have au... |
critical | 9.8 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-108540 A flaw has been found in OpenSpug Spug up to 3.4.0/4.0.1. |
critical | 9.9 | — | — | 2026-10-11 | 2026-10-14 |
| CVE-2026-104028 The Anton Extensions WordPress plugin through 1.2.2 does not perform any capabil... |
critical | 9.8 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-108707 Wukong_HRM through commit 186115e contains an authentication bypass vulnerabilit... |
critical | 9.8 | — | — | 2026-10-11 | 2026-10-18 |
| CVE-2026-78533 Unauthenticated PHP Object Injection in Qwery <= 3.6.1 versions. |
critical | 9.8 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-78535 Unauthenticated PHP Object Injection in Photolia <= 1.0.3 versions. |
critical | 9.8 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-81797 Unauthenticated PHP Object Injection in Buzz Stone | Magazine & Viral Blog WordP... |
critical | 9.8 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-66567 Unauthenticated PHP Object Injection in Anesta <= 1.5.3 versions. |
critical | 9.8 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-66568 Unauthenticated PHP Object Injection in Original <= 1.9.0 versions. |
critical | 9.8 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-66569 Unauthenticated PHP Object Injection in Kicker <= 2.2.1 versions. |
critical | 9.8 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-78529 Unauthenticated PHP Object Injection in Alliance <= 3.11 versions. |
critical | 9.8 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-78531 Unauthenticated PHP Object Injection in Jacqueline <= 2.22 versions. |
critical | 9.8 | — | — | 2026-10-10 | 2026-10-13 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.