October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,479
Critical
1,340
High
5,872
Medium
6,263
Low
649
Severity not reported
3,355
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1307), google (756), oracle (156), ibm (140), adobe (138), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-78392 The Link Library WordPress plugin before 7.9.6 does not sanitise and escape a li... |
medium | 6.8 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-111971 The Photo Engine (Media Organizer & Lightroom) WordPress plugin before 6.5.8 doe... |
medium | 6.8 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-111972 The Photo Engine (Media Organizer & Lightroom) WordPress plugin before 6.5.8 doe... |
medium | 4.9 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-114570 WordPress Core is vulnerable to Stored Cross-Site Scripting via Quick Edit in al... |
medium | 4.9 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-103234 The WP Ultimate Review WordPress plugin before 2.4.5 does not neutralise shortco... |
medium | 4.8 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-110010 The MB Custom Post Types & Custom Taxonomies WordPress plugin before 2.12.3 does... |
medium | 4.8 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-100142 The FluentCart A New Era of eCommerce WordPress plugin before 2.2.0 does not ver... |
medium | 5.3 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-114222 NT OneAPP developed by NewType Infortech has an Authentication Bypass vulnerabil... |
medium | 6.2 | — | — | 2026-10-22 | 2026-10-30 |
| CVE-2026-114223 NT OneAPP developed by NewType Infortech has an Exposure of Sensitive Informatio... |
medium | 5.5 | — | — | 2026-10-22 | 2026-10-30 |
| CVE-2026-114729 Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote c... |
medium | 5.3 | — | — | 2026-10-22 | 2026-10-26 |
| CVE-2026-114731 Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an uncontr... |
medium | 5.3 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-114732 Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an imprope... |
medium | 6.8 | — | — | 2026-10-22 | 2026-10-29 |
| CVE-2026-96388 Cross-Site Request Forgery (CSRF) vulnerability in Drupal Tawk.to - Live chat ap... |
medium | 5.4 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-96390 Privilege Defined With Unsafe Actions vulnerability in Drupal Editoria11y Access... |
medium | 4.3 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-96391 Missing Authorization vulnerability in Drupal Webform REST allows Forceful Brows... |
medium | 4.3 | — | — | 2026-10-22 | 2026-10-30 |
| CVE-2026-96398 Incorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing... |
medium | 4.3 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-96377 Allocation of Resources Without Limits or Throttling vulnerability in Drupal Com... |
medium | 5.3 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-96378 Improperly Controlled Modification of Dynamically-Determined Object Attributes v... |
medium | 4.3 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-96380 Missing Authorization vulnerability in Drupal CSS Usage Analyzer allows Forceful... |
medium | 6.5 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-96382 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripti... |
medium | 4.6 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-96385 Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal... |
medium | 6.5 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-96386 Missing Authorization vulnerability in Drupal Smart Content allows Forceful Brow... |
medium | 6.5 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-96368 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripti... |
medium | 4.6 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-96370 Incorrect Authorization vulnerability in Drupal Webform allows Server Side Reque... |
medium | 5.4 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-96371 Privilege Defined With Unsafe Actions vulnerability in Drupal Webform allows Sto... |
medium | 5.4 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-96372 Insufficient Granularity of Access Control vulnerability in Drupal Webform allow... |
medium | 5.4 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-96374 Cross-Site Request Forgery (CSRF) vulnerability in Drupal Project Browser allows... |
medium | 4.2 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-96375 Improper Certificate Validation vulnerability in Drupal Cloud allows Adversary i... |
medium | 4.8 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-96376 Improper Neutralization of Special Elements used in an OS Command ("OS Command I... |
medium | 6.4 | — | — | 2026-10-22 | 2026-10-23 |
| CVE-2026-96361 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripti... |
medium | 4.6 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-96362 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripti... |
medium | 4.2 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-96364 Improper Control of Interaction Frequency vulnerability in Drupal Webform allows... |
medium | 5.3 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-96366 Incorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing... |
medium | 5.3 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-96367 Privilege Defined With Unsafe Actions vulnerability in Drupal Webform allows Sto... |
medium | 4.6 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-87954 Missing Authorization vulnerability in Drupal Taxonomy Term Glossary allows Forc... |
medium | 4.3 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-87955 Missing Authorization vulnerability in Drupal Ultimate Table Field allows Forcef... |
medium | 4.3 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-96356 Incorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing... |
medium | 5.3 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-96357 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripti... |
medium | 4.6 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-96358 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripti... |
medium | 4.6 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-96359 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripti... |
medium | 4.6 | — | — | 2026-10-22 | 2026-10-22 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.