October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,479
Critical
1,340
High
5,869
Medium
6,256
Low
648
Severity not reported
3,366
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1307), google (756), oracle (156), ibm (140), adobe (138), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-81343 The ACF Frontend Admin by DynamiApps WordPress plugin through 3.29.13 does not p... |
medium | 5.3 | — | — | 2026-10-17 | 2026-10-19 |
| CVE-2026-81344 The ACF Frontend Admin by DynamiApps WordPress plugin through 3.29.13 does not r... |
medium | 6.6 | — | — | 2026-10-17 | 2026-10-19 |
| CVE-2026-91074 The BSK PDF Manager WordPress plugin through 3.8.1 does not properly sanitise an... |
medium | 6.8 | — | — | 2026-10-17 | 2026-10-19 |
| CVE-2026-103376 The PeachPay — Payments & Express Checkout for WooCommerce (supports Stripe, Pay... |
medium | 5.3 | — | — | 2026-10-17 | 2026-10-19 |
| CVE-2026-92715 The Tutor LMS – eLearning and online course solution plugin for WordPress is vul... |
medium | 4.3 | — | — | 2026-10-17 | 2026-10-19 |
| CVE-2026-92978 The User Registration & Membership – Free & Paid Memberships, Subscriptions, Con... |
medium | 4.3 | — | — | 2026-10-17 | 2026-10-19 |
| CVE-2026-110268 The Post Export Import with Media plugin for WordPress is vulnerable to Director... |
medium | 4.9 | — | — | 2026-10-17 | 2026-10-19 |
| CVE-2026-111726 The Themify Builder plugin for WordPress is vulnerable to Stored Cross-Site Scri... |
medium | 6.4 | — | — | 2026-10-17 | 2026-10-19 |
| CVE-2026-109368 The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to S... |
medium | 6.5 | — | — | 2026-10-17 | 2026-10-19 |
| CVE-2026-109369 The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to a... |
medium | 6.8 | — | — | 2026-10-17 | 2026-10-19 |
| CVE-2026-109985 The xSpeed Cache: AI-Powered Performance Hub with MCP, Caching & CDN plugin for... |
medium | 6.4 | — | — | 2026-10-17 | 2026-10-19 |
| CVE-2026-109989 The Themify Popup plugin for WordPress is vulnerable to Stored Cross-Site Script... |
medium | 6.4 | — | — | 2026-10-17 | 2026-10-19 |
| CVE-2026-107744 The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin... |
medium | 6.5 | — | — | 2026-10-17 | 2026-10-19 |
| CVE-2026-107752 The Welcart e-Commerce plugin for WordPress is vulnerable to generic SQL Injecti... |
medium | 4.9 | — | — | 2026-10-17 | 2026-10-19 |
| CVE-2026-107763 The Fastcache by Host.it plugin for WordPress is vulnerable to authorization byp... |
medium | 4.3 | — | — | 2026-10-17 | 2026-10-19 |
| CVE-2026-111601 The Hippoo Mobile App for WooCommerce plugin for WordPress is vulnerable to Refl... |
medium | 6.1 | — | — | 2026-10-17 | 2026-10-19 |
| CVE-2026-89085 A flaw was found in parted. |
medium | 6.6 | — | — | 2026-10-16 | 2026-10-19 |
| CVE-2026-89088 A flaw was found in parted. |
medium | 5.5 | — | — | 2026-10-16 | 2026-10-19 |
| CVE-2026-89096 A flaw was found in nfs-utils. |
medium | 5.9 | — | — | 2026-10-16 | 2026-10-19 |
| CVE-2026-111802 A flaw was found in Nautilus. |
medium | 6.6 | — | — | 2026-10-16 | 2026-10-21 |
| CVE-2026-110754 Text::CSV_XS versions before 1.65 for Perl leak the parsed fields of a record th... |
medium | 6.5 | — | — | 2026-10-16 | 2026-10-20 |
| CVE-2026-96628 Arcane is an interface for managing Docker containers, images, networks, and vol... |
medium | 4.3 | — | — | 2026-10-16 | 2026-10-19 |
| CVE-2026-62438 A flaw was found in GIMP. |
medium | 6.1 | — | — | 2026-10-16 | 2026-10-19 |
| CVE-2026-96542 Incorrect permission assignment (CWE-732) in the standalone installer for EA Jav... |
medium | 5.0 | — | — | 2026-10-16 | 2026-10-19 |
| CVE-2026-64862 Frappe HR is an open-source human resources management solution (HRMS). |
medium | 6.5 | — | — | 2026-10-16 | 2026-10-19 |
| CVE-2026-55796 Frappe HR is an open-source human resources management solution (HRMS). |
medium | 6.5 | — | — | 2026-10-16 | 2026-10-21 |
| CVE-2026-108373 ERPNext is a free and open source Enterprise Resource Planning tool. |
medium | 6.5 | — | — | 2026-10-16 | 2026-10-19 |
| CVE-2026-59966 Tandoor Recipes is an application for managing recipes, planning meals, and buil... |
medium | 5.7 | — | — | 2026-10-16 | 2026-10-19 |
| CVE-2026-85231 A flaw was found in libtirpc. |
medium | 6.5 | — | — | 2026-10-16 | 2026-10-30 |
| CVE-2026-85977 A flaw was found in libtirpc. |
medium | 5.3 | — | — | 2026-10-16 | 2026-10-19 |
| CVE-2026-17073 IBM i 7.3, 7.4, 7.5, and 7.6 could allow a local attacker to obtain sensitive in... |
medium | 5.5 | — | Ibm / i | 2026-10-16 | 2026-10-23 |
| CVE-2026-17275 IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote attacker to perform unauthoriz... |
medium | 5.3 | — | Ibm / i | 2026-10-16 | 2026-10-23 |
| CVE-2026-17488 IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to bypa... |
medium | 6.5 | — | Ibm / i | 2026-10-16 | 2026-10-23 |
| CVE-2026-17491 IBM i 7.3, 7.4, 7.5, and 7.6 is could allow a remote authenticated attacker to b... |
medium | 5.4 | — | Ibm / i | 2026-10-16 | 2026-10-23 |
| CVE-2026-111793 Openwave Webtop Media Transcoder does not enforce administrator-defined file typ... |
medium | 4.3 | — | — | 2026-10-16 | 2026-10-19 |
| CVE-2026-107674 IBM i 7.3, 7.4, 7.5, and 7.6 is vulnerable to a denial of service to Digital Cer... |
medium | 4.4 | — | Ibm / i | 2026-10-16 | 2026-10-23 |
| CVE-2025-55653 GPAC MP4Box v2.4 was discovered to contain a floating point exception in the gf_... |
medium | 5.5 | — | — | 2026-10-16 | 2026-10-28 |
| CVE-2025-55640 A heap buffer overflow in the stbl_AddSize function (isomedia/stbl_write.c) of G... |
medium | 5.5 | — | — | 2026-10-16 | 2026-10-28 |
| CVE-2026-89098 A flaw was found in nfs-utils. |
medium | 5.5 | — | — | 2026-10-16 | 2026-10-19 |
| CVE-2026-80092 Authentication bypass by assumed-immutable data in Microsoft Identity Web allows... |
medium | 5.3 | — | — | 2026-10-16 | 2026-10-20 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.