October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,479
Critical
1,340
High
5,869
Medium
6,256
Low
648
Severity not reported
3,366
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1307), google (756), oracle (156), ibm (140), adobe (138), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-96425 Incorrect DBus policy for lomiri-download-manager allows arbitrary user to run a... |
medium | 5.5 | — | — | 2026-10-16 | 2026-10-18 |
| CVE-2026-68908 libIEC61850 is an open-source implementation of IEC 61850 client and server prot... |
medium | 5.3 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-55862 pupnp is an SDK for development of UPnP device and control point applications. |
medium | 6.5 | — | Pupnp Project / pupnp | 2026-10-16 | 2026-10-23 |
| CVE-2026-57446 libIEC61850 is an open-source implementation of IEC 61850 client and server prot... |
medium | 5.3 | — | — | 2026-10-16 | 2026-10-28 |
| CVE-2026-57447 Discourse Doc Categories is a plugin for organizing Discourse topics as document... |
medium | 4.3 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-54657 Open Zaak is an open-source data and services layer for Dutch case-oriented work... |
medium | 6.5 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-55836 Open Zaak is an open-source data and services layer for Dutch case-oriented work... |
medium | 6.8 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-46471 An issue was discovered in GStreamer gst-plugins-good before 1.28.2. |
medium | 5.5 | — | — | 2026-10-16 | 2026-10-19 |
| CVE-2026-102923 SparkyFitness is a self-hosted, AI-powered health and fitness tracker for famili... |
medium | 5.4 | — | — | 2026-10-16 | 2026-10-28 |
| CVE-2026-111728 Seanime v3.7.0 to v3.10.3 contains an argument injection vulnerability reachable... |
medium | 5.4 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-107777 Thermo Fisher Torrent Suite Software is vulnerable to a path traversal, which co... |
medium | 6.5 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2025-52097 Cross Site Scripting vulnerability in InstantASP ltd, InstantForum.NET v.4.1.4 a... |
medium | 5.4 | — | — | 2026-10-16 | 2026-10-29 |
| CVE-2026-97858 An attacker can cause the server to unbind the target device from its current ow... |
medium | 5.3 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-97470 The Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental plugin for W... |
medium | 6.4 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-90821 An input neutralization vulnerability in the Webhook URL form field component of... |
medium | 5.4 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-110287 Improper access control in asset contact password in Devolutions Server 2026.3.8... |
medium | 4.3 | — | Devolutions / devolutions server | 2026-10-16 | 2026-10-23 |
| CVE-2026-110804 Improperly controlled modification of JIT elevation settings in PAM checkout in... |
medium | 4.3 | — | Devolutions / devolutions server | 2026-10-16 | 2026-10-23 |
| CVE-2026-110806 Incorrect authorization in add-on properties in Devolutions Server 2026.3.8.0 an... |
medium | 6.5 | — | Devolutions / devolutions server | 2026-10-16 | 2026-10-23 |
| CVE-2026-105664 The endpoint exposes an observable response discrepancy when processing ID value... |
medium | 5.3 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-111409 Missing Authorization vulnerability in YITH YITH PayPal Express Checkout for Woo... |
medium | 5.3 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-111555 A flaw was found in luksmeta. |
medium | 6.0 | — | — | 2026-10-16 | 2026-10-19 |
| CVE-2026-110896 Missing Authorization vulnerability in WP Chill Passster content-protector allow... |
medium | 5.3 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-110900 Missing Authorization vulnerability in Liquid Web / StellarWP BookIt bookit allo... |
medium | 5.3 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-110901 Authorization Bypass Through User-Controlled Key vulnerability in WPMU DEV Smart... |
medium | 5.4 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-110903 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-111397 Missing Authorization vulnerability in PT Norther Lights Production MapSVG mapsv... |
medium | 5.3 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-111400 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-111405 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-110380 Missing Authorization vulnerability in Arraytics WP Event Solution wp-event-solu... |
medium | 5.3 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-111390 Erupt through 2.3.0 contains an HQL injection vulnerability that allows authenti... |
medium | 5.3 | — | — | 2026-10-16 | 2026-10-21 |
| CVE-2026-109930 The MAIO WordPress plugin before 7.3.22 does not properly restrict access to its... |
medium | 5.3 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-110029 The Squeeze WordPress plugin before 1.8.1 does not perform a capability check on... |
medium | 5.4 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-109118 Improper path containment check in ikus060 rdiffweb 7.1.1 allows an authenticate... |
medium | 4.6 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-110703 The GeoDirectory – WP Business Directory Plugin and Classified Listings Director... |
medium | 6.4 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-107649 The Events Made Easy plugin for WordPress is vulnerable to Stored Cross-Site Scr... |
medium | 5.4 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-93681 The Tutor LMS – eLearning and online course solution plugin for WordPress is vul... |
medium | 6.4 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-15219 Authorization bypass through User-Controlled key vulnerability in SFM Software T... |
medium | 6.5 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-15575 Active debug code vulnerability in SFM Software Technologies Inc. |
medium | 5.3 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-104003 The WP User Avatar / ProfilePress plugin for WordPress is vulnerable to Arbitrar... |
medium | 5.4 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-104726 The Name Directory plugin for WordPress is vulnerable to Stored Cross-Site Scrip... |
medium | 6.4 | — | — | 2026-10-16 | 2026-10-16 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.