October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,479
Critical
1,340
High
5,869
Medium
6,256
Low
648
Severity not reported
3,366
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1307), google (756), oracle (156), ibm (140), adobe (138), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-72528 "Handmade Marketplace App - Creema" provided by CREEMA LTD. |
medium | 4.3 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-104617 There are two invocations of `qrencode` to display a QR code for scanning. |
medium | 5.1 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-104618 On request the `sdbootutil` script creates a world-readable debug log in /var/lo... |
medium | 6.2 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-105271 "ゲオアプリ" provided by GEO CORPORATION contains an issue with cleartext storag... |
medium | 4.3 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-102462 In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or... |
medium | 5.9 | — | Eclipse / vert.x | 2026-10-15 | 2026-10-20 |
| CVE-2026-102463 In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or... |
medium | 5.9 | — | Eclipse / vert.x | 2026-10-15 | 2026-10-20 |
| CVE-2026-102464 In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or... |
medium | 5.9 | — | Eclipse / vert.x | 2026-10-15 | 2026-10-20 |
| CVE-2026-102466 In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or... |
medium | 5.9 | — | Eclipse / vert.x | 2026-10-15 | 2026-10-20 |
| CVE-2026-102469 In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or... |
medium | 5.9 | — | Eclipse / vert.x | 2026-10-15 | 2026-10-20 |
| CVE-2026-102477 In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or... |
medium | 5.9 | — | Eclipse / vert.x | 2026-10-15 | 2026-10-20 |
| CVE-2026-103223 In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or... |
medium | 5.9 | — | Eclipse / vert.x | 2026-10-15 | 2026-10-20 |
| CVE-2026-103224 In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or... |
medium | 5.9 | — | Eclipse / vert.x | 2026-10-15 | 2026-10-20 |
| CVE-2025-23390 A vulnerability has been identified within Fleet where, by default, Fleet will a... |
medium | 6.3 | — | — | 2026-10-15 | 2026-10-19 |
| CVE-2026-102461 In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or... |
medium | 5.9 | — | Eclipse / vert.x | 2026-10-15 | 2026-10-20 |
| CVE-2026-102465 In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or... |
medium | 5.9 | — | Eclipse / vert.x | 2026-10-15 | 2026-10-20 |
| CVE-2026-102467 In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or... |
medium | 5.9 | — | Eclipse / vert.x | 2026-10-15 | 2026-10-20 |
| CVE-2026-102475 In Eclipse Vert.x versions [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], th... |
medium | 5.9 | — | Eclipse / vert.x | 2026-10-15 | 2026-10-20 |
| CVE-2026-108092 The Blog2Social – Social Media Auto Post & Scheduler plugin for WordPress is vul... |
medium | 4.3 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-92428 The Rede Itaú for WooCommerce WordPress plugin before 5.5.3 does not verify the... |
medium | 5.3 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-92429 The Rede Itaú for WooCommerce WordPress plugin before 5.5.3 does not verify the... |
medium | 5.3 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-76668 A security vulnerability in HPE NonStop Kernel may allow user space access to pr... |
medium | 6.3 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-24723 A NULL pointer dereference vulnerability has been reported to affect File Statio... |
medium | 6.5 | — | Qnap / file station | 2026-10-15 | 2026-10-16 |
| CVE-2026-24721 A NULL pointer dereference vulnerability has been reported to affect File Statio... |
medium | 6.5 | — | Qnap / file station | 2026-10-15 | 2026-10-16 |
| CVE-2026-24722 A NULL pointer dereference vulnerability has been reported to affect File Statio... |
medium | 6.5 | — | Qnap / file station | 2026-10-15 | 2026-10-16 |
| CVE-2026-101308 When an audio channel's buffer needs to be resized, the sound(4) driver checks t... |
medium | 5.5 | — | Freebsd / freebsd | 2026-10-15 | 2026-10-19 |
| CVE-2026-103304 The eaSYNC Booking WordPress plugin before 1.3.31 does not perform authorization... |
medium | 5.3 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-103324 The Cardinity Payment Gateway for WooCommerce WordPress plugin before 3.4.2 does... |
medium | 5.3 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-104643 The Easy HTTPS Redirection (SSL) WordPress plugin before 2.0.2 does not perform... |
medium | 4.2 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-106031 The Spin Wheel WordPress plugin before 2.2.1 does not verify that a visitor actu... |
medium | 6.5 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-110933 Uncaught exception vulnerability in Samsung Open Source Vyond allows Input Data... |
medium | 4.4 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-110934 Improper validation of array index vulnerability in Samsung Open Source Vyond al... |
medium | 4.4 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-11905 The Elementor Website Builder – more than just a page builder plugin for WordPre... |
medium | 4.3 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-101302 TLS 1.3 embeds the actual record type as the last non-zero byte of the decrypted... |
medium | 6.5 | — | Freebsd / freebsd | 2026-10-15 | 2026-10-20 |
| CVE-2025-66272 A path traversal vulnerability has been reported to affect Video Station. |
medium | 6.5 | — | Qnap / video station | 2026-10-15 | 2026-10-19 |
| CVE-2025-66275 A path traversal vulnerability has been reported to affect Video Station. |
medium | 6.5 | — | Qnap / video station | 2026-10-15 | 2026-10-19 |
| CVE-2026-86803 The The Ocean Extra plugin for WordPress is vulnerable to arbitrary shortcode ex... |
medium | 6.5 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-78001 The Post and Page Builder by BoldGrid – Visual Drag and Drop Editor plugin for W... |
medium | 6.4 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-78087 The VK Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting... |
medium | 6.4 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-18557 The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress... |
medium | 6.1 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-15180 The Tracking Code Manager plugin for WordPress is vulnerable to Reflected Cross-... |
medium | 6.1 | — | — | 2026-10-15 | 2026-10-15 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.