October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,479
Critical
1,340
High
5,869
Medium
6,256
Low
648
Severity not reported
3,366
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1307), google (756), oracle (156), ibm (140), adobe (138), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-97020 The PO/MO Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripti... |
medium | 6.4 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-95807 The FV Player 8 plugin for WordPress is vulnerable to Stored Cross-Site Scriptin... |
medium | 6.4 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-16495 The Countdown Timer – Widget Countdown plugin for WordPress is vulnerable to Sto... |
medium | 6.4 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-100185 The Directorist: AI-Powered Business Directory, Listings & Classified Ads plugin... |
medium | 6.4 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-100193 The Tutor LMS – eLearning and online course solution plugin for WordPress is vul... |
medium | 4.7 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-86573 Out-of-bounds write vulnerability in Hitachi Disk Array Driver for AIX and Hitac... |
medium | 5.1 | — | — | 2026-10-14 | 2026-10-18 |
| CVE-2026-86607 Internal Application Information Exposure Vulnerability in Hitachi Ops Center Ad... |
medium | 4.3 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-107652 The Database Addon for Contact Form 7 – CFDB7 plugin for WordPress is vulnerable... |
medium | 5.3 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-103425 The Booking Package plugin for WordPress is vulnerable to Stored Cross-Site Scri... |
medium | 6.4 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-110170 Use after free in Bindings in Google Chrome prior to 155.0.8059.79 allowed a rem... |
medium | 4.3 | — | Google / chrome | 2026-10-13 | 2026-10-14 |
| CVE-2026-48377 CAI Content Credentials is affected by an Improper Input Validation vulnerabilit... |
medium | 5.3 | — | Adobe / c2pa | 2026-10-13 | 2026-10-15 |
| CVE-2026-48378 CAI Content Credentials is affected by an Improper Input Validation vulnerabilit... |
medium | 5.3 | — | Adobe / c2pa | 2026-10-13 | 2026-10-15 |
| CVE-2026-110160 Missing authorization in ReadingMode in Google Chrome prior to 155.0.8059.79 all... |
medium | 4.2 | — | Google / chrome | 2026-10-13 | 2026-10-14 |
| CVE-2026-110143 Use of uninitialized variable in ThirdParty lmza_sdk in Google Chrome prior to 1... |
medium | 4.3 | — | Google / chrome | 2026-10-13 | 2026-10-14 |
| CVE-2026-110146 Information leak in Passwords in Google Chrome prior to 155.0.8059.79 allowed a... |
medium | 6.5 | — | Google / chrome | 2026-10-13 | 2026-10-14 |
| CVE-2026-110150 Privilege elevation in Installer in Google Chrome on on Windows prior to 155.0.8... |
medium | 5.5 | — | Google / chrome | 2026-10-13 | 2026-10-14 |
| CVE-2026-103820 CAI Content Credential is affected by an Improper Limitation of a Pathname to a... |
medium | 5.5 | — | Adobe / c2pa | 2026-10-13 | 2026-10-14 |
| CVE-2026-103294 CAI Content Credentials is affected by an Improper Certificate Validation vulner... |
medium | 5.9 | — | Adobe / c2pa | 2026-10-13 | 2026-10-17 |
| CVE-2026-102501 CAI Content Credentials is affected by an Improper Input Validation vulnerabilit... |
medium | 5.3 | — | Adobe / c2pa | 2026-10-13 | 2026-10-15 |
| CVE-2026-102502 CAI Content Credentials is affected by an Improper Verification of Cryptographic... |
medium | 5.3 | — | Adobe / c2pa | 2026-10-13 | 2026-10-14 |
| CVE-2026-100125 CAI Content Credentials is affected by an Improper Input Validation vulnerabilit... |
medium | 5.9 | — | Adobe / c2pa | 2026-10-13 | 2026-10-15 |
| CVE-2026-100116 CAI Content Credentials is affected by an Improper Certificate Validation vulner... |
medium | 5.9 | — | Adobe / c2pa | 2026-10-13 | 2026-10-15 |
| CVE-2026-95640 Photoshop Desktop is affected by a NULL Pointer Dereference vulnerability that c... |
medium | 5.5 | — | Adobe / photoshop | 2026-10-13 | 2026-10-22 |
| CVE-2026-94520 Use of externally-controlled format string in SQL Server allows an authorized at... |
medium | 4.9 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-88085 Heap-based buffer overflow in SQL Server allows an authorized attacker to elevat... |
medium | 6.4 | — | — | 2026-10-13 | 2026-10-30 |
| CVE-2026-88086 Out-of-bounds read in SQL Server allows an unauthorized attacker to disclose inf... |
medium | 5.3 | — | — | 2026-10-13 | 2026-10-30 |
| CVE-2026-88089 Heap-based buffer overflow in SQL Server allows an authorized attacker to execut... |
medium | 6.7 | — | — | 2026-10-13 | 2026-10-30 |
| CVE-2026-88084 Allocation of resources without limits or throttling in SQL Server allows an aut... |
medium | 5.3 | — | — | 2026-10-13 | 2026-10-30 |
| CVE-2026-85473 The auth0/java-jwt library may terminate a thread if it receives a JWT with a ti... |
medium | 5.3 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-83945 Heap-based buffer overflow in SQL Server allows an authorized attacker to execut... |
medium | 6.6 | — | — | 2026-10-13 | 2026-10-30 |
| CVE-2026-77816 IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.9 administrat... |
medium | 6.5 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-78628 The Okta Credential Provider for Windows does not validate a serialized credenti... |
medium | 6.0 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-78632 The Okta RADIUS Agent Windows installer assigns write permissions to the NT SERV... |
medium | 5.3 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-78633 The Okta RADIUS Agent does not validate the sub-attribute length when parsing a... |
medium | 6.5 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-79715 IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.9 could allow... |
medium | 5.5 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-70189 Heap-based buffer overflow in SQL Server allows an authorized attacker to execut... |
medium | 6.7 | — | — | 2026-10-13 | 2026-10-30 |
| CVE-2026-63171 Omnispace Agora Project before 26.10.0 contains a stored cross-site scripting vu... |
medium | 5.4 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-67626 Uncontrolled resource consumption in SQL Server allows an authorized attacker to... |
medium | 6.5 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-67628 Out-of-bounds read in SQL Server allows an authorized attacker to disclose infor... |
medium | 4.9 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-63156 Omnispace Agora Project before 26.10.0 contains a reflected cross-site scripting... |
medium | 6.1 | — | — | 2026-10-13 | 2026-10-15 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.