October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,479
Critical
1,340
High
5,872
Medium
6,263
Low
649
Severity not reported
3,355
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1307), google (756), oracle (156), ibm (140), adobe (138), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-109160 A vulnerability was determined in PublicCMS up to 5.202608.a. |
medium | 4.3 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-109153 A vulnerability was detected in MosaicML Composer up to 0.32.1. |
medium | 6.3 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-109155 A flaw has been found in DeepPavlov up to 1.7.0. |
medium | 6.3 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-109156 A vulnerability has been found in SeldonIO MLServer up to 1.6.1. |
medium | 6.3 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-89204 A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). |
medium | 5.4 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-89205 A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). |
medium | 6.3 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-89206 A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). |
medium | 6.3 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-89208 A vulnerability has been identified in Capital Embedded AR Classic 431-422 (All... |
medium | 5.3 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-89200 A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). |
medium | 6.7 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-89202 A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). |
medium | 6.5 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-89203 A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). |
medium | 4.3 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-85115 A vulnerability has been identified in .NET Client Library for SIMATIC S7 Webser... |
medium | 5.5 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-63356 Affected devices do not properly sanitize calculated signal names contained in i... |
medium | 6.1 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-63357 Affected devices do not properly sanitize calculated signal data contained in im... |
medium | 6.1 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-63355 Affected devices do not properly sanitize signal names contained in imported CSV... |
medium | 6.1 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-63351 Affected devices do not properly validate and sanitize visual properties of calc... |
medium | 6.1 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-63352 Affected devices do not properly sanitize calculated signal data contained in im... |
medium | 6.1 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-44414 A vulnerability has been identified in Industrial Edge Cloud Device (IECD), Indu... |
medium | 6.8 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-109149 A weakness has been identified in beautifier js-beautify up to 1.15.1/2.0.3. |
medium | 5.3 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-109152 A security vulnerability has been detected in jbardin scp.py up to 0.16.1. |
medium | 5.4 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-109144 A vulnerability was identified in wbond certvalidator up to 0.11.1. |
medium | 5.3 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-109143 A vulnerability was determined in calcom cal.com and cal.diy up to 6.2.0. |
medium | 5.4 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-109684 Missing Authorization vulnerability in TMS Amelia ameliabooking allows Exploitin... |
medium | 5.3 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-109691 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-109696 Missing Authorization vulnerability in WP ManageNinja LLC FluentBoards fluent-bo... |
medium | 5.4 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-109697 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-109699 Missing Authorization vulnerability in ThemeGrill User Registration user-registr... |
medium | 5.4 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-108495 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-108496 Missing Authorization vulnerability in WP User Manager WP User Manager wp-user-m... |
medium | 5.3 | — | — | 2026-10-13 | 2026-10-21 |
| CVE-2026-108174 Missing Authorization vulnerability in PluginUs.Net FOX woocommerce-currency-swi... |
medium | 5.3 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-108487 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-108488 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-108489 Insertion of Sensitive Information Into Sent Data vulnerability in PluginUs.Net... |
medium | 5.3 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-108490 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-108492 Missing Authorization vulnerability in Fullworks Plugins Quick Paypal Payments q... |
medium | 5.3 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-108493 Missing Authorization vulnerability in Karolína Vyskočilová Pay for Payment for... |
medium | 5.3 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-103076 Cross-Site Request Forgery (CSRF) vulnerability in ThemeGrill User Registration... |
medium | 5.4 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-105881 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-106597 Missing Authorization vulnerability in ThemeGrill User Registration user-registr... |
medium | 5.3 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-106598 Missing Authorization vulnerability in ThemeGrill User Registration user-registr... |
medium | 5.3 | — | — | 2026-10-13 | 2026-10-13 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.