October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,476
Critical
1,339
High
5,869
Medium
6,255
Low
648
Severity not reported
3,365
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1307), google (756), oracle (156), ibm (140), adobe (138), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-108722 open-computer-use through commit 610bac8 contains a stored cross-site scripting... |
medium | 4.2 | — | — | 2026-10-11 | 2026-10-16 |
| CVE-2026-108712 SuiteCRM through 7.15.2 and 8.10.2 contains a missing authorization vulnerabilit... |
medium | 4.3 | — | — | 2026-10-11 | 2026-10-16 |
| CVE-2026-108713 SuiteCRM through 7.15.2 and 8.x through 8.10.2 contains a missing authorization... |
medium | 4.3 | — | — | 2026-10-11 | 2026-10-18 |
| CVE-2026-108715 LibreNMS through 26.9.1.1 contains an authorization bypass vulnerability in incl... |
medium | 4.3 | — | — | 2026-10-11 | 2026-10-15 |
| CVE-2026-108716 mcp-remote 0.8.0 through 0.14.3 contains a cleartext transmission vulnerability... |
medium | 5.3 | — | — | 2026-10-11 | 2026-10-16 |
| CVE-2026-108717 Combodo iTop 3.1.0 through 3.3.0 contains a missing authorization vulnerability... |
medium | 6.3 | — | — | 2026-10-11 | 2026-10-16 |
| CVE-2026-108577 A vulnerability was determined in Konstanty Bialkowski libmodplug up to 0.8.9.1. |
medium | 4.3 | — | — | 2026-10-11 | 2026-10-14 |
| CVE-2026-108578 A vulnerability was identified in Neterbit NW-431F 20250715. |
medium | 5.3 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-108584 A security flaw has been discovered in FunnyWolf Viper up to 3.1.11. |
medium | 5.3 | — | — | 2026-10-11 | 2026-10-15 |
| CVE-2026-108710 NornicDB through 1.4.1 contains a missing authorization vulnerability that allow... |
medium | 6.5 | — | — | 2026-10-11 | 2026-10-16 |
| CVE-2026-108711 Plastic Labs Honcho through 3.3.0 contains an incorrect authorization vulnerabil... |
medium | 4.3 | — | — | 2026-10-11 | 2026-10-16 |
| CVE-2026-108575 A vulnerability has been found in BerriAI LiteLLM up to 1.94.0. |
medium | 6.3 | — | — | 2026-10-11 | 2026-10-15 |
| CVE-2026-108573 A vulnerability was detected in Open Asset Import Library Assimp up to 6.0.5. |
medium | 5.5 | — | — | 2026-10-11 | 2026-10-14 |
| CVE-2026-108574 A flaw has been found in BerriAI LiteLLM up to 1.95.0. |
medium | 4.3 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-108572 A security vulnerability has been detected in Casdoor up to 3.164.0/4.10.0. |
medium | 4.3 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-108570 A security flaw has been discovered in Furion .NET Framework up to 4.9.9.95. |
medium | 6.3 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-108569 A vulnerability was identified in Furion .NET Framework up to 4.9.9.92. |
medium | 6.3 | — | — | 2026-10-11 | 2026-10-14 |
| CVE-2026-108567 A vulnerability was found in InstantSoft icms2 up to 2.18.2. |
medium | 4.3 | — | — | 2026-10-11 | 2026-10-15 |
| CVE-2026-108568 A vulnerability was determined in InstantSoft icms2 up to 2.18.2. |
medium | 4.3 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-108542 A vulnerability was found in 021is elvix-sdk up to 0.10.1. |
medium | 6.3 | — | — | 2026-10-11 | 2026-10-15 |
| CVE-2026-108543 A vulnerability was determined in ag2ai ag2 up to 0.13.4. |
medium | 6.3 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-108544 A vulnerability was identified in Lippu Docx Reader Office Viewer App up to 1.4.... |
medium | 6.3 | — | — | 2026-10-11 | 2026-10-14 |
| CVE-2026-89305 The paymendo WordPress plugin through 1.1 does not properly sanitize and escape... |
medium | 6.5 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-93550 The Veeqo for WooCommerce WordPress plugin through 2.2.8 does not restrict who c... |
medium | 4.3 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-94235 The MemberHero WordPress plugin through 6.9 does not perform any capability or n... |
medium | 4.3 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-97183 The WP-Invoice WordPress plugin through 4.3.1 does not perform capability checks... |
medium | 4.3 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-89304 The paymendo WordPress plugin through 1.1 does not properly sanitize and escape... |
medium | 6.5 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-88785 The Simple Membership WordPress plugin before 4.8.3 does not avoid transmitting... |
medium | 4.7 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-81153 The Robo Gallery WordPress plugin before 5.2.6 does not sanitise and escape some... |
medium | 6.8 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-81154 The Robo Gallery WordPress plugin before 5.2.6 does not sanitise and escape imag... |
medium | 6.8 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-81155 The Robo Gallery WordPress plugin before 5.2.6 does not sanitise and escape a ga... |
medium | 6.8 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-81156 The Robo Gallery WordPress plugin before 5.2.6 does not sanitise and escape some... |
medium | 6.8 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-108541 A vulnerability has been found in highwarden Super Store Finder up to 3.8. |
medium | 6.3 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-12980 The Post Snippets WordPress plugin through 4.2.4 does not properly escape variab... |
medium | 6.8 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-108538 A security vulnerability has been detected in GPAC up to 26.07.0. |
medium | 6.3 | — | — | 2026-10-11 | 2026-10-15 |
| CVE-2026-108539 A vulnerability was detected in GPAC up to 26.07.0. |
medium | 6.3 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-108523 A vulnerability was determined in Studio-Saelix Sencho up to 0.94.1. |
medium | 4.3 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-108521 A vulnerability has been found in Studio-Saelix Sencho up to 0.97.1. |
medium | 4.7 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-108705 CordysCRM through 1.9.3 contains a missing authorization vulnerability in the PO... |
medium | 4.3 | — | — | 2026-10-11 | 2026-10-14 |
| CVE-2026-108706 eladmin through commit 55fbf70 contains a missing authorization vulnerability in... |
medium | 4.3 | — | — | 2026-10-11 | 2026-10-16 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.