October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 29, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
16,234
Critical
1,207
High
5,403
Medium
5,749
Low
602
Severity not reported
3,273
In CISA KEV
17
Most affected vendors (by CPE data where available): microsoft (1078), google (711), ibm (140), oracle (117), adobe (110), broadcom (61), apache (45), freerdp (42), linuxfoundation (41), dell (40)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-15896 The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to... |
critical | 9.1 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-19660 The Divi Membership plugin for WordPress is vulnerable to Authentication Bypass... |
critical | 9.8 | — | — | 2026-10-02 | 2026-10-03 |
| CVE-2026-14378 The DevKit Pro plugin for WordPress is vulnerable to Authentication Bypass Leadi... |
critical | 9.8 | — | — | 2026-10-02 | 2026-10-03 |
| CVE-2026-86345 A flaw was found in 389-ds-base. |
critical | 9.0 | — | — | 2026-10-02 | 2026-10-07 |
| CVE-2026-103764 Mooncake transfer engine before 0.3.13 contains an untrusted pointer dereference... |
critical | 9.8 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-103765 Mooncake through 0.3.13.post1 contains a missing authentication vulnerability in... |
critical | 9.4 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-51897 RAGFlow 0.24.0 contains improper access control in get_dataset (api/apps/evaluat... |
critical | 9.8 | — | — | 2026-10-01 | 2026-10-05 |
| CVE-2026-51882 The OpenAI-compatible file upload endpoint `/v1/files` in Langchain-Chatchat 0.3... |
critical | 9.1 | — | — | 2026-10-01 | 2026-10-07 |
| CVE-2026-51883 The knowledge base creation and document upload interfaces in Langchain-Chatchat... |
critical | 9.1 | — | — | 2026-10-01 | 2026-10-05 |
| CVE-2026-51884 The /knowledge_base/upload_temp_docs temporary document upload endpoint in Langc... |
critical | 9.8 | — | — | 2026-10-01 | 2026-10-05 |
| CVE-2026-51886 langflow-ai langflow v1.9.3 is affected by: Code Injection. |
critical | 9.8 | — | — | 2026-10-01 | 2026-10-06 |
| CVE-2026-51893 infiniflow ragflow 0.24.0 is vulnerable to Incorrect Access Control via trace_mi... |
critical | 9.8 | — | — | 2026-10-01 | 2026-10-05 |
| CVE-2026-51875 In Devika v1.0, the Feature Agent save_code_to_project function contains a path... |
critical | 9.1 | — | — | 2026-10-01 | 2026-10-05 |
| CVE-2026-51876 DeepTutor 1.4.0 contains an authorization bypass vulnerability in the book confi... |
critical | 9.1 | — | — | 2026-10-01 | 2026-10-06 |
| CVE-2026-51879 deeptutor 1.4.0 contains an authorization bypass through a user-controlled objec... |
critical | 9.1 | — | — | 2026-10-01 | 2026-10-05 |
| CVE-2026-51880 deeptutor 1.4.0 contains a path traversal issue in EditFileTool.execute. |
critical | 9.8 | — | — | 2026-10-01 | 2026-10-05 |
| CVE-2026-51881 deeptutor 1.4.0 contains code injection in ExecTool.execute. |
critical | 9.8 | — | — | 2026-10-01 | 2026-10-06 |
| CVE-2026-56660 GetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the... |
critical | 9.1 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-56662 GetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the... |
critical | 9.6 | — | — | 2026-10-01 | 2026-10-06 |
| CVE-2026-53953 GetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the... |
critical | 9.1 | — | — | 2026-10-01 | 2026-10-05 |
| CVE-2026-104286 Fortinet FortiMail Path Traversal Vulnerability |
critical | 9.8 | Listed | Fortinet / FortiMail | 2026-10-01 | 2026-10-28 |
| CVE-2026-102628 The Cadmos LTI application hosted at cadmos.eummena.io had Laravel debug mode en... |
critical | 9.3 | — | — | 2026-10-01 | 2026-10-11 |
| CVE-2026-55083 DHIS2 is a flexible information system for data capture, management, validation,... |
critical | 9.1 | — | — | 2026-10-01 | 2026-10-02 |
| CVE-2026-104056 Authlib version 1.7.2 and below contains a vulnerability where discovery JSON me... |
critical | 9.8 | — | — | 2026-10-01 | 2026-10-05 |
| CVE-2026-103922 Capacitor is a cross-platform native runtime for web applications. |
critical | 9.3 | — | — | 2026-10-01 | 2026-10-02 |
| CVE-2026-96659 A flaw was found in Foreman. |
critical | 9.1 | — | Redhat / satellite | 2026-10-01 | 2026-10-16 |
| CVE-2026-59797 Improper Privilege Management vulnerability in Apache HTTP Server's mod_ssl via... |
critical | 9.8 | — | Apache / http server | 2026-10-01 | 2026-10-05 |
| CVE-2026-57941 Use After Free vulnerability in Apache HTTP Server's mod_http2 via shared sessio... |
critical | 9.8 | — | Apache / http server | 2026-10-01 | 2026-10-05 |
| CVE-2026-56154 Use After Free vulnerability in Apache HTTP Server's mod_rewrite when using look... |
critical | 9.8 | — | Apache / http server | 2026-10-01 | 2026-10-05 |
| CVE-2026-12627 Fortra's Core Privileged Access Manager (BoKS) contains a stack-based buffer ove... |
critical | 9.8 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-79898 Fortra BoKS Manager contains a command injection vulnerability in crlserver. |
critical | 9.1 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-62071 Unauthenticated SQL Injection in WordPress File Upload <= 5.1.10 versions. |
critical | 9.3 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-103752 Unauthenticated Privilege Escalation in Authorizer <= 3.15.3 versions. |
critical | 9.8 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-79901 In deployments using BoKS keytab management, affected versions of boks_keytabmd... |
critical | 9.9 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-103264 Fleet versions before 4.87.0 contain an authentication bypass vulnerability in t... |
critical | 9.1 | — | Fleetdm / fleet | 2026-10-01 | 2026-10-08 |
| CVE-2026-103255 n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2... |
critical | 9.0 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-103248 n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2... |
critical | 9.0 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-103244 ground-station versions before 0.8.0 contain an authentication bypass vulnerabil... |
critical | 9.8 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-75957 The Ultimate Multisite – WordPress Multisite SaaS & WaaS Platform plugin for Wor... |
critical | 9.8 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-15989 The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to... |
critical | 9.8 | — | — | 2026-10-01 | 2026-10-01 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.