October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,463
Critical
1,337
High
5,864
Medium
6,249
Low
648
Severity not reported
3,365
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1307), google (756), oracle (156), ibm (140), adobe (138), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-107637 pH7Builder (pH7 Social Dating CMS) before 18.5.0 contains an improper authorizat... |
medium | 4.3 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-107638 pH7Builder (pH7 Social Dating CMS) before 18.5.0 contains an improper restrictio... |
medium | 6.8 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-107604 A flaw was found in the installation provider and client registration endpoints... |
medium | 4.9 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-107585 Uncontrolled eviction in the pending sign-in tables of the REST API in Progressi... |
medium | 5.3 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-107586 Uncontrolled eviction in the browser session table of the REST API in Progressiv... |
medium | 4.3 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-107565 A flaw was found in luksmeta. |
medium | 5.1 | — | — | 2026-10-08 | 2026-10-31 |
| CVE-2026-105829 League CommonMark from 1.3.0 before 2.10.2 contains a cross-site scripting vulne... |
medium | 6.1 | — | — | 2026-10-08 | 2026-10-10 |
| CVE-2026-105831 EspoCRM before 10.0.6 contains a stored HTML injection vulnerability that allows... |
medium | 4.3 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-105832 EspoCRM before 10.0.6 contains an authentication bypass vulnerability that accep... |
medium | 4.3 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-27420 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-42698 Concurrent Execution using Shared Resource with Improper Synchronization ('Race... |
medium | 5.3 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-107613 A NULL pointer dereference vulnerability in the Win8ScreenDriver component of Gl... |
medium | 5.9 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-107614 An integer underflow in WinCursorShapeUtils::trimTransparent() in GlavSoft Tight... |
medium | 6.1 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-62127 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-62128 Missing Authorization vulnerability in Creator LMS Creator LMS creatorlms allows... |
medium | 5.3 | — | — | 2026-10-08 | 2026-10-10 |
| CVE-2026-44033 Uncontrolled recursion in XMLNode::ParseXMLElement() and XMLNode::emptyTheNode()... |
medium | 5.5 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-44034 A heap-based out-of-bounds read in DcmRLECodecDecoder::decodeFrame() in dcmdata/... |
medium | 4.4 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-44035 Uncontrolled recursion in DcmDicomDir::moveRecordToTree() in dcmdata/libsrc/dcdi... |
medium | 5.5 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-44036 Uncontrolled mutual recursion between DcmXMLParseHelper::parseDataSet() and DcmX... |
medium | 5.5 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-44037 Uncontrolled mutual recursion between DcmJSONReader::parseDataSet(), DcmJSONRead... |
medium | 5.5 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-44038 A global out-of-bounds read in the Huffman decoder of the bundled IJG JPEG libra... |
medium | 4.4 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-16182 IBM DataPower Gateway 10.5.0.0 through 10.5.0.0 through 10.5.0.22, 10.6.1 throug... |
medium | 5.9 | — | Ibm / datapower gateway | 2026-10-08 | 2026-10-15 |
| CVE-2026-14521 IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.... |
medium | 4.9 | — | Ibm / datapower gateway | 2026-10-08 | 2026-10-15 |
| CVE-2026-16177 IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.... |
medium | 5.3 | — | Ibm / datapower gateway | 2026-10-08 | 2026-10-15 |
| CVE-2026-105891 Missing Authorization vulnerability in Liquid Web / StellarWP Event Tickets even... |
medium | 4.3 | — | — | 2026-10-08 | 2026-10-10 |
| CVE-2026-105893 Authorization Bypass Through User-Controlled Key vulnerability in Liquid Web / S... |
medium | 5.3 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-106596 Missing Authorization vulnerability in Visual Composer Visual Composer Website B... |
medium | 5.3 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-106600 Missing Authorization vulnerability in Liquid Web / StellarWP GiveWP give allows... |
medium | 5.3 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-106603 Authorization Bypass Through User-Controlled Key vulnerability in Groundhogg Hol... |
medium | 6.5 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-105079 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-08 | 2026-10-10 |
| CVE-2026-105878 Missing Authorization vulnerability in YITH YITH WooCommerce Product Bundles yit... |
medium | 5.3 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-105886 Missing Authorization vulnerability in BdThemes Ultimate Post Kit ultimate-post-... |
medium | 6.5 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-105887 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-105888 Missing Authorization vulnerability in Liquid Web / StellarWP Event Tickets even... |
medium | 5.4 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-105890 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-103070 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-103072 Missing Authorization vulnerability in VillaTheme VillaTheme Core villatheme-cor... |
medium | 4.3 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-105078 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-107580 Inefficient algorithmic complexity in the decoding of message header fields in P... |
medium | 6.5 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-107581 Progressive Robot hMailServer 6.0.0 through 6.3.5 processes several IMAP command... |
medium | 6.5 | — | — | 2026-10-08 | 2026-10-08 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.