October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,462
Critical
1,337
High
5,864
Medium
6,249
Low
648
Severity not reported
3,364
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1307), google (756), oracle (156), ibm (140), adobe (138), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-107582 Inefficient algorithmic complexity in the REST API (6.3.3 through 6.3.5) and the... |
medium | 6.5 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-107583 Inefficient algorithmic complexity in the webmail's message view of the REST API... |
medium | 6.5 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-107587 Improper certificate validation in the webmail of Progressive Robot hMailServer... |
medium | 5.9 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-107575 Inefficient algorithmic complexity in the SPF macro expansion of Progressive Rob... |
medium | 5.3 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-107578 Improper link resolution and external control of file paths in the administrativ... |
medium | 6.7 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-107275 @fastify/jwt is a JSON Web Token plugin for the Fastify web framework. |
medium | 6.8 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-107572 Inefficient complexity in the Sieve filter evaluation of Progressive Robot hMail... |
medium | 6.5 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-93509 The Wallet System for WooCommerce WordPress plugin before 2.8.0 does not validat... |
medium | 6.5 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-104671 The TutorStarter WordPress theme before 4.0.4 does not respect the site's user r... |
medium | 5.3 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-105190 The Easy Digital Downloads WordPress plugin before 3.7.1 does not consult the si... |
medium | 5.3 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-103011 Heap-based buffer overflow in the legacy Blowfish encryption routine (BlowFishEn... |
medium | 6.5 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-103517 The Airwallex Online Payments Gateway WordPress plugin before 1.36.0 does not ve... |
medium | 5.3 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-71896 An authorization vulnerability in Apache DolphinScheduler allows authenticated u... |
medium | 6.5 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-89191 Unsanitised input in
the "template name" field of SQLView KRIS's Workflow Templa... |
medium | 6.8 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-66082 An authorization bypass vulnerability in Apache DolphinScheduler allows authenti... |
medium | 6.5 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-107466 A flaw was found in flatpak-builder. |
medium | 6.1 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-87425 An unauthenticated remote attacker can modify the TLS client trust store in Broc... |
medium | 6.8 | — | Broadcom / brocade active support connectivity gateway | 2026-10-08 | 2026-10-14 |
| CVE-2026-87426 An unauthenticated network-based attacker can query specific internal management... |
medium | 4.3 | — | Broadcom / brocade active support connectivity gateway | 2026-10-08 | 2026-10-14 |
| CVE-2026-94275 The Track Orders for WooCommerce WordPress plugin before 1.2.7 does not verify o... |
medium | 5.3 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-94244 The Wallet System for WooCommerce WordPress plugin before 2.8.0 does not perform... |
medium | 4.3 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-94245 The Wallet System for WooCommerce WordPress plugin before 2.8.0 does not verify... |
medium | 6.5 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-94246 The Wallet System for WooCommerce WordPress plugin before 2.8.0 does not verify... |
medium | 6.3 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-86828 The BackWPup WordPress plugin before 5.7.7 does not properly restrict the destin... |
medium | 6.6 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-5769 A vulnerability in Brocade SANnav before 3.0.1 can have the Brocade Fabric OS sw... |
medium | 4.1 | — | Broadcom / brocade sannav | 2026-10-08 | 2026-10-14 |
| CVE-2026-86826 The BackWPup WordPress plugin before 5.7.7 does not properly restrict web access... |
medium | 5.9 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-86827 The BackWPup WordPress plugin before 5.7.7 does not verify that a request to its... |
medium | 5.3 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-5049 A path traversal vulnerability affects the The Zone Alias Import flow feature in... |
medium | 5.7 | — | Broadcom / brocade sannav | 2026-10-08 | 2026-10-14 |
| CVE-2026-5047 A vulnerability in Brocade SANnav before 2.4.0b and 3.0.0 prints encoded passwor... |
medium | 5.7 | — | Broadcom / brocade sannav | 2026-10-08 | 2026-10-14 |
| CVE-2026-105260 The Database Addon For WPForms ( wpforms entries ) WordPress plugin before 1.1.1... |
medium | 4.3 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-105198 The Appointment Booking Plugin WordPress plugin before 5.7.3 does not verify tha... |
medium | 5.3 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-104646 The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.14 does not... |
medium | 6.8 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-105193 The Booking Calendar WordPress plugin before 11.8 does not generate its per-book... |
medium | 4.8 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-105194 The Easy Digital Downloads WordPress plugin before 3.7.1 does not restrict a blo... |
medium | 4.3 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-94581 An OS command injection vulnerability exists in the REST API management interfac... |
medium | 6.8 | — | Broadcom / fabric operating system | 2026-10-08 | 2026-10-14 |
| CVE-2026-94586 A command injection vulnerability exists in the WebTools administrative interfac... |
medium | 6.8 | — | Broadcom / fabric operating system | 2026-10-08 | 2026-10-14 |
| CVE-2026-94587 A buffer overflow vulnerability exists in the WebTools administrative interface... |
medium | 4.5 | — | Broadcom / fabric operating system | 2026-10-08 | 2026-10-14 |
| CVE-2026-87661 Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1 directly ac... |
medium | 5.7 | — | Broadcom / fabric operating system | 2026-10-08 | 2026-10-14 |
| CVE-2026-87662 Brocade Fabric versions before 9.2.2d and 10.0.0 through 10.0.0a1 handling of sp... |
medium | 6.7 | — | Broadcom / fabric operating system | 2026-10-08 | 2026-10-14 |
| CVE-2026-87663 An authentication bypass and command injection vulnerability exists in the inter... |
medium | 6.7 | — | Broadcom / fabric operating system | 2026-10-08 | 2026-10-14 |
| CVE-2026-87677 An OS command injection vulnerability exists in the account management subsystem... |
medium | 6.6 | — | Broadcom / fabric operating system | 2026-10-08 | 2026-10-14 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.