October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,479
Critical
1,340
High
5,869
Medium
6,256
Low
648
Severity not reported
3,366
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1307), google (756), oracle (156), ibm (140), adobe (138), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-46437 wger is a free, open-source workout and fitness manager. |
medium | 4.8 | — | — | 2026-10-07 | 2026-10-10 |
| CVE-2026-46438 wger is a free, open-source workout and fitness manager. |
medium | 6.5 | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-46571 In NTFS-3G before 2026.7.7, a out-of-bounds read exists in ntfs_fix_file_name()... |
medium | 5.5 | — | Tuxera / ntfs-3g | 2026-10-07 | 2026-10-08 |
| CVE-2026-102258 Post-authentication Stored Cross-Site Scripting (XSS) vulnerability has been ide... |
medium | 6.1 | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-41958 A path traversal vulnerability exists in the unzip_http RemoteZipFile extract fu... |
medium | 6.5 | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-42532 A path traversal vulnerability exists in the EmailSheet extract_parts functional... |
medium | 5.5 | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-107168 A flaw was found in m17n-lib. |
medium | 6.2 | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-107177 Express Gateway through 1.16.11 contains a hardcoded cryptographic key vulnerabi... |
medium | 5.9 | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-105139 Obot 0.26.0 before 0.26.2 contains an authorization bypass vulnerability that al... |
medium | 4.3 | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-105140 Obot 0.25.0 before 0.25.6 and 0.26.0 before 0.26.1 contains a race condition in... |
medium | 4.2 | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-107151 Missing authentication has been found in remote-execution task updates in the sm... |
medium | 5.9 | — | — | 2026-10-07 | 2026-10-10 |
| CVE-2026-107162 Express Gateway through 1.16.11 contains an authentication bypass vulnerability... |
medium | 6.8 | — | — | 2026-10-07 | 2026-10-10 |
| CVE-2026-105138 Obot 0.12.0 before 0.26.2 contains an insufficiently protected credentials vulne... |
medium | 6.5 | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-107159 MiniUPnPd through 2.3.11 built with --strict contains a divide-by-zero vulnerabi... |
medium | 6.5 | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-97294 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-105873 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-105875 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-105876 Missing Authorization vulnerability in WP Chill Modula Image Gallery modula-best... |
medium | 5.3 | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-105884 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-27434 Missing Authorization vulnerability in sc Internet Vivoo WP Rentals wprentals al... |
medium | 5.3 | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-105871 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-104390 Missing Authorization vulnerability in Arraytics Booktics booktics allows Exploi... |
medium | 4.3 | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-104391 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-104393 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-103075 Missing Authorization vulnerability in WPMU DEV Hustle wordpress-popup allows Ex... |
medium | 4.3 | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-93684 An SQL user using Impala up to and including version 4.5.2 with only SELECT perm... |
medium | 5.4 | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-90466 Path traversal of 'trusted_jar_paths' in Impala 4.5.2 allows an attacker-control... |
medium | 6.5 | — | Apache / impala | 2026-10-07 | 2026-10-13 |
| CVE-2026-107121 A flaw was found in the SMTP email configuration handling of the keycloak-servic... |
medium | 6.5 | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-96530 The Optimole WordPress plugin before 4.2.15 does not perform a capability check... |
medium | 6.5 | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-97331 The User Private Files WordPress plugin before 2.1.9 does not validate that a su... |
medium | 4.3 | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-97354 The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.17.11 doe... |
medium | 4.1 | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-86816 The WPCafe WordPress plugin before 3.0.21 does not restrict access to some of it... |
medium | 5.3 | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-86833 The MetForm WordPress plugin before 4.3.1 does not sanitize or escape submitted... |
medium | 5.4 | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-105322 The Magee Shortcodes WordPress plugin through 2.1.1 does not restrict the recipi... |
medium | 5.3 | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-104653 The Envira Gallery WordPress plugin before 1.16.1 does not sanitise or escape us... |
medium | 6.8 | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-104667 The Animated Number Counters WordPress plugin before 3.1 does not sanitise or es... |
medium | 6.8 | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-104953 The MPG WordPress plugin before 4.2.3 does not properly validate the structure o... |
medium | 6.8 | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-103323 The Integration for Epos Now and WooCommerce WordPress plugin before 4.11.2 does... |
medium | 5.9 | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-103378 The Geliver Akıllı Kargo Pazaryeri WordPress plugin before 3.1.1 does not preven... |
medium | 6.5 | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-103681 The Frontend Dashboard WordPress plugin before 3.0.0 does not perform a capabili... |
medium | 4.3 | — | — | 2026-10-07 | 2026-10-07 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.