October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,479
Critical
1,340
High
5,869
Medium
6,256
Low
648
Severity not reported
3,366
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1307), google (756), oracle (156), ibm (140), adobe (138), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-104049 The Academy LMS WordPress plugin before 4.0.0 does not verify course enrollment... |
medium | 4.3 | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-104050 The Academy LMS WordPress plugin before 4.0.0 does not verify that a quiz questi... |
medium | 4.3 | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-104651 The Yaad Sarig Payment Gateway For WC WordPress plugin before 2.2.13 does not ve... |
medium | 4.3 | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-104652 The Envira Gallery WordPress plugin before 1.16.1 does not sanitise and escape a... |
medium | 6.8 | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-103868 A flaw was found in pulp-container when it authenticates to an upstream registry... |
medium | 6.5 | — | — | 2026-10-07 | 2026-10-14 |
| CVE-2026-103869 A flaw was found in pulp-ansible's bearer-token refresh for collection remotes. |
medium | 6.5 | — | — | 2026-10-07 | 2026-10-14 |
| CVE-2026-103870 A flaw was found in pulp-rpm when it publishes a distribution tree. |
medium | 5.0 | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-84897 src/internal.c in wolfSSL wolfSSH through 1.5.0 admits the server-to-client Diff... |
medium | 5.3 | — | Wolfssh / wolfssh | 2026-10-07 | 2026-10-13 |
| CVE-2026-106061 A flaw was found in GIMP’s X cursor (XMC) thumbnail loader. |
medium | 5.5 | — | — | 2026-10-07 | 2026-10-09 |
| CVE-2026-93677 IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacke... |
medium | 6.5 | — | Langflow / langflow | 2026-10-07 | 2026-10-08 |
| CVE-2026-93679 IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacke... |
medium | 4.3 | — | Langflow / langflow | 2026-10-07 | 2026-10-08 |
| CVE-2026-97671 IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacke... |
medium | 6.5 | — | Langflow / langflow | 2026-10-07 | 2026-10-08 |
| CVE-2026-103360 IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacke... |
medium | 6.5 | — | Langflow / langflow | 2026-10-07 | 2026-10-08 |
| CVE-2026-93448 IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacke... |
medium | 6.5 | — | Langflow / langflow | 2026-10-07 | 2026-10-09 |
| CVE-2026-101331 IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacke... |
medium | 6.5 | — | Langflow / langflow | 2026-10-07 | 2026-10-08 |
| CVE-2026-101329 IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacke... |
medium | 6.5 | — | Langflow / langflow | 2026-10-07 | 2026-10-08 |
| CVE-2026-80048 A flaw was found in `sssd-kcm`. |
medium | 5.5 | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-97626 Requesting a user or organization profile page (`GET /{username}`) with an `Acce... |
medium | 4.3 | — | — | 2026-10-06 | 2026-10-07 |
| CVE-2026-65122 NVIDIA TensorRT contains a vulnerability where an attacker can cause an out of b... |
medium | 5.5 | — | — | 2026-10-06 | 2026-10-07 |
| CVE-2026-89182 With `[repository] FORCE_PRIVATE = true`, Gitea creates new repositories as priv... |
medium | 5.4 | — | Gitea / gitea | 2026-10-06 | 2026-10-13 |
| CVE-2026-96594 The Gitea API endpoint `GET /api/v1/repos/{owner}/{repo}/media/{filepath}` wrote... |
medium | 6.1 | — | Gitea / gitea | 2026-10-06 | 2026-10-13 |
| CVE-2026-97208 The Gitea API endpoint for creating push mirrors (`POST /api/v1/repos/{owner}/{r... |
medium | 4.9 | — | Gitea / gitea | 2026-10-06 | 2026-10-13 |
| CVE-2026-106507 Backstage is an open framework for building developer portals. |
medium | 6.5 | — | Linuxfoundation / backstage plugin-techdocs-node | 2026-10-06 | 2026-10-09 |
| CVE-2026-106508 Backstage is an open framework for building developer portals. |
medium | 6.5 | — | Linuxfoundation / backstage plugin-techdocs-node | 2026-10-06 | 2026-10-09 |
| CVE-2026-106502 Backstage is an open framework for building developer portals. |
medium | 5.3 | — | Linuxfoundation / backstage\/plugin-scaffolder-backend | 2026-10-06 | 2026-10-13 |
| CVE-2026-106504 Backstage is an open framework for building developer portals. |
medium | 6.5 | — | Linuxfoundation / backstage\/plugin-scaffolder-backend | 2026-10-06 | 2026-10-13 |
| CVE-2026-106506 Backstage is an open framework for building developer portals. |
medium | 5.3 | — | Linuxfoundation / backstage\/plugin-scaffolder-backend | 2026-10-06 | 2026-10-09 |
| CVE-2026-106496 Backstage is an open framework for building developer portals. |
medium | 6.5 | — | Linuxfoundation / backstage plugin-catalog-backend | 2026-10-06 | 2026-10-16 |
| CVE-2026-106497 Backstage is an open framework for building developer portals. |
medium | 4.3 | — | Linuxfoundation / backstage plugin-catalog-backend | 2026-10-06 | 2026-10-16 |
| CVE-2026-106499 Backstage is an open framework for building developer portals. |
medium | 4.9 | — | Linuxfoundation / backstage\/plugin-scaffolder-backend | 2026-10-06 | 2026-10-15 |
| CVE-2026-105268 The Gitea API routes for issue attachments (`/api/v1/repos/{owner}/{repo}/issues... |
medium | 4.3 | — | Gitea / gitea | 2026-10-06 | 2026-10-13 |
| CVE-2026-104633 When migrating a repository from another Gitea instance, Gitea used the page siz... |
medium | 6.5 | — | Gitea / gitea | 2026-10-06 | 2026-10-13 |
| CVE-2026-106585 In sshd and ssh in OpenSSH before 10.6, there is no check for whether the maximu... |
medium | 6.5 | — | Openbsd / openssh | 2026-10-06 | 2026-10-15 |
| CVE-2026-106586 In sshd in OpenSSH before 10.6, the restrict keyword (in authorized_keys) was su... |
medium | 4.3 | — | Openbsd / openssh | 2026-10-06 | 2026-10-13 |
| CVE-2026-106491 Backstage is an open framework for building developer portals. |
medium | 6.4 | — | Linuxfoundation / backstage\/plugin-proxy-backend | 2026-10-06 | 2026-10-22 |
| CVE-2026-106492 Backstage is an open framework for building developer portals. |
medium | 6.5 | — | Linuxfoundation / backstage\/backend-defaults | 2026-10-06 | 2026-10-22 |
| CVE-2026-106493 Backstage is an open framework for building developer portals. |
medium | 4.1 | — | Linuxfoundation / backstage | 2026-10-06 | 2026-10-22 |
| CVE-2026-106494 Backstage is an open framework for building developer portals. |
medium | 4.9 | — | Linuxfoundation / backstage\/backend defaults | 2026-10-06 | 2026-10-22 |
| CVE-2026-106552 In sftp in OpenSSH before 10.6, a server can trigger directory traversal (causin... |
medium | 6.5 | — | Openbsd / openssh | 2026-10-06 | 2026-10-13 |
| CVE-2026-106462 Backstage is an open framework for building developer portals. |
medium | 6.4 | — | Linuxfoundation / backstage\/plugin-scaffolder-backend | 2026-10-06 | 2026-10-22 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.