October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,456
Critical
1,335
High
5,835
Medium
6,248
Low
648
Severity not reported
3,390
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1307), google (756), oracle (156), ibm (140), adobe (138), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-105836 QloApps through 1.7.0 contains an authorization bypass vulnerability in AdminPro... |
medium | 5.4 | — | — | 2026-10-06 | 2026-10-16 |
| CVE-2026-97308 Unauthenticated Bypass Vulnerability in Login Lockdown <= 2.17 versions. |
medium | 4.8 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-42637 Unauthenticated Settings Change in PayPlug for WooCommerce (Official) <= 3.1.0 v... |
medium | 6.5 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-39798 Unauthenticated Settings Change in TrueBooker <= 1.2.9 versions. |
medium | 6.5 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-39787 Unauthenticated Broken Access Control in 10Web Social Photo Feed <= 1.4.35 versi... |
medium | 6.5 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-39788 Subscriber Cross Site Scripting (XSS) in Front End PM <= 11.4.6 versions. |
medium | 6.5 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-39791 Unauthenticated Sensitive Data Exposure in Mailjet Email Marketing <= 6.2.3 vers... |
medium | 5.3 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-39772 Unauthenticated Bypass Vulnerability in Captcha by BestWebSoft <= 5.2.8 versions... |
medium | 5.3 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-39762 Missing Authorization vulnerability in Patterns In The Cloud Autoship Cloud for... |
medium | 6.5 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-39767 Subscriber Denial of Service Attack in WPBase Cache <= 5.5.6 versions. |
medium | 6.5 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-39754 Contributor Arbitrary File Download in Piotnet Addons For Elementor <= 7.1.71 ve... |
medium | 6.5 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-39756 Unauthenticated Insecure Direct Object References (IDOR) in Wappointment <= 2.7.... |
medium | 6.5 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-39749 Subscriber Broken Access Control in App for Cloudflare® <= 1.10.1 versions. |
medium | 6.5 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-39727 Subscriber Cross Site Scripting (XSS) in WC Fields Factory <= 4.1.12 versions. |
medium | 6.5 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-32571 Subscriber Cross Site Scripting (XSS) in Ohio Extra <= 3.6.8 versions. |
medium | 6.5 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-105809 A vulnerability was identified in SourceCodester Simple Student Information Syst... |
medium | 4.3 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-105879 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-105057 Unauthenticated Bypass Vulnerability in Zero Spam <= 5.7.11 versions. |
medium | 5.3 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-105059 Missing Authorization vulnerability in royalnavneet Delete All Comments of wordp... |
medium | 6.5 | — | — | 2026-10-06 | 2026-10-12 |
| CVE-2026-100518 Unauthenticated Broken Authentication in Advanced Google reCAPTCHA <= 5.40 versi... |
medium | 5.3 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-105305 A flaw was found in the OIDC implementation of Keycloak, specifically within the... |
medium | 5.4 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-94278 The File Media Renamer WordPress plugin through 1.3 does not verify that the req... |
medium | 5.5 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-94299 The elegro Crypto Payment WordPress plugin through 1.0.1 does not require a shar... |
medium | 6.5 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-86786 The Slider Pro WordPress plugin through 1.0.0 does not perform any capability or... |
medium | 5.3 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-89289 The Fast Courier WordPress plugin through 5.2.3 does not restrict an unauthentic... |
medium | 5.3 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-94270 The Deema Payment Gateway WordPress plugin through 1.1.2 does not verify the aut... |
medium | 5.3 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-94271 The Deema Payment Gateway WordPress plugin through 1.1.2 does not verify the pay... |
medium | 5.3 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-25269 Memory corruption when processing camera requests with excessive batch and IO bu... |
medium | 6.7 | — | Qualcomm / snapdragon g1 gen 2 gaming platform firmware | 2026-10-06 | 2026-10-09 |
| CVE-2026-25270 Memory corruption when processing command buffer requests with invalid length pa... |
medium | 6.7 | — | Qualcomm / snapdragon g1 gen 2 gaming platform firmware | 2026-10-06 | 2026-10-09 |
| CVE-2026-25272 Memory Corruption when processing camera CRE driver operations with improper han... |
medium | 6.7 | — | Qualcomm / snapdragon g1 gen 2 gaming platform firmware | 2026-10-06 | 2026-10-09 |
| CVE-2026-25273 Memory Corruption when processing camera operations due to out-of-bounds write d... |
medium | 6.7 | — | Qualcomm / congo firmware | 2026-10-06 | 2026-10-09 |
| CVE-2026-25274 Memory Corruption when processing concurrent DMA buffer allocation and deallocat... |
medium | 6.7 | — | Qualcomm / aqt1000 firmware | 2026-10-06 | 2026-10-09 |
| CVE-2026-25263 Memory corruption while processing IOCTL command called from user space to the k... |
medium | 6.6 | — | Qualcomm / snapdragon g1 gen 2 gaming platform firmware | 2026-10-06 | 2026-10-09 |
| CVE-2026-97300 Unauthenticated Broken Access Control in WP Event Solution <= 4.1.25 versions. |
medium | 6.5 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-105708 A flaw has been found in imgproxy up to 4.0.17. |
medium | 4.3 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-105775 A security vulnerability has been detected in vllm-project vLLM up to 0.31.0. |
medium | 4.3 | — | — | 2026-10-06 | 2026-10-09 |
| CVE-2026-32576 Authorization Bypass Through User-Controlled Key vulnerability in ZWEISCHNEIDER... |
medium | 6.5 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-32582 Missing Authorization vulnerability in iatoai IATO MCP iato-mcp allows Exploitin... |
medium | 6.5 | — | — | 2026-10-06 | 2026-10-08 |
| CVE-2026-39599 Contributor Broken Access Control in WDS MCP Content Manager <= 3.10.4 versions. |
medium | 4.3 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-105706 A weakness has been identified in SourceCodester Drug Recommendation System 1.0. |
medium | 4.3 | — | — | 2026-10-06 | 2026-10-06 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.