October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,456
Critical
1,335
High
5,835
Medium
6,248
Low
648
Severity not reported
3,390
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1307), google (756), oracle (156), ibm (140), adobe (138), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-94669 Missing Authorization vulnerability in WP ManageNinja LLC Fluent Forms Pro Add O... |
medium | 5.3 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-39763 Missing Authorization vulnerability in Deepak Anand WP Dummy Content Generator w... |
medium | 4.3 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-105291 A vulnerability was identified in feelec-yishu feelcrm-os 1.0.0. |
medium | 4.3 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-105286 A vulnerability was detected in Totolink A3002MU 1.0.0-B20230403.1455. |
medium | 6.3 | — | — | 2026-10-05 | 2026-10-07 |
| CVE-2026-105287 A flaw has been found in feelec-yishu feelcrm-os 1.0.0. |
medium | 6.3 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-105288 A vulnerability has been found in feelec-yishu feelcrm-os 1.0.0. |
medium | 4.3 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-39721 Missing Authorization vulnerability in Brainstorm Force Starter Templates astra-... |
medium | 5.4 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-97071 Incorrect Calculation vulnerability in VillaTheme CURCY woo-multi-currency allow... |
medium | 5.3 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-105263 A security flaw has been discovered in Shaarli up to 0.16.3. |
medium | 4.7 | — | — | 2026-10-05 | 2026-10-05 |
| CVE-2026-105062 Missing Authorization vulnerability in Brandtoss WP Admin Audit wp-admin-audit a... |
medium | 4.3 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-105064 Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection... |
medium | 6.5 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-105068 Insertion of Sensitive Information Into Sent Data vulnerability in Pixelite Even... |
medium | 5.3 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-105069 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-105251 A vulnerability was detected in vgmstream up to r2117. |
medium | 6.3 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-105254 A vulnerability was identified in itsourcecode Online Admission System 1.0. |
medium | 6.3 | — | — | 2026-10-05 | 2026-10-07 |
| CVE-2026-105055 Missing Authorization vulnerability in WP Mailster WP Mailster wp-mailster allow... |
medium | 5.3 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-105056 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-105060 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-104675 Missing Authorization vulnerability in Liquid Web / StellarWP Event Tickets even... |
medium | 4.3 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-104400 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-104401 Exposure of Sensitive System Information to an Unauthorized Control Sphere vulne... |
medium | 4.3 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-104404 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-104409 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-104673 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-104386 Missing Authorization vulnerability in WPFunnels Team WP VR wpvr allows Exploiti... |
medium | 6.5 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-104388 Missing Authorization vulnerability in Blubrry Podcasting PowerPress Podcasting... |
medium | 5.3 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-104396 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-104397 Missing Authorization vulnerability in Jeroen Peters Name Directory name-directo... |
medium | 5.3 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-102914 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-103078 Authorization Bypass Through User-Controlled Key vulnerability in Ahmad JS Help... |
medium | 4.3 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-103079 Authorization Bypass Through User-Controlled Key vulnerability in Ahmad JS Help... |
medium | 5.4 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-103084 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-103351 Improper Validation of Specified Quantity in Input vulnerability in Magepeople i... |
medium | 5.3 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-102393 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-105248 A security flaw has been discovered in vgmstream up to r2117. |
medium | 6.3 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-105249 A weakness has been identified in vgmstream up to r2117. |
medium | 4.8 | — | — | 2026-10-05 | 2026-10-07 |
| CVE-2026-105250 A security vulnerability has been detected in vgmstream up to r2117. |
medium | 4.3 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-19954 Net::Whois::Raw versions before 2.99044 for Perl ship a pwhois command-line tool... |
medium | 5.4 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-100727 An improper access control vulnerability exists in GROWI, which allow an unauthe... |
medium | 5.3 | — | — | 2026-10-05 | 2026-10-05 |
| CVE-2026-84169 The UPI QR Code Payment Gateway WordPress plugin through 1.4.3 does not verify t... |
medium | 5.3 | — | — | 2026-10-05 | 2026-10-06 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.