October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,432
Critical
1,333
High
5,825
Medium
6,236
Low
648
Severity not reported
3,390
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1307), google (756), oracle (156), ibm (140), adobe (138), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-94486 Next.js is a React framework for building full-stack web applications. |
medium | 5.4 | — | Vercel / next.js | 2026-10-02 | 2026-10-05 |
| CVE-2026-51899 In SuperAGI v0.0.14 and prior, controller endpoints (/api/agents/create, /api/ag... |
medium | 4.3 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-104844 PostCSS Selector Parser is a CSS selector parser that integrates with PostCSS bu... |
medium | 5.9 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-103629 Integer overflow in Skia in Google Chrome prior to 154.0.8037.97 allowed a remot... |
medium | 4.3 | — | Google / chrome | 2026-10-02 | 2026-10-05 |
| CVE-2026-103621 Integer overflow in Compositing in Google Chrome prior to 154.0.8037.97 allowed... |
medium | 4.3 | — | Google / chrome | 2026-10-02 | 2026-10-05 |
| CVE-2026-103627 Information leak in SVG in Google Chrome prior to 154.0.8037.97 allowed a remote... |
medium | 6.5 | — | Google / chrome | 2026-10-02 | 2026-10-06 |
| CVE-2026-39717 Missing Authorization vulnerability in ThimPress LearnPress learnpress allows Ex... |
medium | 4.3 | — | — | 2026-10-02 | 2026-10-09 |
| CVE-2026-5782 Improper neutralization of input during web page generation ('cross-site scripti... |
medium | 5.2 | — | — | 2026-10-02 | 2026-10-05 |
| CVE-2026-104638 A security vulnerability has been detected in onetwothreeneth HospitalManagement... |
medium | 5.3 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-32584 Insertion of Sensitive Information Into Sent Data vulnerability in Chiranjit Haz... |
medium | 5.3 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-32585 Missing Authorization vulnerability in airano Airano MCP Bridge airano-mcp-bridg... |
medium | 6.5 | — | — | 2026-10-02 | 2026-10-03 |
| CVE-2026-39439 Missing Authorization vulnerability in Kiera Howe WebSamurai websamurai allows E... |
medium | 6.5 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-39444 Authorization Bypass Through User-Controlled Key vulnerability in PublishPress P... |
medium | 5.4 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-39600 URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Mehul Gohil... |
medium | 4.7 | — | — | 2026-10-02 | 2026-10-07 |
| CVE-2026-104625 A security flaw has been discovered in CodeAstro Simple Loan Management System 1... |
medium | 6.3 | — | — | 2026-10-02 | 2026-10-06 |
| CVE-2026-104613 A vulnerability was determined in CodeAstro Simple Pharmacy Management System 1.... |
medium | 6.3 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-104614 A vulnerability was identified in CodeAstro Simple Pharmacy Management System 1.... |
medium | 6.3 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-85209 Missing Authorization vulnerability in AVEZ Electronics Communication Training a... |
medium | 6.5 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-11795 Observable discrepancy vulnerability in Softtr Informatics Trading Limited Compa... |
medium | 5.3 | — | — | 2026-10-02 | 2026-10-08 |
| CVE-2026-104612 A vulnerability was found in SourceCodester Student Result Management System 1.0... |
medium | 4.3 | — | — | 2026-10-02 | 2026-10-06 |
| CVE-2026-102797 Server-Side Request Forgery (SSRF) vulnerability in ThemeREX Group ThemeREX Addo... |
medium | 6.4 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-102798 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-104473 YesWiki before 4.5.3 contains multiple reflected cross-site scripting vulnerabil... |
medium | 6.1 | — | — | 2026-10-02 | 2026-10-08 |
| CVE-2026-104465 YesWiki before 4.6.7 contains a reflected cross-site scripting vulnerability tha... |
medium | 6.1 | — | — | 2026-10-02 | 2026-10-06 |
| CVE-2026-104466 YesWiki before 4.6.7 contains a stored cross-site scripting vulnerability in for... |
medium | 5.4 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-104468 YesWiki before 4.6.7 contains an insufficient session expiration vulnerability t... |
medium | 4.8 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-104469 YesWiki before 4.6.7 contains a session fixation vulnerability that allows attac... |
medium | 6.8 | — | — | 2026-10-02 | 2026-10-06 |
| CVE-2026-104470 YesWiki before 4.6.7 contains a server-side request forgery vulnerability that a... |
medium | 5.0 | — | — | 2026-10-02 | 2026-10-04 |
| CVE-2026-104461 YesWiki before 4.6.7 contains a stored cross-site scripting vulnerability in the... |
medium | 5.4 | — | — | 2026-10-02 | 2026-10-06 |
| CVE-2026-104453 YesWiki before 4.6.7 contains a cross-site request forgery vulnerability in the... |
medium | 5.4 | — | — | 2026-10-02 | 2026-10-06 |
| CVE-2026-104454 YesWiki before 4.6.7 contains an algorithmic-complexity denial of service in the... |
medium | 5.3 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-104455 YesWiki before 4.6.7 contains an access control bypass vulnerability that allows... |
medium | 5.3 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-104458 YesWiki before 4.6.7 contains a server-side request forgery vulnerability in val... |
medium | 6.5 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-104459 YesWiki before 4.6.7 contains a server-side request forgery vulnerability in Web... |
medium | 6.5 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-104449 YesWiki before 4.6.7 contains an access control vulnerability allowing unauthent... |
medium | 6.5 | — | — | 2026-10-02 | 2026-10-06 |
| CVE-2026-104450 YesWiki before 4.6.7 contains a missing authorization flaw in the pointimage act... |
medium | 6.5 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-104451 YesWiki before 4.6.7 contains a cross-site request forgery vulnerability in Revi... |
medium | 4.3 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-104452 YesWiki before 4.6.7 contains a cross-site request forgery vulnerability in the... |
medium | 5.4 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-104442 YesWiki before 4.6.7 contains an unauthenticated server-side request forgery vul... |
medium | 5.8 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-104446 YesWiki before 4.6.7 contains an authentication bypass in the contact mail AJAX... |
medium | 6.5 | — | — | 2026-10-02 | 2026-10-02 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.