October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,432
Critical
1,333
High
5,825
Medium
6,236
Low
648
Severity not reported
3,390
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1307), google (756), oracle (156), ibm (140), adobe (138), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-104438 YesWiki before 4.6.7 contains a missing authorization vulnerability in the listp... |
medium | 5.3 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-104439 YesWiki before 4.6.7 contains a user enumeration vulnerability in LostPasswordAc... |
medium | 5.3 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-104440 YesWiki before 4.6.7 contains a blind server-side request forgery vulnerability... |
medium | 5.3 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-104441 YesWiki before 4.6.7 contains an unauthenticated server-side request forgery vul... |
medium | 5.3 | — | — | 2026-10-02 | 2026-10-06 |
| CVE-2026-104427 Zebra before 6.1.0 contains an incomplete cleanup vulnerability in the state wri... |
medium | 5.9 | — | — | 2026-10-02 | 2026-10-05 |
| CVE-2026-104428 The getblock RPC method in zebra-rpc before 11.0.0, used by the Zcash Foundation... |
medium | 5.3 | — | — | 2026-10-02 | 2026-10-06 |
| CVE-2026-104429 Zebra (zebrad) 5.0.0 before 6.0.0-rc.0 does not apply its per-peer mempool admis... |
medium | 5.3 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-104432 Zebra before 6.3.0 contains an improper exceptional condition check in ChainSync... |
medium | 5.3 | — | — | 2026-10-02 | 2026-10-06 |
| CVE-2026-104434 ZcashFoundation Zebra zebra-rpc before 8.0.0 and zebrad before 4.5.0 contain a r... |
medium | 6.5 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-104421 Zebra before 6.2.1 contains an incomplete cleanup vulnerability that allows unau... |
medium | 5.3 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-104425 ZcashFoundation Zebra before 6.1.0 contains a resource exhaustion vulnerability... |
medium | 5.3 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-104426 Zebra before 6.1.0 contains an inefficient algorithmic complexity vulnerability... |
medium | 5.9 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-104417 Ghost from 1.20.0 before 6.64.0 contains a path traversal vulnerability in theme... |
medium | 4.9 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-104419 Zebra (zebrad) 4.5.0 before 6.3.0 discards which peer supplied the block hashes... |
medium | 4.8 | — | — | 2026-10-02 | 2026-10-05 |
| CVE-2026-104420 Zebra before 6.3.0 contains a protection mechanism failure that allows unauthent... |
medium | 5.3 | — | — | 2026-10-02 | 2026-10-06 |
| CVE-2026-103763 SiYuan before v3.8.5 contains an information disclosure vulnerability that allow... |
medium | 5.8 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-104412 Ghost 0.5.0 before 6.64.0 does not correctly restrict staff role assignment, all... |
medium | 4.3 | — | — | 2026-10-02 | 2026-10-06 |
| CVE-2026-103762 SiYuan before v3.8.5 contains a missing authorization vulnerability in the getRe... |
medium | 5.3 | — | — | 2026-10-02 | 2026-10-06 |
| CVE-2026-97876 A local attacker with control over GRUB's configuration can bypass lockdown rest... |
medium | 6.4 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-104606 A security flaw has been discovered in itsourcecode Online Admission System Proj... |
medium | 6.3 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-97652 The WP Statistics – Simple, privacy-friendly Google Analytics alternative plugin... |
medium | 6.1 | — | — | 2026-10-02 | 2026-10-03 |
| CVE-2026-94180 Authorization Bypass Through User-Controlled Key vulnerability in Monetizemore A... |
medium | 4.3 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-94405 Authorization Bypass Through User-Controlled Key vulnerability in Shahjada Downl... |
medium | 5.3 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-85492 The All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Loca... |
medium | 6.1 | — | — | 2026-10-02 | 2026-10-03 |
| CVE-2026-104403 Authorization Bypass Through User-Controlled Key vulnerability in ThimPress Lear... |
medium | 5.3 | — | — | 2026-10-02 | 2026-10-03 |
| CVE-2026-95512 A flaw was found in FreeType, specifically within its CID font loader. |
medium | 5.5 | — | — | 2026-10-02 | 2026-10-06 |
| CVE-2026-80337 Missing Authorization vulnerability in HAVELSAN Inc. |
medium | 5.3 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-80464 Server-Side request forgery (SSRF) vulnerability in HAVELSAN Inc. |
medium | 4.9 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-97338 The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scr... |
medium | 6.4 | — | — | 2026-10-02 | 2026-10-03 |
| CVE-2026-97634 The Event Tickets and Registration plugin for WordPress is vulnerable to generic... |
medium | 6.5 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-96647 The Listdom: AI-powered Business Directory with Classifieds Ads Listings plugin... |
medium | 6.4 | — | — | 2026-10-02 | 2026-10-03 |
| CVE-2026-93880 The Greenshift – animation and page builder blocks plugin for WordPress is vulne... |
medium | 6.1 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-94432 The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress... |
medium | 5.3 | — | — | 2026-10-02 | 2026-10-03 |
| CVE-2026-12951 The Dc Woocommerce Multi Vendor plugin for WordPress is vulnerable to SQL Inject... |
medium | 6.5 | — | — | 2026-10-02 | 2026-10-03 |
| CVE-2026-103602 Improper certificate validation in PkixNameConstraintValidator in Legion of the... |
medium | 5.3 | — | Bouncycastle / bc-csharp | 2026-10-02 | 2026-10-28 |
| CVE-2026-97219 The MStore API WordPress plugin before 4.22.1 does not restrict which fields of... |
medium | 4.3 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-84740 The Events Calendar WordPress plugin before 6.17.5.1 does not validate or saniti... |
medium | 6.5 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-85005 The Popup Maker WP WordPress plugin through 1.4.5 does not perform authorization... |
medium | 5.4 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-90952 The WP Edit Password Protected WordPress plugin before 2.0.7 does not enforce it... |
medium | 5.3 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-90987 The Easy PayPal & Stripe Buy Now Button WordPress plugin before 2.0.6 does not d... |
medium | 5.3 | — | — | 2026-10-02 | 2026-10-02 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.