October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,432
Critical
1,333
High
5,825
Medium
6,236
Low
648
Severity not reported
3,390
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1307), google (756), oracle (156), ibm (140), adobe (138), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-91020 The WebToffee Gift Cards for WooCommerce WordPress plugin before 1.3.1 does not... |
medium | 5.3 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-92924 The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not che... |
medium | 5.4 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-63569 Improper input validation in DHAgreement.CalculateAgreement (MTI/A0 two-pass Dif... |
medium | 6.5 | — | Bouncycastle / bc-csharp | 2026-10-02 | 2026-10-28 |
| CVE-2026-79618 The WP User Frontend WordPress plugin before 4.3.12 does not enforce its subscri... |
medium | 4.3 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-13413 The CMP – Coming Soon & Maintenance WordPress plugin before 4.1.20 does not corr... |
medium | 5.3 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-1661 The WP Mail Logging WordPress plugin before 1.17.0 does not properly restrict th... |
medium | 4.3 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-94298 The BuildKit WordPress plugin before 1.0.29 does not properly sanitise and escap... |
medium | 6.2 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-97317 The Giveaways and Contests by RafflePress WordPress plugin before 1.12.27 does n... |
medium | 5.3 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-97318 The Giveaways and Contests by RafflePress WordPress plugin before 1.12.27 does n... |
medium | 6.1 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-90988 The Request a Quote WordPress plugin through 2.5.6 does not perform an authoriza... |
medium | 5.3 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-91022 The Motors WordPress plugin before 1.4.124 does not sanitise and escape a listin... |
medium | 6.8 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-78471 The Autoptimize plugin for WordPress is vulnerable to Stored Cross-Site Scriptin... |
medium | 5.4 | — | — | 2026-10-02 | 2026-10-03 |
| CVE-2026-81740 The Paytm Payment Gateway WordPress plugin before 2.8.9 does not verify that pay... |
medium | 5.3 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-84925 The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is v... |
medium | 6.1 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-85004 The Popup Maker WordPress plugin through 1.4.5 does not perform a capability che... |
medium | 4.3 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-85016 The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not esc... |
medium | 6.8 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-13718 The Tabs Responsive WordPress plugin through 2.5 does not sanitize the content o... |
medium | 6.8 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-104052 A vulnerability was determined in itsourcecode Pet Shop Management System 1.0. |
medium | 6.3 | — | — | 2026-10-02 | 2026-10-06 |
| CVE-2026-104053 A vulnerability was identified in itsourcecode Pet Shop Management System 1.0. |
medium | 6.3 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-104054 A security flaw has been discovered in calcom cal.diy up to 6.2.0. |
medium | 6.3 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2025-71427 Office-PowerPoint-MCP-Server through 2.0.7 contains a path traversal vulnerabili... |
medium | 6.8 | — | — | 2026-10-01 | 2026-10-14 |
| CVE-2026-103760 Mooncake transfer engine through 0.3.13.post1 contains a denial of service vulne... |
medium | 5.9 | — | — | 2026-10-01 | 2026-10-02 |
| CVE-2026-51895 Ragflow 0.24.0 and prior contains improper access control in update_metadata_set... |
medium | 6.5 | — | — | 2026-10-01 | 2026-10-02 |
| CVE-2026-51896 infiniflow ragflow 0.25.3 contains improper access control in resume (api/apps/c... |
medium | 6.5 | — | — | 2026-10-01 | 2026-10-05 |
| CVE-2026-51892 infiniflow ragflow 0.24.0 is vulnerable to Incorrect Access Control via /v1/docu... |
medium | 6.5 | — | — | 2026-10-01 | 2026-10-05 |
| CVE-2026-51894 infiniflow ragflow 0.24.0 is vulnerable to Incorrect Access Control via run_mind... |
medium | 6.5 | — | — | 2026-10-01 | 2026-10-05 |
| CVE-2026-51878 deeptutor 1.4.0 contains an authorization bypass through a user-controlled objec... |
medium | 4.3 | — | — | 2026-10-01 | 2026-10-06 |
| CVE-2026-104002 A fail-open error handling issue within the data masking utility of Powertools f... |
medium | 5.3 | — | — | 2026-10-01 | 2026-10-02 |
| CVE-2026-104356 PictShare before version 3.7.1 contains a weak randomness vulnerability where th... |
medium | 5.9 | — | — | 2026-10-01 | 2026-10-02 |
| CVE-2026-104182 stream-json is a micro-library of stream components for processing JSON and JSON... |
medium | 6.2 | — | — | 2026-10-01 | 2026-10-05 |
| CVE-2026-104183 stream-json is a micro-library of stream components for processing JSON and JSON... |
medium | 5.1 | — | — | 2026-10-01 | 2026-10-02 |
| CVE-2026-104181 Filament is a collection of full-stack components for accelerated Laravel develo... |
medium | 5.4 | — | — | 2026-10-01 | 2026-10-06 |
| CVE-2026-82357 RT-Labs AB C-Open CANopen contains a NULL pointer dereference if the LSS protoco... |
medium | 6.5 | — | — | 2026-10-01 | 2026-10-07 |
| CVE-2026-82358 RT-Labs AB C-Open CANopen contains a write protection bypass in the SDO (Service... |
medium | 6.5 | — | — | 2026-10-01 | 2026-10-07 |
| CVE-2026-93832 A component of one of the Motorola system applications was
exported without perm... |
medium | 4.4 | — | — | 2026-10-01 | 2026-10-02 |
| CVE-2026-55251 NetBox Device Type Library is a collection of community-sourced device type defi... |
medium | 6.5 | — | — | 2026-10-01 | 2026-10-05 |
| CVE-2026-102669 Joyland AI app does not verify hostnames, allowing a malicious host to connect o... |
medium | 5.3 | — | — | 2026-10-01 | 2026-10-11 |
| CVE-2026-102670 Joyland AI app explicitly permits cleartext HTTP traffic on Android 9+ where the... |
medium | 4.3 | — | — | 2026-10-01 | 2026-10-11 |
| CVE-2026-102671 The Joyland AI app accepts invalid SSL certificates in the invisible advertiseme... |
medium | 5.3 | — | — | 2026-10-01 | 2026-10-11 |
| CVE-2026-102666 The Joyland AI app contains hard-coded credentials for the GeTui push notificati... |
medium | 6.5 | — | — | 2026-10-01 | 2026-10-07 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.