October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,417
Critical
1,331
High
5,820
Medium
6,228
Low
648
Severity not reported
3,390
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1307), google (756), oracle (156), ibm (140), adobe (138), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-42528 A memory calculation bug in mod_dav in Apache httpd 2.4.67 and earlier allows an... |
medium | 4.3 | — | Apache / http server | 2026-10-01 | 2026-10-06 |
| CVE-2026-17053 The SMBus driver API exposed smbus_smbalert_remove_cb() and smbus_host_notify_re... |
medium | 4.4 | — | — | 2026-10-01 | 2026-10-02 |
| CVE-2026-103690 A flaw has been found in itsourcecode Leave Management System 1.0. |
medium | 6.3 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-103505 Improper neutralization of argument delimiters in the volume handling component... |
medium | 6.5 | — | — | 2026-10-01 | 2026-10-02 |
| CVE-2026-97269 Unauthenticated Insecure Direct Object References (IDOR) in WPFunnels <= 3.13.1... |
medium | 6.5 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-97280 Missing Authorization vulnerability in Mamunur Rashid Review Schema review-schem... |
medium | 6.5 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-97281 Subscriber Broken Access Control in WP Project Manager <= 4.0.7 versions. |
medium | 6.3 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-97251 Unauthenticated Insecure Direct Object References (IDOR) in Bus Ticket Booking w... |
medium | 6.5 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-97258 Subscriber Broken Access Control in Aruba Migration Tool <= 1.0.4 versions. |
medium | 6.5 | — | — | 2026-10-01 | 2026-10-03 |
| CVE-2026-67104 HCL BigFix Service Management is affected by an Information Disclosure vulnerabi... |
medium | 5.3 | — | Hcltech / bigfix service management | 2026-10-01 | 2026-10-05 |
| CVE-2026-67106 HCL BigFix Service Management is affected by an Information Disclosure vulnerabi... |
medium | 5.3 | — | Hcltech / bigfix service management | 2026-10-01 | 2026-10-05 |
| CVE-2026-79900 boks_ksllogsd accepts a checksum algorithm name in the MD field of an authentica... |
medium | 6.5 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-103347 Unauthenticated Bypass Vulnerability in hCaptcha for WP <= 5.3.0 versions. |
medium | 5.3 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-103004 Next.js versions from 16.3.0 to 16.3.7 warm `use cache` handlers using `next/roo... |
medium | 5.3 | — | Vercel / next.js | 2026-10-01 | 2026-10-05 |
| CVE-2026-66247 iControl is affected by an insecure Cross-Origin Resource Sharing (CORS) policy... |
medium | 4.3 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-102505 Imager versions before 1.037 for Perl overflow a heap buffer fetching float samp... |
medium | 6.3 | — | Tonycoz / imager | 2026-10-01 | 2026-10-08 |
| CVE-2026-62061 Authorization Bypass Through User-Controlled Key vulnerability in Metagauss Prof... |
medium | 5.3 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-62063 Missing Authorization vulnerability in Magepeople inc. |
medium | 5.4 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-103345 Insertion of Sensitive Information Into Sent Data vulnerability in Shamim Rajani... |
medium | 5.3 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-62058 Insertion of Sensitive Information Into Sent Data vulnerability in WPExperts CF7... |
medium | 5.3 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-103064 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-103339 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-103340 Missing Authorization vulnerability in Gemini Labs Site Reviews site-reviews all... |
medium | 5.3 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-103341 Missing Authorization vulnerability in Unlimited Elements Unlimited Elements For... |
medium | 5.3 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-103343 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-102381 Missing Authorization vulnerability in Ahmad Majestic Support majestic-support a... |
medium | 5.3 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-102382 Authorization Bypass Through User-Controlled Key vulnerability in Ahmad Majestic... |
medium | 4.3 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-102390 Missing Authorization vulnerability in VillaTheme AFFI – Affiliate Marketing for... |
medium | 5.3 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-102394 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-103063 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-103679 A flaw was found in tnef. |
medium | 6.5 | — | Tnef Project / tnef | 2026-10-01 | 2026-10-05 |
| CVE-2026-103680 A flaw was found in tnef. |
medium | 6.5 | — | Tnef Project / tnef | 2026-10-01 | 2026-10-05 |
| CVE-2026-103754 A flaw was found in ansible-runner. |
medium | 5.9 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-103336 Insertion of Sensitive Information Into Sent Data vulnerability in Smackcoders I... |
medium | 5.3 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-103353 Incorrect Behavior Order vulnerability in WP ManageNinja LLC FluentForm fluentfo... |
medium | 5.3 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-103288 Ghost, an open-source publishing platform, contains an input validation flaw in... |
medium | 6.5 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-103289 Ghost from 5.9.0 before 6.44.1 contains an input validation issue in the comment... |
medium | 6.5 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-103291 Ghost versions from 3.20.2 before 6.51.0 contain a server-side request forgery v... |
medium | 6.4 | — | — | 2026-10-01 | 2026-10-06 |
| CVE-2026-103281 Ghost (npm package 'ghost') versions from 3.23.0 up to, but not including, 6.23.... |
medium | 5.4 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-103282 Ghost versions 0.5.0 before 6.23.0 contain a concurrency issue in the staff invi... |
medium | 4.3 | — | — | 2026-10-01 | 2026-10-01 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.