October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,417
Critical
1,331
High
5,820
Medium
6,228
Low
648
Severity not reported
3,390
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1307), google (756), oracle (156), ibm (140), adobe (138), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-103284 Ghost versions from 5.125.1 before 6.57.1 contain an information disclosure vuln... |
medium | 4.3 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-103285 Ghost versions from 5.19.0 before 6.57.1 contain a cross-site request forgery vu... |
medium | 4.3 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-103275 Ghost 5.42.2 before 6.58.0 contains an information disclosure vulnerability in t... |
medium | 4.3 | — | — | 2026-10-01 | 2026-10-06 |
| CVE-2026-103276 Ghost versions before 6.20.0 contain a file extension filtering bypass vulnerabi... |
medium | 5.3 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-103279 Ghost versions from 3.10.0 before 6.34.0 fail to fully invalidate all sessions a... |
medium | 6.8 | — | — | 2026-10-01 | 2026-10-06 |
| CVE-2026-103280 Ghost from version 0.8.0 before 6.23.0 contains an information disclosure vulner... |
medium | 5.3 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-103269 Ghost versions 5.3.0 before 6.62.0 contain a missing authorization vulnerability... |
medium | 5.3 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-103273 Ghost versions 4.3.0 before 6.58.0 contain an authentication bypass vulnerabilit... |
medium | 4.3 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-103274 Ghost versions 5.3.0 before 6.58.0 fail to properly enforce access controls on c... |
medium | 5.3 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-103263 Tornado before 6.5.9 contains a path traversal vulnerability in StaticFileHandle... |
medium | 5.9 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-103265 Fleet versions before 4.89.0 fail to properly filter MDM command results by team... |
medium | 4.3 | — | Fleetdm / fleet | 2026-10-01 | 2026-10-08 |
| CVE-2026-103267 Ghost versions before 6.62.0 contain an authentication bypass vulnerability in s... |
medium | 4.3 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-103258 n8n versions before 2.39.6 and 2.40.0 before 2.40.1 contain an unescaped paramet... |
medium | 6.8 | — | — | 2026-10-01 | 2026-10-06 |
| CVE-2026-103260 n8n versions before 2.39.6 and 2.40.0 before 2.40.1 contain an approval bypass v... |
medium | 4.0 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-103261 Tornado before 6.5.9 fails to limit the number of query string fields in HTTPSer... |
medium | 5.3 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-103254 n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2... |
medium | 6.3 | — | — | 2026-10-01 | 2026-10-06 |
| CVE-2026-103245 n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2... |
medium | 5.3 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-83589 A flaw was found in oauth-proxy. |
medium | 6.1 | — | — | 2026-10-01 | 2026-10-30 |
| CVE-2026-96256 The Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns pl... |
medium | 6.4 | — | — | 2026-10-01 | 2026-10-03 |
| CVE-2026-103495 In JetBrains YouTrack before 2026.2.19422 missing authorisation allowed reloadin... |
medium | 4.3 | — | Jetbrains / youtrack | 2026-10-01 | 2026-10-01 |
| CVE-2026-103496 In JetBrains YouTrack before 2026.2.19422 iDOR in inbox threads allowed reading... |
medium | 5.4 | — | Jetbrains / youtrack | 2026-10-01 | 2026-10-01 |
| CVE-2026-103497 In JetBrains YouTrack before 2026.2.19422 sSRF was possible via the GitHub VCS i... |
medium | 5.5 | — | Jetbrains / youtrack | 2026-10-01 | 2026-10-01 |
| CVE-2026-103489 In JetBrains YouTrack before 2026.2.19422 hTML injection in VCS command failure... |
medium | 5.4 | — | Jetbrains / youtrack | 2026-10-01 | 2026-10-05 |
| CVE-2026-103491 In JetBrains YouTrack before 2026.2.19422 iDOR in the issue activities API allow... |
medium | 6.5 | — | Jetbrains / youtrack | 2026-10-01 | 2026-10-01 |
| CVE-2026-103492 In JetBrains YouTrack before 2026.2.19422 doS attack was possible via crafted PS... |
medium | 6.5 | — | Jetbrains / youtrack | 2026-10-01 | 2026-10-01 |
| CVE-2026-103494 In JetBrains YouTrack before 2026.2.19422 privilege escalation was possible via... |
medium | 6.6 | — | Jetbrains / youtrack | 2026-10-01 | 2026-10-02 |
| CVE-2026-96268 The Awesome Support – WordPress HelpDesk & Support Plugin plugin for WordPress i... |
medium | 6.4 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-89424 The Duplicate Post plugin for WordPress is vulnerable to Stored Cross-Site Scrip... |
medium | 6.4 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-89427 The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to... |
medium | 6.1 | — | — | 2026-10-01 | 2026-10-03 |
| CVE-2026-90992 The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scri... |
medium | 6.4 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-100184 The Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Q... |
medium | 4.7 | — | — | 2026-10-01 | 2026-10-03 |
| CVE-2026-101925 The bbp style pack plugin for WordPress is vulnerable to Stored Cross-Site Scrip... |
medium | 6.4 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-100179 The Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Q... |
medium | 6.1 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-89047 The Social Media Share Buttons & Social Sharing Icons plugin for WordPress is vu... |
medium | 6.1 | — | — | 2026-10-01 | 2026-10-03 |
| CVE-2026-19902 The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to... |
medium | 6.1 | — | — | 2026-10-01 | 2026-10-03 |
| CVE-2026-103544 A vulnerability was found in datadrivenconstruction OpenConstructionERP up to 14... |
medium | 6.3 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-96200 The Payments for Hubtel WordPress plugin before 1.0.2 does not verify that payme... |
medium | 5.3 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-90974 The WP Fusion Lite WordPress plugin before 3.48.0 does not require authenticatio... |
medium | 6.5 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-96173 The Payments for Hubtel WordPress plugin before 1.0.2 does not verify that the r... |
medium | 5.3 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-90972 The WP Fusion Lite WordPress plugin before 3.48.0 does not perform a capability... |
medium | 5.4 | — | — | 2026-10-01 | 2026-10-01 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.