October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,370
Critical
1,327
High
5,803
Medium
6,212
Low
648
Severity not reported
3,380
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1307), google (756), oracle (156), ibm (140), adobe (138), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-105156 A weakness has been identified in YzmCMS up to 7.6. |
low | 3.7 | — | — | 2026-10-04 | 2026-10-06 |
| CVE-2026-104119 The Simple Shopping Cart WordPress plugin before 5.2.6 does not escape some of i... |
low | 3.5 | — | — | 2026-10-04 | 2026-10-06 |
| CVE-2026-105099 A weakness has been identified in Omega Solution CoinEx Crypto 2025. |
low | 3.5 | — | — | 2026-10-04 | 2026-10-06 |
| CVE-2026-105130 LaraDashboard from 1.4.0 before 1.4.8 contains a race condition vulnerability in... |
low | 3.7 | — | — | 2026-10-04 | 2026-10-05 |
| CVE-2026-105125 LaraDashboard before 1.4.8 contains a path traversal vulnerability that allows u... |
low | 3.7 | — | — | 2026-10-04 | 2026-10-05 |
| CVE-2026-96962 The Pie Register WordPress plugin before 3.8.4.14 does not restrict access to an... |
low | 3.7 | — | — | 2026-10-03 | 2026-10-06 |
| CVE-2026-86834 The MetForm WordPress plugin before 4.3.1 does not properly restrict access to a... |
low | 3.7 | — | — | 2026-10-03 | 2026-10-06 |
| CVE-2026-80518 The WP Ultimate CSV Importer WordPress plugin before 9.2 does not use a site-spe... |
low | 3.7 | — | — | 2026-10-03 | 2026-10-06 |
| CVE-2026-80517 The WP Ultimate CSV Importer WordPress plugin before 9.2 does not properly valid... |
low | 3.5 | — | — | 2026-10-03 | 2026-10-06 |
| CVE-2026-105051 Denuvo Anti-Tamper through 2026-03-04 allows bypass of a hypervisor presence che... |
low | 1.9 | — | — | 2026-10-02 | 2026-10-06 |
| CVE-2026-105043 MathWorks Simulink before R2026b, when showing a crafted .slx file, can have blo... |
low | 3.6 | — | — | 2026-10-02 | 2026-10-06 |
| CVE-2026-104994 Trivy before 0.71.0 allows directory traversal in Terraform filesystem functions... |
low | 2.5 | — | — | 2026-10-02 | 2026-10-05 |
| CVE-2026-39601 Concurrent Execution using Shared Resource with Improper Synchronization ('Race... |
low | 3.7 | — | — | 2026-10-02 | 2026-10-05 |
| CVE-2026-104436 Zebra before 4.5.0 contains an uncontrolled resource consumption vulnerability t... |
low | 3.7 | — | — | 2026-10-02 | 2026-10-29 |
| CVE-2026-104424 Zebra before 6.1.0 contains an incorrect calculation vulnerability in its ZIP-31... |
low | 3.7 | — | — | 2026-10-02 | 2026-10-06 |
| CVE-2026-104415 Ghost from 0.7.2 before 6.64.0 contains an information disclosure vulnerability... |
low | 3.1 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-102002 The Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE plu... |
low | 3.1 | — | — | 2026-10-02 | 2026-10-03 |
| CVE-2026-91023 The Motors WordPress plugin before 1.4.124 does not properly verify that a user... |
low | 3.1 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-67172 HCL BigFix Service Management is affected by an Information Disclosure vulnerabi... |
low | 3.7 | — | Hcltech / bigfix service management | 2026-10-01 | 2026-10-06 |
| CVE-2026-21833 HCL AION is affected by a vulnerability in which the Content-Security-Policy (CS... |
low | 3.7 | — | — | 2026-10-01 | 2026-10-02 |
| CVE-2026-42356 Deployment of wrong handler vulnerability in Apache HTTP Server allows the targe... |
low | 3.7 | — | Apache / http server | 2026-10-01 | 2026-10-06 |
| CVE-2026-56599 HCL BigFix Service Management is affected by an Insecure Cookie Attribute Config... |
low | 2.2 | — | Hcltech / bigfix service management | 2026-10-01 | 2026-10-05 |
| CVE-2026-66248 iControl is affected by an Improper Error Handling vulnerability, which could al... |
low | 3.1 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-66249 iControl is affected by a Missing Secure Attribute vulnerability, which could al... |
low | 3.1 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-66253 iControl is affected by a Session Timeout vulnerability, which could allow an at... |
low | 3.1 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-103686 A flaw has been found in rhukster dom-sanitizer up to 1.0.15. |
low | 3.5 | — | — | 2026-10-01 | 2026-10-06 |
| CVE-2026-103287 Ghost versions 1.18.0 before 6.27.0 contain a server-side request forgery vulner... |
low | 2.7 | — | — | 2026-10-01 | 2026-10-06 |
| CVE-2026-103290 Ghost versions 6.14.0 through versions prior to 6.27.0 contain a path traversal... |
low | 3.8 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-87973 The If-So Dynamic Content WordPress plugin before 1.10.2 does not sanitize a con... |
low | 3.1 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-101887 BlueALSA (bluez-alsa/bluealsad) contains a division-by-zero vulnerability in the... |
low | 3.5 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-110176 The File Force Download module for Drupal 7 implements hook_file_download() to a... |
not reported | — | — | — | 2026-10-31 | 2026-10-31 |
| CVE-2026-117656 Acceptance of Extraneous Untrusted Data With Trusted Data vulnerability in the S... |
not reported | — | — | — | 2026-10-31 | 2026-10-31 |
| CVE-2026-77152 Improper Authorization vulnerability in Drupal Field Collection for Drupal 7 all... |
not reported | — | — | — | 2026-10-31 | 2026-10-31 |
| CVE-2026-63400 Coop is an open source review and moderation tool from ROOST. |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-63401 Coop is an open source review and moderation tool from ROOST. |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-63414 Shopify App is a Rails engine for building Shopify applications. |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-63346 Refitter is a tool for generating a C# REST API client using the Refit library. |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-63393 OpenSearch SQL supports querying OpenSearch data using SQL and Piped Processing... |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-63396 Coop is an open source review and moderation tool from ROOST. |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-63398 Coop is an open source review and moderation tool from ROOST. |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.