October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,016
Critical
1,287
High
5,651
Medium
6,028
Low
636
Severity not reported
3,414
In CISA KEV
19
Most affected vendors (by CPE data where available): microsoft (1303), google (735), oracle (150), ibm (140), adobe (128), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-115596 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-115606 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-118485 Axel Download Accelerator 2.17.14 and earlier performs URL percent-decoding (htt... |
high | 8.1 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-87102 Sensitive information disclosure and manipulation due to improper token validati... |
high | 7.4 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-87103 Sensitive information disclosure and manipulation due to improper token validati... |
high | 7.4 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-6064 Link following vulnerability in Data Shredder components in Norton Antivirus, Av... |
high | 7.3 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-86377 Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS... |
high | 7.6 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-86378 Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS... |
high | 8.8 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-110540 Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.... |
high | 7.1 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-110541 Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS... |
high | 7.2 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-103779 Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS... |
high | 8.3 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2025-30414 Local privilege escalation due to improper authentication. |
high | 7.1 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-86389 Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS... |
high | 7.2 | — | — | 2026-10-28 | 2026-10-30 |
| CVE-2026-86393 Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS... |
high | 7.2 | — | — | 2026-10-28 | 2026-10-30 |
| CVE-2026-86394 Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS... |
high | 7.2 | — | — | 2026-10-28 | 2026-10-30 |
| CVE-2026-86379 Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.... |
high | 7.2 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-86380 Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS... |
high | 7.2 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-86385 Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, con... |
high | 8.8 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-86395 Dell PowerProtect Data Domain Virtual Edition, Feature Release versions 7.7.1.0... |
high | 7.2 | — | — | 2026-10-28 | 2026-10-30 |
| CVE-2026-86396 Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS... |
high | 8.8 | — | — | 2026-10-28 | 2026-10-30 |
| CVE-2026-86398 Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS... |
high | 8.8 | — | — | 2026-10-28 | 2026-10-30 |
| CVE-2026-86399 Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS... |
high | 7.2 | — | — | 2026-10-28 | 2026-10-30 |
| CVE-2026-92797 The MemberPress plugin for WordPress is vulnerable to Cross-Site Request Forgery... |
high | 8.8 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-63286 Database backups are vulnerable to offline attacks. |
high | 7.1 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-110662 The MxChat – AI Chatbot & Content Generation for WordPress plugin for WordPress... |
high | 7.2 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-111111 The Prime Slider – Hero Slider, Carousel, WooCommerce & Post Slider Elementor Ad... |
high | 7.2 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-111120 The VikRentCar Car Rental Management System plugin for WordPress is vulnerable t... |
high | 8.8 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-109381 The Mage Eventpress plugin for WordPress is vulnerable to privilege escalation i... |
high | 7.2 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-109384 The The Innovative Form Builder – IvyForms plugin for WordPress is vulnerable to... |
high | 8.8 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-15323 The Product Designer for WooCommerce WordPress | Lumise plugin for WordPress is... |
high | 7.5 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-111021 The افزونه پیامک ووکامرس | Persian WooCommerce SMS WordPress plugin before 7.3.2... |
high | 7.1 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-111577 The GoSMTP WordPress plugin before 1.2.5 does not perform a settings-management... |
high | 7.2 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-105972 The Menu Cart for WooCommerce WordPress plugin before 3.2.1 does not sanitise an... |
high | 7.5 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-1928 The Rank Math SEO – AI SEO Tools to Dominate SEO Rankings plugin for WordPress i... |
high | 8.8 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-116613 The Animated Text Block plugin for WordPress is vulnerable to Sensitive Informat... |
high | 7.5 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-111255 The affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display plugin... |
high | 7.5 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-97019 The AMP for WP – Accelerated Mobile Pages plugin for WordPress is vulnerable to... |
high | 7.2 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-118375 llama.cpp b8841 before b11865 contains an out-of-bounds write vulnerability in t... |
high | 8.1 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-118377 mews/pos through 2.0.0 contains an insufficient verification of data authenticit... |
high | 7.5 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-118378 Tabularis before 0.28.0 contains an SQL injection vulnerability in its SQLite dr... |
high | 7.8 | — | — | 2026-10-28 | 2026-10-28 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.