October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,371
Critical
1,328
High
5,804
Medium
6,212
Low
648
Severity not reported
3,379
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1307), google (756), oracle (156), ibm (140), adobe (138), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-96660 The User Registration & Membership – Free & Paid Memberships, Subscriptions, Con... |
high | 7.2 | — | — | 2026-10-17 | 2026-10-19 |
| CVE-2026-108123 The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to a... |
high | 7.5 | — | — | 2026-10-17 | 2026-10-19 |
| CVE-2026-103899 The EU VAT Assistant for WooCommerce plugin for WordPress is vulnerable to Store... |
high | 7.2 | — | — | 2026-10-17 | 2026-10-19 |
| CVE-2026-107762 The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordP... |
high | 7.5 | — | — | 2026-10-17 | 2026-10-19 |
| CVE-2026-109208 The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin... |
high | 7.2 | — | — | 2026-10-17 | 2026-10-19 |
| CVE-2026-104734 The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordP... |
high | 7.2 | — | — | 2026-10-17 | 2026-10-19 |
| CVE-2026-111853 An issue was discovered on Tektronix 3 Series MDO devices before 1.21.1. |
high | 8.8 | — | — | 2026-10-17 | 2026-10-19 |
| CVE-2026-111854 An issue was discovered on Tektronix 3 Series MDO devices before 1.21.1. |
high | 8.1 | — | — | 2026-10-17 | 2026-10-19 |
| CVE-2026-111855 An issue was discovered on Tektronix 3 Series MDO devices before 1.21.1. |
high | 7.5 | — | — | 2026-10-17 | 2026-10-21 |
| CVE-2026-110758 Text::CSV_XS versions before 1.65 for Perl read before the start of an all-blank... |
high | 7.5 | — | — | 2026-10-16 | 2026-10-20 |
| CVE-2026-110752 Text::CSV_XS versions before 1.65 for Perl allow memory exhaustion by allocating... |
high | 7.5 | — | — | 2026-10-16 | 2026-10-20 |
| CVE-2026-110755 Text::CSV_XS versions before 1.65 for Perl allow quadratic CPU use by copying th... |
high | 7.5 | — | — | 2026-10-16 | 2026-10-20 |
| CVE-2026-96626 Arcane is an interface for managing Docker containers, images, networks, and vol... |
high | 8.5 | — | — | 2026-10-16 | 2026-10-28 |
| CVE-2026-96627 Arcane is an interface for managing Docker containers, images, networks, and vol... |
high | 8.8 | — | — | 2026-10-16 | 2026-10-19 |
| CVE-2026-68498 StreamReadConstraints.maxNameLength (default 50,000 characters) is intended to b... |
high | 7.5 | — | — | 2026-10-16 | 2026-10-20 |
| CVE-2026-62439 A flaw was found in GIMP. |
high | 7.0 | — | — | 2026-10-16 | 2026-10-19 |
| CVE-2026-49410 OpenHuman is an open-source agent harness available as a desktop application and... |
high | 8.1 | — | — | 2026-10-16 | 2026-10-19 |
| CVE-2026-111044 Sunshine is a self-hosted game stream host for Moonlight. |
high | 7.6 | — | — | 2026-10-16 | 2026-10-28 |
| CVE-2026-108374 ERPNext is a free and open source Enterprise Resource Planning tool. |
high | 7.7 | — | — | 2026-10-16 | 2026-10-19 |
| CVE-2026-68572 Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apac... |
high | 7.5 | — | — | 2026-10-16 | 2026-10-20 |
| CVE-2026-69076 Exposure of Job Discard to an Unauthorized Actor vulnerability in Apache Kylin. |
high | 7.5 | — | — | 2026-10-16 | 2026-10-20 |
| CVE-2026-69077 Exposure of unauthorized cross-project job manipulation vulnerability in Apache... |
high | 7.5 | — | — | 2026-10-16 | 2026-10-20 |
| CVE-2026-69080 Exposure of SQL Black List to an Unauthorized Actor vulnerability in Apache Kyli... |
high | 7.5 | — | — | 2026-10-16 | 2026-10-20 |
| CVE-2026-30971 ZoneMinder is a free, open source closed-circuit television software application... |
high | 8.8 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-59963 Tandoor Recipes is an application for managing recipes, planning meals, and buil... |
high | 7.1 | — | — | 2026-10-16 | 2026-10-19 |
| CVE-2026-59970 Tandoor Recipes is an application for managing recipes, planning meals, and buil... |
high | 7.7 | — | — | 2026-10-16 | 2026-10-21 |
| CVE-2026-61726 Tandoor Recipes is an application for managing recipes, planning meals, and buil... |
high | 8.1 | — | — | 2026-10-16 | 2026-10-28 |
| CVE-2026-108743 Improper Neutralization of Special Elements used in an OS Command ('OS Command I... |
high | 8.8 | — | — | 2026-10-16 | 2026-10-20 |
| CVE-2026-102607 ZoneMinder is a free, open source closed-circuit television software application... |
high | 8.8 | — | — | 2026-10-16 | 2026-10-19 |
| CVE-2026-102834 JavaCV provides Java interfaces to OpenCV, FFmpeg, and other multimedia librarie... |
high | 7.5 | — | — | 2026-10-16 | 2026-10-28 |
| CVE-2026-102917 IBM i 7.3, 7.4, 7.5, and 7.6 is vulnerable to an authenticated attacker elevatin... |
high | 7.8 | — | Ibm / i | 2026-10-16 | 2026-10-23 |
| CVE-2025-66969 Integer overflow in OpenModSim (<=1.11.0), leading to denial of service |
high | 7.5 | — | — | 2026-10-16 | 2026-10-28 |
| CVE-2026-81452 Dell Alienware Command Center (AWCC), versions prior to 6.14.54.0, contain a Lea... |
high | 7.0 | — | — | 2026-10-16 | 2026-10-20 |
| CVE-2026-111722 LingGuo-Drama through commit 8a6924a contains an insecure direct object referenc... |
high | 8.1 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-111723 LingGuo-Drama through commit 8a6924a contains a missing authorization vulnerabil... |
high | 8.8 | — | — | 2026-10-16 | 2026-10-20 |
| CVE-2026-111710 Netcore NR256CN through 1.5.140116 contains a NULL pointer dereference vulnerabi... |
high | 7.5 | — | — | 2026-10-16 | 2026-10-19 |
| CVE-2026-111702 ChatOllama through commit 96c3ce5 contains an insecure direct object reference v... |
high | 7.5 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-111706 99AI through 4.3.0 contains a missing authentication vulnerability in the POST /... |
high | 7.5 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-111695 Shaiwz data-platform-open through commit efeacd3 contains an insecure direct obj... |
high | 7.1 | — | — | 2026-10-16 | 2026-10-19 |
| CVE-2026-111700 WebVella ERP through 1.8.8 contains an sql injection vulnerability that allows a... |
high | 7.1 | — | — | 2026-10-16 | 2026-10-19 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.