October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,390
Critical
1,328
High
5,808
Medium
6,216
Low
648
Severity not reported
3,390
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1307), google (756), oracle (156), ibm (140), adobe (138), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-57488 pupnp is an SDK for development of UPnP device and control point applications. |
high | 7.1 | — | Pupnp Project / pupnp | 2026-10-16 | 2026-10-20 |
| CVE-2026-46472 An issue was discovered in GStreamer gst-plugins-good before 1.28.2. |
high | 7.5 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-48503 libIEC61850 is an open-source implementation of IEC 61850 client and server prot... |
high | 7.5 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-48741 libIEC61850 is an open-source implementation of IEC 61850 client and server prot... |
high | 7.5 | — | — | 2026-10-16 | 2026-10-21 |
| CVE-2026-41582 countly-server is the server-side part of Countly, a product analytics solution. |
high | 7.5 | — | — | 2026-10-16 | 2026-10-19 |
| CVE-2026-42269 countly-server is the server-side part of Countly, a product analytics solution. |
high | 8.1 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-42270 countly-server is the server-side part of Countly, a product analytics solution. |
high | 7.5 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-102941 The package github.com/gomarkdown/markdown is a Go library for parsing Markdown... |
high | 7.5 | — | — | 2026-10-16 | 2026-10-26 |
| CVE-2026-95183 An issue in the context-compaction feature of DeepSeek Harness (dsh) commit c291... |
high | 8.8 | — | — | 2026-10-16 | 2026-10-21 |
| CVE-2026-88755 Z.ai ZCode v3.11.2.6792 was discovered to automatically establish connections wi... |
high | 7.8 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-107621 JPEGParser can enter an infinite loop while parsing a specially crafted or trunc... |
high | 7.5 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-105667 In the default configuration, the HL7 listener accepts ADT^A40 patient-merge mes... |
high | 7.5 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-106705 ELADMIN (eladmin-mp) up to 2.7 contains an improper access control vulnerability... |
high | 8.8 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-105273 MP4Parser does not adequately validate MP4 box sizes. |
high | 7.5 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-101021 MultipartInputStream performs inefficient boundary matching and unnecessary buff... |
high | 7.5 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-111413 Cross-Site Request Forgery (CSRF) vulnerability in aThemeArt aThemeArt Theme Hel... |
high | 8.8 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-63618 Exposure of Sensitive Information (system level configuration info) to an Unauth... |
high | 7.5 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-68571 Improper Control of Generation of Code ('Code Injection') vulnerability in Apach... |
high | 8.8 | — | — | 2026-10-16 | 2026-10-19 |
| CVE-2026-111396 Missing Authorization vulnerability in Liquid Web / StellarWP Advanced Post Mana... |
high | 7.1 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-111399 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
high | 8.5 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-107564 An unauthenticated remote attacker may use an allocation of resources without li... |
high | 7.5 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-105958 A flaw was found in spice-server. |
high | 7.5 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-111391 SGLang 0.5.10 through 0.5.22 contains a code injection vulnerability in _evaluat... |
high | 8.1 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-107648 The WP Sessions Time Monitoring Full Automatic plugin for WordPress is vulnerabl... |
high | 7.2 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-105959 A flaw was found in spice-server. |
high | 7.5 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-109119 Improper Privilege Management in the user management API endpoint (/api/users/{u... |
high | 8.8 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-96768 The GoSMTP Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting... |
high | 7.2 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-109224 The SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downlo... |
high | 7.2 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-111311 The DoubleScale | All-in-One CRM – Sales, Multi-Channel Marketing, Newsletter, B... |
high | 8.8 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-14177 Observable response discrepancy vulnerability in IKAS Technology Inc. |
high | 7.5 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-92766 The Vitepos – Point of Sale (POS) for WooCommerce plugin for WordPress is vulner... |
high | 7.5 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-75903 The Vulnity Security plugin for WordPress is vulnerable to authentication bypass... |
high | 8.1 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-87111 The User Registration PRO – Custom Registration Form, Login Form, and User Profi... |
high | 7.2 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-16453 Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8... |
high | 7.1 | — | Mattermost / mattermost server | 2026-10-16 | 2026-10-29 |
| CVE-2026-92553 The YaySMTP – WP Mail SMTP with Email Logs, Tracking & Reports plugin for WordPr... |
high | 8.8 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-96339 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-97296 Deserialization of Untrusted Data vulnerability in Rocketgenius, Inc Gravity For... |
high | 8.1 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-97640 The WPConsent – Cookie Banner & Cookie Consent for Privacy Compliance (GDPR / CC... |
high | 7.2 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-92115 The WP Photo Album Plus plugin for WordPress is vulnerable to authenticated Comm... |
high | 8.8 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-110701 The CP Multi View Events Calendar plugin for WordPress is vulnerable to Stored C... |
high | 7.2 | — | — | 2026-10-16 | 2026-10-16 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.