October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,432
Critical
1,333
High
5,825
Medium
6,236
Low
648
Severity not reported
3,390
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1307), google (756), oracle (156), ibm (140), adobe (138), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-108491 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-108498 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-79829 A security vulnerability in HPE NonStop HTTP WEBSERVER can cause memory corrupti... |
high | 8.2 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-79824 A directory traversal vulnerability in HPE NonStop Python 3.x could allow attack... |
high | 8.0 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-79825 A heap buffer overflow in HPE NonStop NDSREST could corrupt resume-execution add... |
high | 7.1 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-79826 A heap buffer overflow in HPE NonStop OCAX could corrupt address space and may p... |
high | 7.1 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-79827 A heap buffer overflow in HPE NonStop Inspect Subsystem could corrupt resume-exe... |
high | 7.1 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-79828 A heap buffer overflow in HPE NonStop Debug Utilities could corrupt resume-execu... |
high | 7.1 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-44084 An authorization bypass through user-controlled key vulnerability has been repor... |
high | 7.5 | — | Qnap / video station | 2026-10-15 | 2026-10-16 |
| CVE-2026-26245 A SQL injection vulnerability has been reported to affect Video Station. |
high | 8.8 | — | Qnap / video station | 2026-10-15 | 2026-10-16 |
| CVE-2026-26244 A SQL injection vulnerability has been reported to affect Video Station. |
high | 8.8 | — | Qnap / video station | 2026-10-15 | 2026-10-16 |
| CVE-2026-109855 undici is an HTTP client library for Node.js. |
high | 7.5 | — | Nodejs / undici | 2026-10-15 | 2026-10-19 |
| CVE-2024-22031 A vulnerability has been identified within Rancher where a user with the ability... |
high | 8.5 | — | — | 2026-10-15 | 2026-10-27 |
| CVE-2026-101290 A remote attacker may send a specially crafted network packet that causes the
af... |
high | 7.5 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2023-32198 A vulnerability has been identified in Steve where by default it was using an in... |
high | 8.0 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-101309 The xHCI (USB 3) device model did not validate or save the event ring size provi... |
high | 7.0 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-101310 The HDA audio device model did not check for zero-length Buffer Descriptor List... |
high | 7.0 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-101311 The framebuffer device model's maximum resolution constants were duplicated betw... |
high | 7.0 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-81534 The Email Customizer for WooCommerce (Pro) plugin for WordPress is vulnerable to... |
high | 8.8 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-96537 The Tutor LMS WordPress plugin before 4.1.1 does not perform a capability check... |
high | 7.5 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-58098 When semop(2) blocks waiting for a semaphore condition, it releases the per-set... |
high | 8.4 | — | Freebsd / freebsd | 2026-10-15 | 2026-10-19 |
| CVE-2026-58099 When copying knotes from a parent kqueue to a child, the copy code did not corre... |
high | 7.0 | — | Freebsd / freebsd | 2026-10-15 | 2026-10-19 |
| CVE-2026-58100 kqueue_fork_copy_knote() indexed into the child's file descriptor table using a... |
high | 7.0 | — | Freebsd / freebsd | 2026-10-15 | 2026-10-19 |
| CVE-2026-74920 The Document Gallery WordPress plugin through 5.1.1 does not properly sanitise a... |
high | 7.1 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-79821 A security vulnerability in HPE NonStop SOAP 4.0 may cause memory corruption res... |
high | 8.2 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-79822 A security vulnerability in HPE NonStop TNS/X Native Inspect may cause corruptio... |
high | 7.1 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-101303 The IPv6 UDP send path for unconnected sockets did not apply the jail policy of... |
high | 7.5 | — | Freebsd / freebsd | 2026-10-15 | 2026-10-20 |
| CVE-2026-101304 When fdescfs(4) was mounted in a jail with the "nodup" option, opening /dev/fd/N... |
high | 7.1 | — | Freebsd / freebsd | 2026-10-15 | 2026-10-20 |
| CVE-2026-101305 renameat(2) did not enforce FD_RESOLVE_BENEATH on its directory arguments. |
high | 8.8 | — | Freebsd / freebsd | 2026-10-15 | 2026-10-20 |
| CVE-2026-88043 The Mang Board WP plugin for WordPress is vulnerable to Stored Cross-Site Script... |
high | 7.2 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-18548 The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress... |
high | 7.2 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-18586 The Premium Packages – Sell Digital Products Securely plugin for WordPress is vu... |
high | 7.2 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-15090 The Link Library plugin for WordPress is vulnerable to time-based SQL Injection... |
high | 7.5 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-17031 The Checkout Field Manager (Checkout Manager) for WooCommerce plugin for WordPre... |
high | 8.1 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-3712 The PhastPress plugin for WordPress is vulnerable to Server-Side Request Forgery... |
high | 7.3 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-76665 A security vulnerability in HPE NonStop EXPAND may cause out-of-bounds memory re... |
high | 7.1 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-76663 A stack-based buffer overflow vulnerability in HPE NonStop TELSERV can cause mem... |
high | 7.5 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-110907 Backdrop CMS Core 1.35.x before 1.35.2 and 1.34.x before 1.34.6 mishandles token... |
high | 7.5 | — | — | 2026-10-15 | 2026-10-19 |
| CVE-2026-110908 Netgate pfSense FRR package (pfSense-pkg-frr) 2.0.2_1 and source revision 2.1.2_... |
high | 8.8 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-76660 A vulnerability in HPE NonStop CIPSAM allows an out-of-bounds
write that can co... |
high | 8.7 | — | — | 2026-10-15 | 2026-10-15 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.