October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
23,728
Critical
3,236
High
7,711
Medium
7,361
Low
706
Severity not reported
4,714
In CISA KEV
188
Most affected vendors (by CPE data where available): microsoft (1424), google (825), linux (722), ibm (323), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-119711 PipesHub before 0.10.0 contains a rate limit bypass vulnerability in getClientIp... |
medium | 5.3 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119712 PipesHub before 0.10.0 contains a server-side request forgery vulnerability in I... |
medium | 6.4 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119714 My Calendar WordPress plugin 3.8.8 before 3.8.11 contains a shortcode injection... |
medium | 6.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119715 NocoDB before 2026.08.0 contains a clickjacking vulnerability that allows any or... |
medium | 4.3 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119761 Axigen Mail Server WebMail before 10.6.39 and 10.7.1 contains a stored cross-sit... |
medium | 6.1 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-7003 WIT SynApps Runtime through 1.4.11 contains a hardcoded credentials vulnerabilit... |
medium | 5.3 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-104674 Missing Authorization vulnerability in Arraytics Booktics booktics allows Exploi... |
medium | 4.3 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-115604 Subscriber Arbitrary File Deletion in SureDash |
medium | 5.0 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-115947 Unauthenticated Sensitive Data Exposure in HUSKY |
medium | 6.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-116410 Unauthenticated Arbitrary Content Deletion in Masteriyo - LMS |
medium | 6.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-116853 Unauthenticated Broken Access Control in GiveWP |
medium | 6.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-116854 Subscriber Cross Site Scripting (XSS) in WP Customer Area |
medium | 6.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-27061 Subscriber Cross Site Scripting (XSS) in User Registration |
medium | 6.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-39739 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-52710 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vu... |
medium | 5.3 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-54850 Subscriber Broken Access Control in Booking and Rental Manager |
medium | 6.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-54854 Contributor Privilege Escalation in Profile Builder |
medium | 6.3 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-62019 Missing Authorization vulnerability in Liquid Web / StellarWP BookIt bookit allo... |
medium | 4.3 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-62023 Missing Authorization vulnerability in Unlimited Elements Unlimited Elements For... |
medium | 4.3 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-62047 Missing Authorization vulnerability in Liquid Web / StellarWP Event Tickets even... |
medium | 4.3 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-62056 Missing Authorization vulnerability in WP ManageNinja LLC Fluent CRM fluent-crm... |
medium | 5.3 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-62057 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vu... |
medium | 5.3 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-62121 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP... |
medium | 6.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-62122 Missing Authorization vulnerability in Arraytics Booktics booktics allows Exploi... |
medium | 5.3 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119553 Moodle 5.3.0, 5.2.0 through 5.2.4, 5.1.0 through 5.1.8, 5.0.0 through 5.0.11, an... |
medium | 6.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119556 Moodle 4.2.0 through 4.5.15, 5.0.0 through 5.0.11, 5.1.0 through 5.1.8, 5.2.0 th... |
medium | 4.3 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-9239 The Meow Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripti... |
medium | 6.4 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-97782 Observable discrepancy in Microsoft Office SharePoint allows an authorized attac... |
medium | 6.8 | — | Microsoft / sharepoint server | 2026-10-13 | 2026-10-30 |
| CVE-2026-57207 NetBox MCP Server is a simple read-only Model Context Protocol server for NetBox... |
medium | 5.9 | — | — | 2026-10-23 | 2026-10-30 |
| CVE-2026-5461 The Forminator Forms plugin for WordPress is vulnerable to Limited File Deletion... |
medium | 6.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-54852 Missing Authorization vulnerability in miniOrange Page Restriction WordPress (WP... |
medium | 5.3 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-54865 Subscriber Cross Site Scripting (XSS) in Podamibe Custom User Gravatar |
medium | 6.5 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-42691 Authorization Bypass Through User-Controlled Key vulnerability in EventPrime Eve... |
medium | 5.4 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-42694 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vu... |
medium | 4.3 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-27062 Cross-Site Request Forgery (CSRF) vulnerability in WPFunnels Team WPFunnels wpfu... |
medium | 4.3 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-27063 Missing Authorization vulnerability in Kit Kit (formerly ConvertKit) convertkit... |
medium | 5.3 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-18477 A TOCTOU (Time-of-Check Time-of-Use) vulnerability in GNU tar's incremental dump... |
medium | 4.4 | — | Gnu / tar | 2026-08-03 | 2026-10-30 |
| CVE-2026-120046 Nezha 2.0.0 before 2.4.0 contains a NULL pointer dereference vulnerability in Se... |
medium | 5.3 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119721 Blender before 4.5.15 and 5.x before 5.2.3 contains an out-of-bounds read vulner... |
medium | 6.1 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119176 The CP Multi View Events Calendar plugin for WordPress is vulnerable to Stored C... |
medium | 6.4 | — | — | 2026-10-30 | 2026-10-30 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.