October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
23,728
Critical
3,236
High
7,711
Medium
7,361
Low
706
Severity not reported
4,714
In CISA KEV
188
Most affected vendors (by CPE data where available): microsoft (1424), google (825), linux (722), ibm (323), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-119059 The Content Egg plugin for WordPress is vulnerable to unauthorized modification... |
medium | 4.3 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119087 The Content Egg – Affiliate Product Importer & Price Comparison plugin for WordP... |
medium | 4.3 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119113 The GeoDirectory – WP Business Directory Plugin and Classified Listings Director... |
medium | 6.4 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-118634 The Events Made Easy plugin for WordPress is vulnerable to Stored Cross-Site Scr... |
medium | 6.4 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-118635 The The GeoDirectory – WP Business Directory Plugin and Classified Listings Dire... |
medium | 6.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-118091 Missing Authorization vulnerability in WPFunnels Team WPFunnels wpfunnels allows... |
medium | 5.3 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-118084 Subscriber Insecure Direct Object References (IDOR) in Hotel Booking |
medium | 6.5 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-118194 The Page and Post Restriction plugin for WordPress is vulnerable to Authenticati... |
medium | 6.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-116689 follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically f... |
medium | 5.9 | — | — | 2026-10-27 | 2026-10-30 |
| CVE-2026-116848 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-116387 Missing Authorization vulnerability in Brainstorm Force SureForms sureforms allo... |
medium | 5.3 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-115869 The Themify Builder plugin for WordPress is vulnerable to Stored Cross-Site Scri... |
medium | 6.4 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-115601 Missing Authorization vulnerability in WP Desk Custom Price for WooCommerce cust... |
medium | 5.3 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-115610 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-115820 The Majestic Support – The Leading-Edge Help Desk & Customer Support Plugin plug... |
medium | 6.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-114711 Subscriber Cross Site Scripting (XSS) in MultiVendorX |
medium | 6.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-114485 Insufficient protection of sensitive information in the user list endpoint in De... |
medium | 4.3 | — | — | 2026-10-22 | 2026-10-30 |
| CVE-2026-114486 Incorrect authorization in the Devolutions Gateway token generation in Devolutio... |
medium | 4.3 | — | — | 2026-10-22 | 2026-10-30 |
| CVE-2026-114706 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-114690 A flaw was found in GCC. |
medium | 6.2 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-114691 A flaw was found in the libstdc++ component of GCC. |
medium | 5.9 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-114460 A flaw was found in mod_qos. |
medium | 5.3 | — | — | 2026-10-22 | 2026-10-30 |
| CVE-2026-114222 NT OneAPP developed by NewType Infortech has an Authentication Bypass vulnerabil... |
medium | 6.2 | — | — | 2026-10-22 | 2026-10-30 |
| CVE-2026-114223 NT OneAPP developed by NewType Infortech has an Exposure of Sensitive Informatio... |
medium | 5.5 | — | — | 2026-10-22 | 2026-10-30 |
| CVE-2026-109891 Missing Authorization vulnerability in weDevs Happy Addons for Elementor happy-e... |
medium | 6.4 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-109984 The FV Flowplayer Video Player plugin for WordPress is vulnerable to Stored Cros... |
medium | 5.4 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-110001 The FV Flowplayer Video Player plugin for WordPress is vulnerable to Stored Cros... |
medium | 5.4 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-109592 The OpenStation: Desktop Windows, Dock & Virtual Desktops for WP Admin plugin fo... |
medium | 4.3 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-107023 Insecure permissions in the ContentProvider component of mhss1 MyBrain v3.1.0 al... |
medium | 6.5 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-104739 The JS Help Desk – AI-Powered Support & Ticketing System plugin for WordPress is... |
medium | 4.9 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-104623 A security vulnerability exists in the authorization handling for the local (man... |
medium | 6.3 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-104592 libosmocore through 1.14.1 contains an out-of-bounds read in the CBSP WRITE-REPL... |
medium | 6.5 | — | — | 2026-10-26 | 2026-10-30 |
| CVE-2026-102918 The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scri... |
medium | 6.4 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-101364 Vulnerability in Oracle REST Data Services (component: Database Actions). |
medium | 5.4 | — | — | 2026-10-20 | 2026-10-30 |
| CVE-2026-101363 Vulnerability in Oracle REST Data Services (component: Graph QL). |
medium | 5.3 | — | — | 2026-10-20 | 2026-10-30 |
| CVE-2026-101362 Vulnerability in Oracle REST Data Services (component: Core). |
medium | 6.9 | — | — | 2026-10-20 | 2026-10-30 |
| CVE-2026-101361 Vulnerability in Oracle REST Data Services (component: Core). |
medium | 4.2 | — | — | 2026-10-20 | 2026-10-30 |
| CVE-2026-101360 Vulnerability in Oracle REST Data Services (component: Core). |
medium | 5.4 | — | — | 2026-10-20 | 2026-10-30 |
| CVE-2025-6017 A flaw was found in Red Hat Advanced Cluster Management through versions 2.10, b... |
medium | 5.5 | — | Redhat / advanced cluster management for kubernetes | 2025-07-02 | 2026-10-30 |
| CVE-2025-57848 A container privilege escalation flaw was found in certain Container-native Virt... |
medium | 6.4 | — | — | 2025-10-23 | 2026-10-30 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.