October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
23,723
Critical
3,236
High
7,709
Medium
7,360
Low
706
Severity not reported
4,712
In CISA KEV
188
Most affected vendors (by CPE data where available): microsoft (1424), google (825), linux (722), ibm (323), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-119375 SQLite before 3.54.0 contains an information disclosure vulnerability that allow... |
medium | 5.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119378 SQLite before 3.54.0 contains a use-after-free vulnerability in the R-Tree exten... |
medium | 5.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119591 SQLite before 3.54.0 contains a stack exhaustion vulnerability in countOfViewOpt... |
medium | 5.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-102905 The The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerabl... |
medium | 6.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-110533 The FV Flowplayer Video Player plugin for WordPress is vulnerable to Stored Cros... |
medium | 6.4 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-116552 The Like Button Rating ♥ LikeBtn plugin for WordPress is vulnerable to Stored Cr... |
medium | 4.7 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-13747 The Meow Gallery plugin for WordPress is vulnerable to authorization bypass in a... |
medium | 6.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-75525 OpenReception's appointment booking software provides an end-to-end encrypted ap... |
medium | 5.3 | — | — | 2026-10-23 | 2026-10-30 |
| CVE-2026-66392 Apache bRPC versions before 1.18.0 validate the server certificate chain when cl... |
medium | 5.9 | — | — | 2026-10-21 | 2026-10-30 |
| CVE-2026-62141 Missing Authorization vulnerability in WP ManageNinja LLC Fluent CRM fluent-crm... |
medium | 5.4 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-62055 Missing Authorization vulnerability in Liquid Web / StellarWP Event Tickets even... |
medium | 4.3 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-13319 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.10... |
medium | 6.5 | — | Gitlab / gitlab | 2026-10-22 | 2026-10-30 |
| CVE-2026-119482 Missing Authorization vulnerability in Crocoblock JetFormBuilder jetformbuilder... |
medium | 5.3 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119479 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vu... |
medium | 5.3 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119368 Missing Authorization vulnerability in Liquid Web / StellarWP The Events Calenda... |
medium | 5.3 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119365 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119367 Missing Authorization vulnerability in Liquid Web / StellarWP The Events Calenda... |
medium | 5.4 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-115922 Open Neural Network Exchange (ONNX) is an open standard for machine learning int... |
medium | 6.2 | — | — | 2026-10-26 | 2026-10-30 |
| CVE-2026-114131 Nuxt is an open-source web development framework for Vue.js. |
medium | 6.5 | — | — | 2026-10-21 | 2026-10-30 |
| CVE-2026-115706 Authorization Bypass Through User-Controlled Key (CWE-639) in Elastic Cloud Ente... |
medium | 6.8 | — | Elastic / elastic cloud enterprise | 2026-10-29 | 2026-10-30 |
| CVE-2026-115707 Insertion of Sensitive Information into Externally-Accessible File or Directory... |
medium | 6.4 | — | Elastic / elastic cloud enterprise | 2026-10-29 | 2026-10-30 |
| CVE-2026-115711 Insertion of Sensitive Information into Externally-Accessible File or Directory... |
medium | 6.4 | — | Elastic / elastic cloud enterprise | 2026-10-29 | 2026-10-30 |
| CVE-2026-113787 odf-kit allows users to generate, fill, read, and convert OpenDocument Format fi... |
medium | 6.1 | — | — | 2026-10-21 | 2026-10-30 |
| CVE-2026-112378 GitLab has remediated an issue in GitLab EE affecting all versions from 17.8 bef... |
medium | 4.3 | — | Gitlab / gitlab | 2026-10-22 | 2026-10-30 |
| CVE-2026-110322 The PEAK-System PCAN type 0x4030 processing path fails to validate a selected/re... |
medium | 5.5 | — | — | 2026-10-20 | 2026-10-30 |
| CVE-2026-107080 OpenJPEG 2.4.0 through 2.5.4, and git master through commit 8314119b, contains a... |
medium | 6.5 | — | — | 2026-10-26 | 2026-10-30 |
| CVE-2026-107067 An issue in Shirt Pocket's SuperDuper! |
medium | 6.2 | — | — | 2026-10-27 | 2026-10-30 |
| CVE-2026-105960 PEAK-System PCAN contains a vulnerable operation involving a variable-length rec... |
medium | 5.5 | — | — | 2026-10-20 | 2026-10-30 |
| CVE-2026-105777 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.6.... |
medium | 6.5 | — | Gitlab / gitlab | 2026-10-22 | 2026-10-30 |
| CVE-2025-13050 Broken Function Level Authorization allows execution of poller post-restart comm... |
medium | 5.4 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2025-8444 The Animation Addons for Elementor – GSAP Powered Elementor Addons & Website Tem... |
medium | 6.4 | — | — | 2026-06-10 | 2026-10-30 |
| CVE-2024-7478 When a WSO2 product is configured to use an external user store, the system fail... |
medium | 5.8 | — | — | 2026-10-21 | 2026-10-30 |
| CVE-2026-67240 RabbitMQ is a messaging and streaming broker. |
medium | 6.5 | — | Broadcom / rabbitmq server | 2026-09-23 | 2026-10-30 |
| CVE-2026-67228 RabbitMQ is a messaging and streaming broker. |
medium | 4.9 | — | Broadcom / rabbitmq server | 2026-09-23 | 2026-10-30 |
| CVE-2026-66069 RabbitMQ is a messaging and streaming broker. |
medium | 4.3 | — | Broadcom / rabbitmq server | 2026-09-23 | 2026-10-30 |
| CVE-2026-66067 RabbitMQ is a messaging and streaming broker. |
medium | 6.5 | — | Broadcom / rabbitmq server | 2026-09-23 | 2026-10-30 |
| CVE-2026-67238 RabbitMQ is a messaging and streaming broker. |
medium | 6.5 | — | Broadcom / rabbitmq server | 2026-09-23 | 2026-10-30 |
| CVE-2026-65959 Vitess is a database clustering system for horizontal scaling of MySQL. |
medium | 5.3 | — | Linuxfoundation / vitess | 2026-08-18 | 2026-10-30 |
| CVE-2026-114444 The Security Plugin, Firewall & Malware Scanner with Auto Removal WordPress plug... |
medium | 4.4 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-115277 The User Frontend WordPress plugin before 4.3.14 does not sanitise and escape so... |
medium | 4.7 | — | — | 2026-10-30 | 2026-10-30 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.