October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
23,723
Critical
3,236
High
7,709
Medium
7,360
Low
706
Severity not reported
4,712
In CISA KEV
188
Most affected vendors (by CPE data where available): microsoft (1424), google (825), linux (722), ibm (323), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-117572 The WP Visitor Statistics (Real Time Traffic) WordPress plugin before 8.8 does n... |
medium | 4.1 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-118071 The Joinchat WordPress plugin before 6.4.2 does not escape the message of its bu... |
medium | 6.8 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-118072 The Fraud Prevention For WooCommerce and EDD WordPress plugin before 2.3.6 does... |
medium | 5.4 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-118100 The BuddyForms WordPress plugin before 2.10.3 does not check that the requester... |
medium | 5.3 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-118101 The BuddyForms WordPress plugin before 2.10.1 does not verify that a user editin... |
medium | 5.3 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-118165 The Firelight Lightbox WordPress plugin before 2.3.23 does not escape the URL of... |
medium | 6.8 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119251 A malicious actor with local access and high privileges could exploit an Imprope... |
medium | 6.7 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-119317 On Linux, an authenticated, low-privileged Nessus user with scan-creation rights... |
medium | 6.5 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-59386 A SpaceSupporter could improperly modify an application's start command and buil... |
medium | 6.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-59388 Cloud Controller (CAPI) leaks sensitive data into audit logs in multiple instanc... |
medium | 6.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-63963 In the Linux kernel, the following vulnerability has been resolved:
usb: typec:... |
medium | 5.5 | — | Linux / linux kernel | 2026-07-19 | 2026-10-30 |
| CVE-2026-63962 In the Linux kernel, the following vulnerability has been resolved:
usb: typec:... |
medium | 5.5 | — | Linux / linux kernel | 2026-07-19 | 2026-10-30 |
| CVE-2026-63964 In the Linux kernel, the following vulnerability has been resolved:
usb: typec:... |
medium | 5.5 | — | Linux / linux kernel | 2026-07-19 | 2026-10-30 |
| CVE-2026-63965 In the Linux kernel, the following vulnerability has been resolved:
iio: pressu... |
medium | 5.5 | — | Linux / linux kernel | 2026-07-19 | 2026-10-30 |
| CVE-2026-63966 In the Linux kernel, the following vulnerability has been resolved:
iio: imu: a... |
medium | 5.5 | — | Linux / linux kernel | 2026-07-19 | 2026-10-30 |
| CVE-2026-116407 Missing Authorization vulnerability in Webba Plugins Webba Booking webba-booking... |
medium | 5.4 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119369 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119466 Cross-Site Request Forgery (CSRF) vulnerability in WPExperts APIExperts Square f... |
medium | 5.4 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-118760 Kubeflow Pipelines enables users to build and deploy portable, scalable machine... |
medium | 6.5 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-119186 Forge (also called node-forge) is a native implementation of Transport Layer Sec... |
medium | 5.9 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-119189 Forge (also called node-forge) is a native implementation of Transport Layer Sec... |
medium | 5.9 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-119198 Nuxt is an open-source web development framework for Vue.js. |
medium | 5.9 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-119199 Nuxt is an open-source web development framework for Vue.js. |
medium | 5.9 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-119200 Nuxt is an open-source web development framework for Vue.js. |
medium | 6.5 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-119201 Nuxt is an open-source web development framework for Vue.js. |
medium | 4.8 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-119210 MariaDB Connector/J is used to connect applications developed in Java to MariaDB... |
medium | 5.9 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-119276 MariaDB Connector/J is used to connect applications developed in Java to MariaDB... |
medium | 5.9 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-119277 MariaDB Connector/J is used to connect applications developed in Java to MariaDB... |
medium | 5.9 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-119279 MariaDB Connector/J is used to connect applications developed in Java to MariaDB... |
medium | 5.9 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-119281 MariaDB Connector/J is used to connect applications developed in Java to MariaDB... |
medium | 5.9 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-96636 Pillow is a Python imaging library. |
medium | 6.5 | — | Python / pillow | 2026-10-21 | 2026-10-30 |
| CVE-2026-96642 Pillow is a Python imaging library. |
medium | 6.5 | — | Python / pillow | 2026-10-21 | 2026-10-30 |
| CVE-2026-86589 Incorrect implementation of authentication algorithm vulnerability in Apache Ans... |
medium | 5.4 | — | — | 2026-10-19 | 2026-10-30 |
| CVE-2026-87941 Vulnerability in Drupal Patreon. |
medium | 5.9 | — | — | 2026-10-22 | 2026-10-30 |
| CVE-2026-119557 n8n from 2.14.0 through 2.46.3 contains a path traversal vulnerability in the Da... |
medium | 5.9 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119545 Forgejo through 15.0.11, 16.0.0 through 16.0.7, and 17.0.0 through 17.0.1 contai... |
medium | 5.3 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119300 Wekan is open source kanban built with Meteor. |
medium | 6.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-118777 Forge (also called node-forge) is a native implementation of Transport Layer Sec... |
medium | 4.8 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-118698 The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for Wo... |
medium | 6.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-114501 Pillow is a Python imaging library. |
medium | 5.3 | — | Python / pillow | 2026-10-21 | 2026-10-30 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.