October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
23,707
Critical
3,235
High
7,704
Medium
7,359
Low
705
Severity not reported
4,704
In CISA KEV
188
Most affected vendors (by CPE data where available): microsoft (1424), google (825), linux (722), ibm (323), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-118318 Improper access control in V8 in Google Chrome prior to 156.0.8078.73 allowed a... |
medium | 4.3 | — | Google / chrome | 2026-10-27 | 2026-10-29 |
| CVE-2026-118319 Memory corruption in Skia in Google Chrome prior to 156.0.8078.73 allowed a remo... |
medium | 4.3 | — | Google / chrome | 2026-10-27 | 2026-10-29 |
| CVE-2026-118322 Memory corruption in ANGLE in Google Chrome prior to 156.0.8078.73 allowed a rem... |
medium | 4.3 | — | Google / chrome | 2026-10-27 | 2026-10-29 |
| CVE-2026-115397 Ghidra before 12.2 contains a resource allocation without limits vulnerability i... |
medium | 5.5 | — | Nsa / ghidra | 2026-10-22 | 2026-10-29 |
| CVE-2026-115398 Ghidra before 12.2 contains a resource allocation without limits vulnerability i... |
medium | 5.5 | — | Nsa / ghidra | 2026-10-22 | 2026-10-29 |
| CVE-2026-115503 Ghidra before 12.2 contains an improper handling of highly compressed data vulne... |
medium | 5.5 | — | Nsa / ghidra | 2026-10-22 | 2026-10-29 |
| CVE-2026-80067 MasterStudy LMS plugin for WordPress before 3.7.50 contains a path traversal vul... |
medium | 5.4 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-71408 A allocation of resources without limits or throttling vulnerability in Fortinet... |
medium | 5.3 | — | Fortinet / fortios | 2026-08-12 | 2026-10-29 |
| CVE-2026-48202 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vu... |
medium | 5.3 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-48884 Missing Authorization vulnerability in weDevs WP User Frontend wp-user-frontend... |
medium | 5.3 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-52708 Missing Authorization vulnerability in weDevs WP User Frontend wp-user-frontend... |
medium | 4.3 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-54871 Missing Authorization vulnerability in Mamunur Rashid ShopBuilder – Elementor Wo... |
medium | 5.3 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-39814 Multiple Relative Path Traversal vulnerabilities [CWE-23] vulnerability in Forti... |
medium | 6.7 | — | Fortinet / fortiweb | 2026-04-14 | 2026-10-29 |
| CVE-2026-59837 A stack-based buffer overflow vulnerability in Fortinet FortiOS 7.4.0 through 7.... |
medium | 6.6 | — | Fortinet / fortiproxy | 2026-07-14 | 2026-10-29 |
| CVE-2026-25467 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vu... |
medium | 5.3 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-39782 Missing Authorization vulnerability in Kaliforms Kali Forms kali-forms allows Ex... |
medium | 5.3 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-25450 Missing Authorization vulnerability in ThemeGrill User Registration user-registr... |
medium | 5.3 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-119137 Wasmtime 42.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a stack overflow... |
medium | 5.3 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-119141 Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a denial of serv... |
medium | 5.3 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-116857 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-116850 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-116856 Missing Authorization vulnerability in WP Desk Flexible Quantity – Measurement P... |
medium | 5.3 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-118088 Missing Authorization vulnerability in WPFunnels Team WPFunnels wpfunnels allows... |
medium | 5.3 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-118095 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-116198 Snipe-IT before 8.7.0 contains a missing encryption vulnerability in Api\AssetsC... |
medium | 4.3 | — | Snipeitapp / snipe-it | 2026-10-25 | 2026-10-29 |
| CVE-2026-116202 YesWiki before 4.7.0 contains a stored cross-site scripting vulnerability that a... |
medium | 5.4 | — | — | 2026-10-25 | 2026-10-29 |
| CVE-2026-116206 YesWiki from 4.2.0 before 4.7.0 contains a stored cross-site scripting vulnerabi... |
medium | 6.4 | — | — | 2026-10-25 | 2026-10-29 |
| CVE-2026-116402 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vu... |
medium | 5.3 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-116406 Missing Authorization vulnerability in Webba Plugins Webba Booking webba-booking... |
medium | 4.3 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-116846 Missing Authorization vulnerability in WP User Manager WP User Manager wp-user-m... |
medium | 5.3 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-116849 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-116182 phpMyFAQ before 4.1.10 contains a server-side request forgery vulnerability in t... |
medium | 5.0 | — | — | 2026-10-25 | 2026-10-29 |
| CVE-2026-116194 Rclone from 1.52.0 before 1.75.2 contains a cross-site request forgery vulnerabi... |
medium | 6.8 | — | Rclone / rclone | 2026-10-25 | 2026-10-29 |
| CVE-2026-116166 SiYuan 3.6.0 before 3.8.7 accepts and persists the networkServeTLS setting but n... |
medium | 6.8 | — | — | 2026-10-25 | 2026-10-29 |
| CVE-2026-116170 SiYuan before v3.8.7 contains an sql injection vulnerability that allows admin-t... |
medium | 4.9 | — | — | 2026-10-25 | 2026-10-29 |
| CVE-2026-116055 A vulnerability was detected in SourceCodester Performance Indicator System 1.0. |
medium | 6.3 | — | — | 2026-10-25 | 2026-10-29 |
| CVE-2026-116058 A vulnerability was found in Alfresco Activiti up to 7.21.0-rc.692. |
medium | 6.3 | — | — | 2026-10-25 | 2026-10-29 |
| CVE-2026-116095 A vulnerability was identified in smg-project smg 1.7.0/1.8.0/1.9.0/1.10.0/1.10.... |
medium | 5.3 | — | — | 2026-10-25 | 2026-10-29 |
| CVE-2026-115638 OpenStack Ironic through 39.0.1 allows a denial of service via a configdrive tha... |
medium | 4.3 | — | — | 2026-10-23 | 2026-10-29 |
| CVE-2026-110881 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-29 | 2026-10-29 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.