October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
23,704
Critical
3,234
High
7,703
Medium
7,358
Low
705
Severity not reported
4,704
In CISA KEV
188
Most affected vendors (by CPE data where available): microsoft (1424), google (825), linux (722), ibm (323), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-118192 The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for Wo... |
medium | 6.5 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-91152 The Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Build... |
medium | 6.1 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-91153 The Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Build... |
medium | 5.3 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-115962 Authentication Bypass by Spoofing vulnerability in myCred myCred mycred allows I... |
medium | 4.3 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-109216 The Meta Box – A Framework for Dynamic Websites plugin for WordPress is vulnerab... |
medium | 4.9 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-27401 Missing Authorization vulnerability in YITH YITH PayPal Express Checkout for Woo... |
medium | 5.3 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-92086 The MW WP Form plugin for WordPress is vulnerable to Sensitive Information Expos... |
medium | 5.3 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-118087 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-118093 Missing Authorization vulnerability in WPFunnels Team Product Feed Manager best-... |
medium | 5.3 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-118094 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-22386 Missing Authorization vulnerability in Ahmad WP Job Portal wp-job-portal allows... |
medium | 4.3 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-24533 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-39735 Missing Authorization vulnerability in Crocoblock JetEngine jet-engine allows Ex... |
medium | 6.5 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-39741 Missing Authorization vulnerability in RelyWP Simple Cloudflare Turnstile simple... |
medium | 5.3 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-42703 Missing Authorization vulnerability in Kaliforms Kali Forms kali-forms allows Ex... |
medium | 6.5 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-48196 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-52709 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-56056 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-42707 Missing Authorization vulnerability in HivePress HivePress Claim Listings hivepr... |
medium | 4.3 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-48195 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-54862 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-114619 Authlib is a Python library which builds OAuth and OpenID Connect servers. |
medium | 4.6 | — | Authlib / authlib | 2026-10-22 | 2026-10-29 |
| CVE-2026-114618 Authlib is a Python library which builds OAuth and OpenID Connect servers. |
medium | 6.8 | — | Authlib / authlib | 2026-10-22 | 2026-10-29 |
| CVE-2026-114617 Authlib is a Python library which builds OAuth and OpenID Connect servers. |
medium | 4.2 | — | Authlib / authlib | 2026-10-22 | 2026-10-29 |
| CVE-2026-113939 An out-of-bounds write issue was addressed with improved bounds checking. |
medium | 6.5 | — | Apple / macos | 2026-10-26 | 2026-10-29 |
| CVE-2026-112708 A race condition was addressed with improved locking. |
medium | 5.3 | — | Apple / macos | 2026-10-26 | 2026-10-29 |
| CVE-2026-112544 An out-of-bounds write issue was addressed with improved bounds checking. |
medium | 6.5 | — | Apple / macos | 2026-10-26 | 2026-10-29 |
| CVE-2026-112471 A buffer overflow was addressed with improved bounds checking. |
medium | 4.3 | — | Apple / macos | 2026-10-26 | 2026-10-29 |
| CVE-2026-114725 Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail hea... |
medium | 5.0 | — | Roundcube / webmail | 2026-10-22 | 2026-10-29 |
| CVE-2026-71569 Server-Side Request Forgery (SSRF) vulnerability in Apache Camel A2A component. |
medium | 4.8 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-55190 Event Schedule is an open-source platform to share events, sell tickets and brin... |
medium | 6.5 | — | — | 2026-10-23 | 2026-10-29 |
| CVE-2026-55442 The Goobi viewer is a web application that allows digitised material to be displ... |
medium | 5.3 | — | — | 2026-10-23 | 2026-10-29 |
| CVE-2026-55463 The Goobi viewer is a web application that allows digitised material to be displ... |
medium | 6.5 | — | — | 2026-10-23 | 2026-10-29 |
| CVE-2026-46347 The Goobi viewer is a web application that allows digitised material to be displ... |
medium | 6.8 | — | — | 2026-10-23 | 2026-10-29 |
| CVE-2026-116855 Missing Authorization vulnerability in wphocus My auctions allegro my-auctions-a... |
medium | 5.4 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-116404 Missing Authorization vulnerability in David Anderson Redux Framework redux-fram... |
medium | 6.5 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-115752 Signal K Server from 2.28.0-beta.2 before 2.34.0 contains a server-side request... |
medium | 4.2 | — | — | 2026-10-23 | 2026-10-29 |
| CVE-2026-115957 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-107445 A flaw was found in Katello where the Flatpak Remote Repositories API does not p... |
medium | 5.4 | — | — | 2026-10-08 | 2026-10-29 |
| CVE-2026-104109 FileRise is a self-hosted web-based file manager with multi-file upload, editing... |
medium | 6.8 | — | — | 2026-10-14 | 2026-10-29 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.