October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
23,704
Critical
3,236
High
7,702
Medium
7,359
Low
705
Severity not reported
4,702
In CISA KEV
188
Most affected vendors (by CPE data where available): microsoft (1426), google (825), linux (722), ibm (323), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-117627 A flaw was found in the JWT Authorization Grant implementation of the keycloak-s... |
medium | 5.4 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-54631 Part-DB is an open source inventory management system for electronic components. |
medium | 6.3 | — | — | 2026-10-23 | 2026-10-29 |
| CVE-2026-55422 conda-forge is a GitHub organization containing repositories of conda recipes. |
medium | 4.6 | — | — | 2026-10-23 | 2026-10-29 |
| CVE-2026-115400 crawlseo before version 0.2.5 contains a cleartext storage vulnerability that al... |
medium | 4.4 | — | — | 2026-10-22 | 2026-10-29 |
| CVE-2026-115508 Crawl4AI 0.7.0 before 0.9.5 contains an inefficient regular expression complexit... |
medium | 6.5 | — | — | 2026-10-22 | 2026-10-29 |
| CVE-2026-115725 Chatwoot before 4.17.0 contains an authorization bypass vulnerability that allow... |
medium | 4.2 | — | — | 2026-10-23 | 2026-10-29 |
| CVE-2026-115388 wasmtime-wasi-http in Wasmtime before 36.0.16, 37.0.0 before 48.0.3, and 49.0.0... |
medium | 6.2 | — | — | 2026-10-22 | 2026-10-29 |
| CVE-2026-115327 libyang through 6.4.13 contains an uninitialized pointer free vulnerability in l... |
medium | 5.3 | — | — | 2026-10-22 | 2026-10-29 |
| CVE-2026-115350 Mistune before 3.3.0 contains a cross-site scripting vulnerability in the Includ... |
medium | 6.1 | — | — | 2026-10-22 | 2026-10-29 |
| CVE-2026-115354 Mistune before 3.3.0 contains a path traversal vulnerability in the opt-in Inclu... |
medium | 6.5 | — | — | 2026-10-22 | 2026-10-29 |
| CVE-2026-114665 Goploy 1.18.0 before 1.18.1 contains a link following vulnerability in the /depl... |
medium | 6.5 | — | — | 2026-10-22 | 2026-10-29 |
| CVE-2026-115248 A vulnerability was detected in subhajitkhan online-clinic-management-system up... |
medium | 5.4 | — | — | 2026-10-22 | 2026-10-29 |
| CVE-2026-114603 OpenTelemetry Python provides the Python API and SDK for OpenTelemetry. |
medium | 5.3 | — | — | 2026-10-22 | 2026-10-29 |
| CVE-2026-114609 fpdf2 is a PDF creation library for Python. |
medium | 5.8 | — | — | 2026-10-22 | 2026-10-29 |
| CVE-2026-114610 fpdf2 is a PDF creation library for Python. |
medium | 6.5 | — | — | 2026-10-22 | 2026-10-29 |
| CVE-2026-91247 Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware... |
medium | 5.9 | — | — | 2026-10-20 | 2026-10-29 |
| CVE-2026-92665 Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS... |
medium | 5.3 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-90731 Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.7, LTS... |
medium | 4.9 | — | — | 2026-10-27 | 2026-10-29 |
| CVE-2026-90732 Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through LTS 2026... |
medium | 4.9 | — | — | 2026-10-27 | 2026-10-29 |
| CVE-2026-90725 Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS... |
medium | 4.9 | — | — | 2026-10-27 | 2026-10-29 |
| CVE-2026-85655 The Enable Media Replace plugin for WordPress is vulnerable to authorization byp... |
medium | 4.3 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-86391 Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.... |
medium | 6.4 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-86392 Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS... |
medium | 4.9 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-68866 PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.7, LTS2024... |
medium | 6.5 | — | — | 2026-10-27 | 2026-10-29 |
| CVE-2026-76005 The WP Inventory Manager plugin for WordPress is vulnerable to time-based SQL In... |
medium | 6.5 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-76780 The Beyondseo plugin for WordPress is vulnerable to unauthorized access in versi... |
medium | 6.3 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-77188 The Waitlist Woocommerce ( Back in stock notifier ) plugin for WordPress is vuln... |
medium | 6.4 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-77871 The Post Snippets – Custom WordPress Code Snippets Customizer plugin for WordPre... |
medium | 6.4 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-2839 The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to unaut... |
medium | 5.3 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-116749 The VikRentCar Car Rental Management System plugin for WordPress is vulnerable t... |
medium | 6.4 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-116750 The VikRentCar Car Rental Management System plugin for WordPress is vulnerable t... |
medium | 6.5 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-116761 The CMB2 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via t... |
medium | 5.4 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-118169 The Hustle – Email Marketing, Lead Generation, Optins, Popups plugin for WordPre... |
medium | 4.9 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-114645 A 32-bit integer wraparound in the MongoDB C Driver's Windows-only Kerberos/SSPI... |
medium | 5.2 | — | — | 2026-10-22 | 2026-10-29 |
| CVE-2026-116609 The WP Visitor Statistics (Real Time Traffic) plugin for WordPress is vulnerable... |
medium | 6.5 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-111727 The Appointment Booking Calendar plugin for WordPress is vulnerable to Stored Cr... |
medium | 6.4 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-111068 The DesignSetGo plugin for WordPress is vulnerable to Stored Cross-Site Scriptin... |
medium | 4.4 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-111213 The Travelly – Tour & Travel Booking Manager for WooCommerce plugin for WordPres... |
medium | 4.3 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-111372 The AI ChatBot for WooCommerce – WoowBot plugin for WordPress is vulnerable to a... |
medium | 4.3 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-10511 The Jupiter X Core plugin for WordPress is vulnerable to Stored Cross-Site Scrip... |
medium | 6.4 | — | — | 2026-10-27 | 2026-10-29 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.