October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
24,571
Critical
3,293
High
7,942
Medium
7,637
Low
740
Severity not reported
4,959
In CISA KEV
191
Most affected vendors (by CPE data where available): microsoft (1424), google (825), linux (722), ibm (323), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (116), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-116405 Unauthenticated Cross Site Scripting (XSS) in VikRentCar |
high | 7.1 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-116847 Unauthenticated Cross Site Scripting (XSS) in Mang Board WP |
high | 7.1 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-116851 Unauthenticated Cross Site Scripting (XSS) in eCommerce Product Catalog |
high | 7.1 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-116861 Unauthenticated Sensitive Data Exposure in Flexible Chat |
high | 7.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-116862 Unauthenticated Broken Access Control in WP REST Cache |
high | 7.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-118089 Shop manager PHP Object Injection in Product Feed Manager |
high | 7.2 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-118090 Subscriber PHP Object Injection in MasterStudy LMS |
high | 8.8 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-39734 Unauthenticated Path Traversal in WP EasyPay |
high | 7.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-39786 Unauthenticated Cross Site Scripting (XSS) in BA Book Everything |
high | 7.1 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-54855 Unauthenticated Cross Site Scripting (XSS) in Profile Builder |
high | 7.1 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-73186 Subscriber PHP Object Injection in Enable Media Replace |
high | 8.8 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-94175 Unauthenticated Cross Site Scripting (XSS) in All In One Login |
high | 7.1 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119568 vsftpd through 3.0.5 contains an authentication bypass vulnerability in ssl_data... |
high | 7.4 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-115642 In OpenStack keystonemiddleware before 13.0.2, by supplying a custom X-Service-T... |
high | 8.3 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-97638 The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin f... |
high | 7.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-96894 The ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce plugin for Wo... |
high | 7.2 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-92202 Luxion KeyShot BIP File Parsing Uncontrolled Search Path Element Remote Code Exe... |
high | 7.8 | — | — | 2026-10-21 | 2026-10-30 |
| CVE-2026-89435 The Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Qu... |
high | 8.8 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-90437 The Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Script... |
high | 7.2 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-85876 Use after free in SQL Server allows an authorized attacker to elevate privileges... |
high | 7.0 | — | — | 2026-10-13 | 2026-10-30 |
| CVE-2026-76012 The Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery plugin for Wor... |
high | 7.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-68883 Heap-based buffer overflow in SQL Server allows an authorized attacker to elevat... |
high | 8.5 | — | — | 2026-10-13 | 2026-10-30 |
| CVE-2026-61989 Unauthenticated Cross Site Scripting (XSS) in Easy Property Listings |
high | 7.1 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-61996 Subscriber SQL Injection in MLS On The Fly |
high | 8.5 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-54864 Unauthenticated Cross Site Scripting (XSS) in Post Video Players |
high | 7.1 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-42701 Shop manager PHP Object Injection in YayMail |
high | 7.2 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-27394 Unauthenticated Cross Site Scripting (XSS) in Eventer |
high | 7.1 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-119979 LM Studio before 0.4.22+1 contains a path traversal vulnerability in the model d... |
high | 8.8 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-11861 A flaw was found in FreeIPA. |
high | 8.1 | — | Freeipa / freeipa | 2026-08-20 | 2026-10-30 |
| CVE-2026-119288 Zuke is a code-first, strongly typed build automation system for Deno. |
high | 7.0 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-118992 CallBackery versions before 0.62.0 for Perl allow OS command execution via sqlit... |
high | 8.4 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-118085 Unauthenticated Cross Site Scripting (XSS) in GlobalPayments WooCommerce |
high | 7.1 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-118205 The Essential Addons for Elementor – Popular Elementor Templates & Widgets plugi... |
high | 7.4 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-116869 Shop manager PHP Object Injection in myPOS Checkout |
high | 7.2 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-118073 Subscriber PHP Object Injection in News Kit Elementor Addons |
high | 8.8 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-118074 Shop manager PHP Object Injection in Finale Lite |
high | 7.2 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-118077 Author PHP Object Injection in Sastra Essential Addons for Elementor |
high | 7.2 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-118078 Shop manager PHP Object Injection in Product Catalog Feed by PixelYourSite |
high | 7.2 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-118079 Shop manager PHP Object Injection in FV Flowplayer Video Player |
high | 7.2 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-118082 Subscriber Privilege Escalation in Buddyboss Platform |
high | 8.8 | — | — | 2026-10-29 | 2026-10-30 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.