October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
24,571
Critical
3,293
High
7,942
Medium
7,637
Low
740
Severity not reported
4,959
In CISA KEV
191
Most affected vendors (by CPE data where available): microsoft (1424), google (825), linux (722), ibm (323), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (116), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-118083 Unauthenticated Sensitive Data Exposure in WP Crowdfunding |
high | 7.5 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-116864 Author PHP Object Injection in WPCargo Track & Trace |
high | 7.2 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-116865 Editor PHP Object Injection in Zippy |
high | 7.2 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-116866 Contributor PHP Object Injection in Extra Fees Plugin for WooCommerce |
high | 8.8 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-115887 GraphQL Scalars is a library of custom GraphQL scalars for creating precise type... |
high | 7.5 | — | — | 2026-10-23 | 2026-10-30 |
| CVE-2026-115895 Happy DOM is a JavaScript implementation of a web browser without its graphical... |
high | 8.8 | — | — | 2026-10-23 | 2026-10-30 |
| CVE-2026-115346 The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is v... |
high | 8.1 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-113870 MongoDB Compass improperly escapes certain BSON values when converting a stored... |
high | 8.8 | — | — | 2026-10-21 | 2026-10-30 |
| CVE-2026-114221 NT OneAPP developed by NewType Infortech has a Credential Disclosure vulnerabili... |
high | 7.4 | — | — | 2026-10-22 | 2026-10-30 |
| CVE-2026-113582 UNSUPPORTED WHEN ASSIGNED Improper restriction of XML external entity references... |
high | 7.5 | — | — | 2026-10-22 | 2026-10-30 |
| CVE-2026-112365 The easy.jobs – AI powered Job Listing, Job Board, Career Page, Recruitment & Hi... |
high | 7.2 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-110732 The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPre... |
high | 7.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-110305 The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to Sensi... |
high | 7.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-109619 PHP Stale Internal Request-State Vulnerability |
high | 8.1 | Listed | PHP Group / PHP | 2026-10-21 | 2026-10-30 |
| CVE-2026-107039 Insecure permissions in the ActivityMain component of M66B/Marcel Bokhorst NetGu... |
high | 7.5 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-105894 The Ak Framework plugin for WordPress, included in the Newsy - Viral News & Maga... |
high | 8.8 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-104744 The Independent Analytics Pro plugin for WordPress is vulnerable to Stored Cross... |
high | 7.2 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2025-8574 The Database Cleaner plugin for WordPress is vulnerable to arbitrary table delet... |
high | 8.7 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2024-9341 A flaw was found in Go. |
high | 8.2 | — | Containers / common | 2024-10-01 | 2026-10-30 |
| CVE-2024-12397 A flaw was found in Quarkus-HTTP, which incorrectly parses cookies with
certain... |
high | 7.4 | — | — | 2024-12-12 | 2026-10-30 |
| CVE-2013-0261 A flaw was found in PackStack. |
high | 8.8 | — | Openstack / essex | 2013-03-08 | 2026-10-30 |
| CVE-2026-119426 phpMyAdmin through 5.2.3 contains a cross-site request forgery vulnerability tha... |
high | 7.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119549 Jellyfin through 12.4 contains a server-side request forgery vulnerability that... |
high | 7.1 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119718 Blender before 4.5.15 and 5.x before 5.2.3 contains a heap buffer overflow vulne... |
high | 7.8 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119719 Blender before 4.5.15 and 5.x before 5.2.3 contains a heap buffer overflow vulne... |
high | 7.8 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119722 Blender before 4.5.15 and 5.x before 5.2.3 contains a heap out-of-bounds access... |
high | 7.8 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119418 CakePHP through 5.4.3 contains an sql injection vulnerability that allows attack... |
high | 8.1 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119419 CakePHP through 5.4.3 contains an sql injection vulnerability that allows attack... |
high | 8.1 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119407 Element Web and Element Desktop before 1.12.32 accept guest credentials from URL... |
high | 7.1 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119373 SQLite before 3.54.0 built with FTS5 contains a heap buffer overflow in fts5Merg... |
high | 7.8 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119374 SQLite before 3.54.0 built with FTS5 contains a heap buffer overflow in fts5DoSe... |
high | 7.8 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119379 SQLite before 3.54.0 built with the session extension contains a heap buffer ove... |
high | 7.8 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119586 SQLite command-line shell through 3.54.1 contains a command injection vulnerabil... |
high | 7.8 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-107630 The Email Templates Customizer and Designer for WordPress and WooCommerce plugin... |
high | 7.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-78002 A flaw was found in rsyslog. |
high | 7.5 | — | — | 2026-08-27 | 2026-10-30 |
| CVE-2026-74755 An integer underflow in the mcpack2pb component of Apache bRPC (version < 1.18.0... |
high | 7.5 | — | — | 2026-10-21 | 2026-10-30 |
| CVE-2026-73197 A flaw was found in FreeIPA. |
high | 7.5 | — | Redhat / enterprise linux | 2026-08-20 | 2026-10-30 |
| CVE-2026-72694 A flaw was found in MRTG. |
high | 7.1 | — | — | 2026-08-11 | 2026-10-30 |
| CVE-2026-65824 OpenReception's appointment booking software provides an end-to-end encrypted ap... |
high | 7.4 | — | — | 2026-10-23 | 2026-10-30 |
| CVE-2026-65566 Cross-Site Request Forgery (CSRF) vulnerability in Meow Apps AI Engine ai-engine... |
high | 8.8 | — | — | 2026-10-30 | 2026-10-30 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.