October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
16,863
Critical
1,275
High
5,585
Medium
5,952
Low
622
Severity not reported
3,429
In CISA KEV
19
Most affected vendors (by CPE data where available): microsoft (1296), google (733), ibm (140), oracle (120), adobe (120), broadcom (61), apache (45), freerdp (42), linuxfoundation (41), dell (40)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-103039 The Gravity Forms plugin for WordPress is vulnerable to PHP Object Injection in... |
critical | 9.8 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-61707 SOCFortress CoPilot focuses on providing a single pane of glass for all your sec... |
critical | 9.0 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-61645 Docat is a tool for hosting versioned static documentation. |
critical | 9.1 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-118762 Monkeytype is a minimalistic and customizable typing test. |
critical | 9.3 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-107058 An issue in Shelter versionCode 445 allows attackers to register their own auth_... |
critical | 9.8 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-93680 IBM Langflow OSS 1.0.0 through 1.12.8 could allow a remote attacker to bypass se... |
critical | 9.8 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-90863 Missing authorization in the administrative interface of Progress Software WS_FT... |
critical | 9.1 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-90864 A path traversal vulnerability in Progress Software WS_FTP Server versions prior... |
critical | 9.1 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-90865 An OS command injection vulnerability in Progress Software WS_FTP Server version... |
critical | 9.0 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-90866 A path traversal vulnerability in Progress Software WS_FTP Server versions prior... |
critical | 9.1 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-90868 An OS command injection vulnerability in Progress Software WS_FTP Server version... |
critical | 9.9 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-84295 Improper authentication in Progress Software WS_FTP Server versions prior to 202... |
critical | 10.0 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-62013 Unauthenticated PHP Object Injection in Edge Decor |
critical | 9.8 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-62014 Unauthenticated PHP Object Injection in EmojiNation |
critical | 9.8 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-62015 Unauthenticated PHP Object Injection in Gamezone |
critical | 9.8 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-62016 Unauthenticated PHP Object Injection in Gamic |
critical | 9.8 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-62017 Unauthenticated PHP Object Injection in Good Homes |
critical | 9.8 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-62018 Unauthenticated PHP Object Injection in Gunslinger |
critical | 9.8 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-62131 Unauthenticated PHP Object Injection in Zoho Flow |
critical | 9.8 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-62004 Unauthenticated PHP Object Injection in Motorix |
critical | 9.8 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-62005 Unauthenticated PHP Object Injection in Muzicon |
critical | 9.8 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-62006 Unauthenticated PHP Object Injection in Nuts |
critical | 9.8 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-62008 Unauthenticated PHP Object Injection in Orpheus |
critical | 9.8 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-62009 Unauthenticated PHP Object Injection in Filmax |
critical | 9.8 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-62010 Unauthenticated PHP Object Injection in Avventure |
critical | 9.8 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-62011 Unauthenticated PHP Object Injection in Bonbon |
critical | 9.8 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-62012 Unauthenticated PHP Object Injection in Coinpress |
critical | 9.8 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-61997 Unauthenticated PHP Object Injection in Legal Stone |
critical | 9.8 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-61998 Unauthenticated PHP Object Injection in Le Truffe |
critical | 9.8 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-62001 Unauthenticated PHP Object Injection in Marcell |
critical | 9.8 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-62002 Unauthenticated PHP Object Injection in Meals & Wheels |
critical | 9.8 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-62003 Unauthenticated PHP Object Injection in Mission |
critical | 9.8 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-61991 Unauthenticated Remote Code Execution (RCE) in AjaxLoadMore Cache |
critical | 10.0 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-61992 Unauthenticated PHP Object Injection in GEO my WordPress |
critical | 9.8 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-54859 Unauthenticated PHP Object Injection in Preservation |
critical | 9.8 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-54860 Unauthenticated PHP Object Injection in Ozisti |
critical | 9.8 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-54856 Unauthenticated PHP Object Injection in RexCoin |
critical | 9.8 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-54857 Unauthenticated PHP Object Injection in Quirky |
critical | 9.8 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-54858 Unauthenticated PHP Object Injection in Printy |
critical | 9.8 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-119145 Frappe before 15.121.0 and 16.x before 16.34.0 contains a path traversal vulnera... |
critical | 9.9 | — | — | 2026-10-29 | 2026-10-29 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.