October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,479
Critical
1,340
High
5,869
Medium
6,256
Low
648
Severity not reported
3,366
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1307), google (756), oracle (156), ibm (140), adobe (138), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-88043 The Mang Board WP plugin for WordPress is vulnerable to Stored Cross-Site Script... |
high | 7.2 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-18548 The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress... |
high | 7.2 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-18586 The Premium Packages – Sell Digital Products Securely plugin for WordPress is vu... |
high | 7.2 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-15090 The Link Library plugin for WordPress is vulnerable to time-based SQL Injection... |
high | 7.5 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-17031 The Checkout Field Manager (Checkout Manager) for WooCommerce plugin for WordPre... |
high | 8.1 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-3712 The PhastPress plugin for WordPress is vulnerable to Server-Side Request Forgery... |
high | 7.3 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-76665 A security vulnerability in HPE NonStop EXPAND may cause out-of-bounds memory re... |
high | 7.1 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-76663 A stack-based buffer overflow vulnerability in HPE NonStop TELSERV can cause mem... |
high | 7.5 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-110907 Backdrop CMS Core 1.35.x before 1.35.2 and 1.34.x before 1.34.6 mishandles token... |
high | 7.5 | — | — | 2026-10-15 | 2026-10-19 |
| CVE-2026-110908 Netgate pfSense FRR package (pfSense-pkg-frr) 2.0.2_1 and source revision 2.1.2_... |
high | 8.8 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-76660 A vulnerability in HPE NonStop CIPSAM allows an out-of-bounds
write that can co... |
high | 8.7 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-76661 A vulnerability in HPE NonStop QIOMON allows an out-of-bounds write that can cor... |
high | 7.6 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-77931 MoviePilot through 3.1.5 contains a command injection vulnerability that allows... |
high | 8.8 | — | — | 2026-10-15 | 2026-10-26 |
| CVE-2026-73799 A security vulnerability in HPE NonStop SNMP Trap Multiplexer may cause memory c... |
high | 7.5 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-76066 IntentKit through 2.6.3, fixed in commit 5b91da5, contains an authorization bypa... |
high | 7.5 | — | — | 2026-10-15 | 2026-10-22 |
| CVE-2026-76659 A vulnerability in the finger daemon of HPE NonStop TCP/IP UTILITIES could allow... |
high | 7.5 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-109430 Ellucian WebAdvisor 3.2 contains an unauthenticated XML External Entity (XXE) in... |
high | 7.5 | — | — | 2026-10-15 | 2026-10-20 |
| CVE-2026-0993 SODOLA SL902-SWTGW124AS firmware before 200.2.12 contains a buffer overflow vuln... |
high | 7.5 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-110873 Heym from 0.0.55 before 0.0.121 contains a privilege escalation vulnerability th... |
high | 7.1 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-110865 Renovate before 44.60.1 contains an allowlist bypass vulnerability that allows r... |
high | 7.1 | — | — | 2026-10-14 | 2026-10-26 |
| CVE-2026-110867 Renovate before 44.60.1 contains an allowlist bypass vulnerability that allows r... |
high | 8.5 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-110868 Renovate before 44.79.0 contains a server-side request forgery vulnerability tha... |
high | 8.5 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-110869 Nodemailer 3.0.0 before 10.0.13 has a regular expression denial of service in SM... |
high | 7.5 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-110858 GitPython from 3.1.30 before 3.2.0 contains a remote code execution vulnerabilit... |
high | 8.1 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-110859 GitPython before 3.2.0 contains an argument injection vulnerability in Head.chec... |
high | 7.5 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-110863 Better Auth @better-auth/sso from 1.7.0-rc.2 before 1.7.3 contains an authentica... |
high | 8.1 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-110864 Better Auth from 1.5.0-beta.12 before 1.7.7 contains an authentication bypass vu... |
high | 7.4 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-110856 GitPython before 3.2.0 contains a regular expression denial of service vulnerabi... |
high | 7.5 | — | — | 2026-10-14 | 2026-10-20 |
| CVE-2026-110857 GitPython before 3.2.0 contains a remote code execution vulnerability that allow... |
high | 7.5 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-110838 FreeRDP shadow server from 3.0.0 before 3.32.0 dispatches input PDUs during the... |
high | 7.5 | — | Freerdp / freerdp | 2026-10-14 | 2026-10-23 |
| CVE-2026-110839 FreeRDP 3.3.0 before 3.32.0, when built with WINPR_UTILS_IMAGE_JPEG=ON, has a he... |
high | 7.1 | — | Freerdp / freerdp | 2026-10-14 | 2026-10-23 |
| CVE-2026-110833 FreeRDP from 3.0.0-beta1 before 3.32.0 fails to enforce cumulative or absolute s... |
high | 7.5 | — | Freerdp / freerdp | 2026-10-14 | 2026-10-23 |
| CVE-2026-110837 FreeRDP 2.0.0 before 3.32.0, when built with WITH_LAME=ON and WITH_DSP_FFMPEG=OF... |
high | 7.1 | — | Freerdp / freerdp | 2026-10-14 | 2026-10-23 |
| CVE-2026-110830 FreeRDP before 3.32.0 fails to close prior serial handles in serial_process_irp_... |
high | 7.5 | — | Freerdp / freerdp | 2026-10-14 | 2026-10-23 |
| CVE-2026-71854 OpenAEV is an open source platform allowing organizations to plan, schedule and... |
high | 8.2 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-96540 An improper access control vulnerability has been identified in the SonicWall Ne... |
high | 8.8 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-61844 FileRise is a self-hosted web-based file manager with multi-file upload, editing... |
high | 7.1 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-57489 FileRise is a self-hosted web-based file manager with multi-file upload, editing... |
high | 8.1 | — | — | 2026-10-14 | 2026-10-20 |
| CVE-2026-57490 FileRise is a self-hosted web-based file manager with multi-file upload, editing... |
high | 8.1 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-57492 FileRise is a self-hosted web-based file manager with multi-file upload, editing... |
high | 7.4 | — | — | 2026-10-14 | 2026-10-15 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.