October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,479
Critical
1,340
High
5,869
Medium
6,256
Low
648
Severity not reported
3,366
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1307), google (756), oracle (156), ibm (140), adobe (138), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-90960 The Seraphinite Accelerator plugin for WordPress is vulnerable to Sensitive Info... |
medium | 5.3 | — | — | 2026-10-31 | 2026-10-31 |
| CVE-2026-119166 The Welcart e-Commerce plugin for WordPress is vulnerable to Insecure Direct Obj... |
medium | 5.3 | — | — | 2026-10-31 | 2026-10-31 |
| CVE-2026-119980 The UsersWP – Front-end login form, User Registration, User Profile & Members Di... |
medium | 6.5 | — | — | 2026-10-31 | 2026-10-31 |
| CVE-2026-116546 The WP Job Portal – AI-Powered Recruitment System for Company or Job Board websi... |
medium | 6.4 | — | — | 2026-10-31 | 2026-10-31 |
| CVE-2026-107765 The Discussion Board – WordPress Forum Plugin plugin for WordPress is vulnerable... |
medium | 6.4 | — | — | 2026-10-31 | 2026-10-31 |
| CVE-2026-109217 The PDF Invoices & Packing Slips for WooCommerce plugin for WordPress is vulnera... |
medium | 5.3 | — | — | 2026-10-31 | 2026-10-31 |
| CVE-2026-109386 The Hustle – Email Marketing, Lead Generation, Optins, Popups plugin for WordPre... |
medium | 4.3 | — | — | 2026-10-31 | 2026-10-31 |
| CVE-2026-110251 The Photo Reviews for WooCommerce plugin for WordPress is vulnerable to unauthor... |
medium | 5.4 | — | — | 2026-10-31 | 2026-10-31 |
| CVE-2026-111109 The Webmention plugin for WordPress is vulnerable to Stored Cross-Site Scripting... |
medium | 6.1 | — | — | 2026-10-31 | 2026-10-31 |
| CVE-2026-92294 The Spectra Gutenberg Blocks – Website Builder for the Block Editor plugin for W... |
medium | 6.5 | — | — | 2026-10-31 | 2026-10-31 |
| CVE-2026-116563 The Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery plugin for Wor... |
medium | 5.4 | — | — | 2026-10-31 | 2026-10-31 |
| CVE-2026-101326 The The Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures... |
medium | 5.4 | — | — | 2026-10-31 | 2026-10-31 |
| CVE-2026-100155 The The Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures... |
medium | 6.5 | — | — | 2026-10-31 | 2026-10-31 |
| CVE-2026-63402 i18next is an internationalization framework for JavaScript. |
medium | 5.9 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-63410 secp256k1-native is a native C secp256k1 implementation for Ruby. |
medium | 5.9 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-61725 sevenz-rust2 is a Rust-native 7z compressor and `decompress`or. |
medium | 6.1 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-63121 Kubewarden policies is a collection of WebAssembly policies for securing and gov... |
medium | 6.3 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-63115 ActivityPub is a multi-tenant ActivityPub server for Ghost, built with Fedify. |
medium | 5.3 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-62277 LubeLogger is a self-hosted, open-source, web-based vehicle maintenance and fuel... |
medium | 6.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-55146 LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web app... |
medium | 4.3 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-55147 LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web app... |
medium | 6.3 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-62991 Shopper is a Headless e-commerce Admin Panel. |
medium | 6.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-62860 Picsou is a self-hosted personal finance dashboard. |
medium | 5.3 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-59993 Picotls is a TLS protocol library that allows users select different crypto back... |
medium | 6.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-62250 LibreDWG is a free C library to read and write DWG files. |
medium | 5.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-62254 LibreDWG is a free C library to read and write DWG files. |
medium | 5.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-62300 Filecoin Pin is an IPFS Pinning Service API implementation that pins to Filecoin... |
medium | 6.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119342 Stirling-PDF is a locally hosted web application that facilitates various operat... |
medium | 5.3 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119343 Stirling-PDF is a locally hosted web application that facilitates various operat... |
medium | 6.8 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119340 Tesseract is an open source OCR engine. |
medium | 5.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119339 Tesseract is an open source OCR engine. |
medium | 5.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-55098 Arc is an open, SQL-native time-series database for telemetry. |
medium | 6.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-55493 HotCRP is conference review software. |
medium | 6.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119730 Maxthon Browser for Android before 7.5.8.103 contains an address bar spoofing vu... |
medium | 4.3 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119328 Immich is a high-performance self-hosted photo and video management solution. |
medium | 6.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119329 Immich is a high-performance self-hosted photo and video management solution. |
medium | 4.3 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-116250 In server mode pgAdmin 4 validates a path a user gives for a file in their stora... |
medium | 6.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-116251 pgAdmin 4 did not invalidate a user's existing sessions when their password chan... |
medium | 4.2 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-116252 pgAdmin 4's materialized view refresh passed the target database's name to psql'... |
medium | 6.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-116246 To pass a server's password to psql and to the utilities pgAdmin 4 runs as backg... |
medium | 6.5 | — | — | 2026-10-30 | 2026-10-30 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.