October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,479
Critical
1,340
High
5,869
Medium
6,256
Low
648
Severity not reported
3,366
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1307), google (756), oracle (156), ibm (140), adobe (138), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-116248 In pgAdmin 4 server mode only administrators are meant to share a server with al... |
medium | 6.8 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-116240 In server mode pgAdmin 4 validates a path into the user's storage directory with... |
medium | 6.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-7003 WIT SynApps Runtime through 1.4.11 contains a hardcoded credentials vulnerabilit... |
medium | 5.3 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-7004 WIT SynApps Runtime through 1.4.11 contains a pre-authentication reflected cross... |
medium | 6.1 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-7005 WIT SynApps Runtime through 1.4.11 contains a browser-mediated cross-origin requ... |
medium | 6.1 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-62303 Pistache is a high-performance REST toolkit written in C++. |
medium | 5.9 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-62121 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP... |
medium | 6.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-62122 Missing Authorization vulnerability in Arraytics Booktics booktics allows Exploi... |
medium | 5.3 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-62019 Missing Authorization vulnerability in Liquid Web / StellarWP BookIt bookit allo... |
medium | 4.3 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-62023 Missing Authorization vulnerability in Unlimited Elements Unlimited Elements For... |
medium | 4.3 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-62047 Missing Authorization vulnerability in Liquid Web / StellarWP Event Tickets even... |
medium | 4.3 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-62056 Missing Authorization vulnerability in WP ManageNinja LLC Fluent CRM fluent-crm... |
medium | 5.3 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-62057 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vu... |
medium | 5.3 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-54854 Contributor Privilege Escalation in Profile Builder |
medium | 6.3 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-52710 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vu... |
medium | 5.3 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-54850 Subscriber Broken Access Control in Booking and Rental Manager |
medium | 6.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-39739 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-27061 Subscriber Cross Site Scripting (XSS) in User Registration |
medium | 6.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119842 A flaw was found in GStreamer's gst-plugins-base MicroDVD subtitle parser. |
medium | 6.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-120007 NodeBB 1.18.0 through 4.16.5 contains an authorization bypass vulnerability that... |
medium | 6.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-120046 Nezha 2.0.0 before 2.4.0 contains a NULL pointer dereference vulnerability in Se... |
medium | 5.3 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119727 A flaw was found in GStreamer's gst-plugins-bad H.265 video parser. |
medium | 6.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119728 A flaw was found in the H.264 video parser in gst-plugins-bad. |
medium | 5.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119729 A flaw was found in GStreamer. |
medium | 6.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119117 Insertion of sensitive information into a log file in Amazon Kinesis Producer Li... |
medium | 6.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-116853 Unauthenticated Broken Access Control in GiveWP |
medium | 6.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-116854 Subscriber Cross Site Scripting (XSS) in WP Customer Area |
medium | 6.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-116410 Unauthenticated Arbitrary Content Deletion in Masteriyo - LMS |
medium | 6.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-115947 Unauthenticated Sensitive Data Exposure in HUSKY |
medium | 6.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-114711 Subscriber Cross Site Scripting (XSS) in MultiVendorX |
medium | 6.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-115604 Subscriber Arbitrary File Deletion in SureDash |
medium | 5.0 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-107868 Unauthenticated Bypass Vulnerability in YITH WooCommerce Product Add-Ons |
medium | 5.3 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-104674 Missing Authorization vulnerability in Arraytics Booktics booktics allows Exploi... |
medium | 4.3 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-9239 The Meow Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripti... |
medium | 6.4 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-69446 Incorrect authorization in Microsoft Edge (Chromium-based) allows an authorized... |
medium | 4.4 | — | — | 2026-10-30 | 2026-10-31 |
| CVE-2026-13747 The Meow Gallery plugin for WordPress is vulnerable to authorization bypass in a... |
medium | 6.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119763 changelog.com before commit 7b35e829 contains a missing authorization vulnerabil... |
medium | 5.3 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119764 Mythic 3.2.16 through 3.4.0.61 contains a stored cross-site scripting vulnerabil... |
medium | 6.8 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119761 Axigen Mail Server WebMail before 10.6.39 and 10.7.1 contains a stored cross-sit... |
medium | 6.1 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119086 Missing queue-set type validation in the queue-set selection system call in Free... |
medium | 6.5 | — | — | 2026-10-30 | 2026-10-30 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.