October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,479
Critical
1,340
High
5,869
Medium
6,256
Low
648
Severity not reported
3,366
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1307), google (756), oracle (156), ibm (140), adobe (138), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-119113 The GeoDirectory – WP Business Directory Plugin and Classified Listings Director... |
medium | 6.4 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119176 The CP Multi View Events Calendar plugin for WordPress is vulnerable to Stored C... |
medium | 6.4 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-118635 The The GeoDirectory – WP Business Directory Plugin and Classified Listings Dire... |
medium | 6.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-115820 The Majestic Support – The Leading-Edge Help Desk & Customer Support Plugin plug... |
medium | 6.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-115869 The Themify Builder plugin for WordPress is vulnerable to Stored Cross-Site Scri... |
medium | 6.4 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-116552 The Like Button Rating ♥ LikeBtn plugin for WordPress is vulnerable to Stored Cr... |
medium | 4.7 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-110533 The FV Flowplayer Video Player plugin for WordPress is vulnerable to Stored Cros... |
medium | 6.4 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-109592 The OpenStation: Desktop Windows, Dock & Virtual Desktops for WP Admin plugin fo... |
medium | 4.3 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-109984 The FV Flowplayer Video Player plugin for WordPress is vulnerable to Stored Cros... |
medium | 5.4 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-110001 The FV Flowplayer Video Player plugin for WordPress is vulnerable to Stored Cros... |
medium | 5.4 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-104739 The JS Help Desk – AI-Powered Support & Ticketing System plugin for WordPress is... |
medium | 4.9 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-102905 The The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerabl... |
medium | 6.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-102918 The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scri... |
medium | 6.4 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-62055 Missing Authorization vulnerability in Liquid Web / StellarWP Event Tickets even... |
medium | 4.3 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-50000 SecureDrop is an open-source whistleblower submission system that media organiza... |
medium | 5.0 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-55551 ZAC is an open-source, workflow-based Common Ground component for Dutch municipa... |
medium | 6.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119466 Cross-Site Request Forgery (CSRF) vulnerability in WPExperts APIExperts Square f... |
medium | 5.4 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119298 croc is a tool that allows any two computers to simply and securely transfer fil... |
medium | 4.2 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119299 gopacket provides packet processing capabilities for Go. |
medium | 5.9 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119300 Wekan is open source kanban built with Meteor. |
medium | 6.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119365 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119367 Missing Authorization vulnerability in Liquid Web / StellarWP The Events Calenda... |
medium | 5.4 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119148 Incomplete string validation in AWS aws-nitro-enclaves-sdk-c before 0.4.6 may al... |
medium | 6.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-104623 A security vulnerability exists in the authorization handling for the local (man... |
medium | 6.3 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-62141 Missing Authorization vulnerability in WP ManageNinja LLC Fluent CRM fluent-crm... |
medium | 5.4 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119720 Blender before 4.5.15 and 5.x before 5.2.3 contains a heap out-of-bounds read vu... |
medium | 5.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119721 Blender before 4.5.15 and 5.x before 5.2.3 contains an out-of-bounds read vulner... |
medium | 6.1 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119711 PipesHub before 0.10.0 contains a rate limit bypass vulnerability in getClientIp... |
medium | 5.3 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119712 PipesHub before 0.10.0 contains a server-side request forgery vulnerability in I... |
medium | 6.4 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119714 My Calendar WordPress plugin 3.8.8 before 3.8.11 contains a shortcode injection... |
medium | 6.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119715 NocoDB before 2026.08.0 contains a clickjacking vulnerability that allows any or... |
medium | 4.3 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119708 abp-next-admin 10.4.0 through 10.7.0 contains a cross-tenant authorization bypas... |
medium | 6.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119709 Grimoire before 1.0.0 contains an unauthenticated server-side request forgery vu... |
medium | 5.8 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119703 xiaozhi-esp32-server through 0.9.8 contains an authentication bypass vulnerabili... |
medium | 4.8 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119704 Bastille through 1.4.4 contains a symlink following vulnerability in the cp.sh,... |
medium | 6.8 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119705 SerpBear before 3.1.1 contains a missing authentication vulnerability in pages/a... |
medium | 5.3 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119699 WPGraphQL Smart Cache before 2.3.3 contains an uncontrolled resource consumption... |
medium | 5.3 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119700 WPGraphQL before 2.24.2 contains an information disclosure vulnerability that al... |
medium | 5.3 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119701 WPGraphQL before 2.24.1 contains a missing rate limiting vulnerability that allo... |
medium | 5.3 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119702 WPGraphQL before 2.24.1 contains a missing authorization vulnerability in the cr... |
medium | 6.5 | — | — | 2026-10-30 | 2026-10-30 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.