October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,479
Critical
1,340
High
5,869
Medium
6,256
Low
648
Severity not reported
3,366
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1307), google (756), oracle (156), ibm (140), adobe (138), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-119479 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vu... |
medium | 5.3 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119291 Zuke is a code-first, strongly typed build automation system for Deno. |
medium | 5.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119369 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-116407 Missing Authorization vulnerability in Webba Plugins Webba Booking webba-booking... |
medium | 5.4 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-104063 Scribus before 1.6.7 contains an out-of-bounds read vulnerability in the Mac PIC... |
medium | 6.1 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-65444 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-46499 Collabora Online is a collaborative online office suite based on LibreOffice tec... |
medium | 4.3 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-48164 Collabora Online is a collaborative online office suite based on LibreOffice tec... |
medium | 4.7 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119665 WHartTest 2.2.0 through 2.8.1 contains a missing authorization vulnerability in... |
medium | 6.3 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-44344 Chamilo LMS is an open-source learning management system. |
medium | 6.6 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-45141 Chamilo LMS is an open-source learning management system. |
medium | 6.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119659 Blossom through 1.17.1 contains an authorization bypass vulnerability that allow... |
medium | 5.4 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119661 ShowDoc through 3.9.5 contains an authorization bypass vulnerability in the api/... |
medium | 4.2 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119663 Tamery (formerly Conar) 0.32.0 before 0.99.0 contains a broken authorization vul... |
medium | 4.3 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119664 Tamery (formerly Conar) 0.26.1 before 0.99.0 contains an authorization bypass vu... |
medium | 4.3 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119657 FilePress through 3.0.1 contains a missing authorization vulnerability in dzz/pi... |
medium | 5.0 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119658 PowerDNS-Admin through 2026.08.1 contains an authorization bypass vulnerability... |
medium | 4.3 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119647 RuoYi-Vue-Plus through 6.0.0 contains an authorization bypass vulnerability in S... |
medium | 4.3 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119648 Tencent BlueKing CMDB (bk-cmdb) through 3.14.6 contains a missing authorization... |
medium | 4.3 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119650 HuLa-Server through 3.0.7 contains an insecure direct object reference vulnerabi... |
medium | 5.4 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119651 HuLa-Server through 3.0.7 contains an insecure direct object reference vulnerabi... |
medium | 5.4 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119652 HuLa-Server through 3.0.7 contains an insecure direct object reference vulnerabi... |
medium | 4.3 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119653 Nging through 5.3.5 contains an information disclosure vulnerability that allows... |
medium | 4.3 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119368 Missing Authorization vulnerability in Liquid Web / StellarWP The Events Calenda... |
medium | 5.3 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119370 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119482 Missing Authorization vulnerability in Crocoblock JetFormBuilder jetformbuilder... |
medium | 5.3 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119644 Blossom through 1.17.1 contains an authorization bypass vulnerability that allow... |
medium | 5.4 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119645 ZenTao PMS through 22.6 contains a missing authorization vulnerability in doc::a... |
medium | 6.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119646 Open Web Analytics before 1.14.1 contains an authorization vulnerability that al... |
medium | 4.3 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-116860 Missing Authorization vulnerability in Arraytics Timetics timetics allows Exploi... |
medium | 5.3 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2015-20130 Netsweeper before 4.0.11 and 4.1.0 before 4.1.5 contains a reflected cross-site... |
medium | 6.1 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-91915 Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutra... |
medium | 6.8 | — | — | 2026-10-30 | 2026-10-31 |
| CVE-2026-119599 AxonHub through 1.0.0-beta11 contains a privilege escalation vulnerability that... |
medium | 4.3 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119600 tcpflow through 1.6.1 contains an out-of-bounds read vulnerability that allows u... |
medium | 4.8 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119601 AFFLIB through 3.7.22 contains a heap out-of-bounds write vulnerability in af_ge... |
medium | 6.1 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119577 ArcadeDB before 26.10.2 contains an improper authorization vulnerability that al... |
medium | 6.8 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119596 UNIT3D through 9.2.0 contains a missing authorization vulnerability in PlaylistZ... |
medium | 4.3 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119598 Miaomiaowu before 0.9.3 contains an insecure direct object reference vulnerabili... |
medium | 4.3 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119573 Traefik 3.7.11 before 3.7.15 contains an authorization bypass in the Kubernetes... |
medium | 4.4 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119574 Traefik from 3.2.0 before 3.7.15 contains a data race in the experimental FastPr... |
medium | 5.9 | — | — | 2026-10-30 | 2026-10-30 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.