October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,479
Critical
1,340
High
5,869
Medium
6,256
Low
648
Severity not reported
3,366
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1307), google (756), oracle (156), ibm (140), adobe (138), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-119575 ArcadeDB from 26.8.1 before 26.10.2 contains a server-side request forgery vulne... |
medium | 6.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119576 ArcadeDB from 21.12.1 before 26.10.2 contains an authorization bypass vulnerabil... |
medium | 4.3 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119542 A flaw was found in the Ickle query parser in Infinispan. |
medium | 4.3 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119569 Parse Server before 8.6.108 and 9.0.0 before 9.10.5-alpha.9 contains a prototype... |
medium | 5.3 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-115683 A race condition in Epiphany allows a malicious website to bypass the TLS/SSL ce... |
medium | 6.8 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-112348 Kirki plugin for WordPress before 6.2.5 contains a reCAPTCHA bypass vulnerabilit... |
medium | 6.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-111498 OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Resource Lo... |
medium | 4.7 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-111499 Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Incorrect Permi... |
medium | 5.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-111500 Dell OpenManage Enterprise, versions prior to 4.8.0, contains a Missing Authenti... |
medium | 5.4 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-112374 FOSSBilling before 0.8.9 contains a Cross-Site Request Forgery vulnerability in... |
medium | 4.3 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-111501 Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Restri... |
medium | 5.4 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-111502 Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Insufficiently... |
medium | 4.3 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119565 Plausible Analytics through 3.2.1 contains a mass assignment vulnerability in up... |
medium | 4.3 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119566 Prometheus through 3.15.1 contains a credential leak vulnerability that allows a... |
medium | 4.8 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119591 SQLite before 3.54.0 contains a stack exhaustion vulnerability in countOfViewOpt... |
medium | 5.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119559 OpenLiteSpeed through 1.9.4 contains an authentication bypass vulnerability that... |
medium | 5.9 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119560 OPNsense core through 26.7.8 contains a configuration injection vulnerability th... |
medium | 5.9 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119561 phpMyAdmin through 5.2.3 contains an authentication bypass vulnerability in Cust... |
medium | 6.8 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119562 phpMyAdmin through 5.2.3 contains an sql injection vulnerability that allows aut... |
medium | 4.2 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119563 phpMyAdmin through 5.2.3 contains a stored cross-site scripting vulnerability th... |
medium | 5.4 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119564 Plausible Analytics Community Edition through 3.2.1 contains an information expo... |
medium | 5.3 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119552 Uptime Kuma through 2.5.8 contains a race condition in the Socket.IO first-run s... |
medium | 4.8 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119553 Moodle 5.3.0, 5.2.0 through 5.2.4, 5.1.0 through 5.1.8, 5.0.0 through 5.0.11, an... |
medium | 6.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119554 Moodle 5.3.0, 5.2.0 through 5.2.4, 5.1.0 through 5.1.8, 5.0.0 through 5.0.11, an... |
medium | 5.9 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119555 Moodle 4.2.0 through 4.5.15, 5.0.0 through 5.0.11, 5.1.0 through 5.1.8, 5.2.0 th... |
medium | 4.3 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119556 Moodle 4.2.0 through 4.5.15, 5.0.0 through 5.0.11, 5.1.0 through 5.1.8, 5.2.0 th... |
medium | 4.3 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119557 n8n from 2.14.0 through 2.46.3 contains a path traversal vulnerability in the Da... |
medium | 5.9 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119551 Jellyfin through 12.4 contains an authorization bypass vulnerability in Suggesti... |
medium | 6.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119429 phpMyAdmin through 5.2.3 contains a missing re-authentication vulnerability that... |
medium | 4.3 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119545 Forgejo through 15.0.11, 16.0.0 through 16.0.7, and 17.0.0 through 17.0.1 contai... |
medium | 5.3 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119546 Forgejo through 15.0.11, 16.0.0 through 16.0.7, and 17.0.0 through 17.0.1 contai... |
medium | 5.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119547 Forgejo through 15.0.11, 16.0.0 through 16.0.7, and 17.0.0 through 17.0.1 contai... |
medium | 4.3 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119422 Juspay Hyperswitch before 1.128.0 contains an authentication bypass vulnerabilit... |
medium | 5.9 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119423 OPNsense core before 26.7.8 contains a log injection vulnerability that allows u... |
medium | 5.3 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119424 OPNsense core before 26.7.8 contains a configuration line injection vulnerabilit... |
medium | 6.8 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119425 OPNsense core 26.1.6 through 26.7.7 contains an authentication bypass vulnerabil... |
medium | 5.4 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119427 phpMyAdmin through 5.2.3 contains an sql injection vulnerability in Designer sav... |
medium | 4.2 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119416 CakePHP through 5.4.3 contains an improper cookie domain validation vulnerabilit... |
medium | 4.8 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119421 Juspay Hyperswitch through 1.128.0 (and builds before 2026.10.19.0) contains a m... |
medium | 5.9 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119414 Bitwarden Server before 2026.10.1 on Entity Framework backends contains an autho... |
medium | 4.3 | — | — | 2026-10-30 | 2026-10-30 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.