October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,479
Critical
1,340
High
5,869
Medium
6,256
Low
648
Severity not reported
3,366
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1307), google (756), oracle (156), ibm (140), adobe (138), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-119375 SQLite before 3.54.0 contains an information disclosure vulnerability that allow... |
medium | 5.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119376 SQLite before 3.54.0 contains a stack exhaustion vulnerability that allows attac... |
medium | 5.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119378 SQLite before 3.54.0 contains a use-after-free vulnerability in the R-Tree exten... |
medium | 5.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119146 ProFTPD before 1.3.9e and 1.3.10rc5 contains a buffer overflow vulnerability in... |
medium | 5.6 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119147 ProFTPD before 1.3.9e and 1.3.10rc5 contains an authorization bypass in the mod_... |
medium | 4.3 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119364 ProFTPD through 1.3.9e and 1.3.10rc1 through 1.3.10rc4 contains a link-following... |
medium | 5.3 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119371 SQLite before 3.54.0 contains a stack exhaustion vulnerability that allows attac... |
medium | 5.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119372 SQLite before 3.54.0 built with FTS3/FTS4 and SQLITE_ENABLE_FTS3_PARENTHESIS con... |
medium | 5.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-59388 Cloud Controller (CAPI) leaks sensitive data into audit logs in multiple instanc... |
medium | 6.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-59396 A denial-of-service vulnerability exists in UAA's private_key_jwt client-authent... |
medium | 4.9 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-59386 A SpaceSupporter could improperly modify an application's start command and buil... |
medium | 6.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-114690 A flaw was found in GCC. |
medium | 6.2 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-114691 A flaw was found in the libstdc++ component of GCC. |
medium | 5.9 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-115455 A flaw was found in GCC libstdc++. |
medium | 6.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-118593 A flaw was found in Red Hat Enterprise Linux 9 kernel builds. |
medium | 5.9 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-118952 A flaw was found in the Kroxylicious ACL authorizer. |
medium | 6.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-118698 The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for Wo... |
medium | 6.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119059 The Content Egg plugin for WordPress is vulnerable to unauthorized modification... |
medium | 4.3 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119087 The Content Egg – Affiliate Product Importer & Price Comparison plugin for WordP... |
medium | 4.3 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-118165 The Firelight Lightbox WordPress plugin before 2.3.23 does not escape the URL of... |
medium | 6.8 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-118194 The Page and Post Restriction plugin for WordPress is vulnerable to Authenticati... |
medium | 6.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-118500 The Cool FormKit Lite – Advanced Form Builder for Elementor plugin for WordPress... |
medium | 6.4 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-118634 The Events Made Easy plugin for WordPress is vulnerable to Stored Cross-Site Scr... |
medium | 6.4 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-117572 The WP Visitor Statistics (Real Time Traffic) WordPress plugin before 8.8 does n... |
medium | 4.1 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-118071 The Joinchat WordPress plugin before 6.4.2 does not escape the message of its bu... |
medium | 6.8 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-118072 The Fraud Prevention For WooCommerce and EDD WordPress plugin before 2.3.6 does... |
medium | 5.4 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-118100 The BuddyForms WordPress plugin before 2.10.3 does not check that the requester... |
medium | 5.3 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-118101 The BuddyForms WordPress plugin before 2.10.1 does not verify that a user editin... |
medium | 5.3 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-114444 The Security Plugin, Firewall & Malware Scanner with Auto Removal WordPress plug... |
medium | 4.4 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-115277 The User Frontend WordPress plugin before 4.3.14 does not sanitise and escape so... |
medium | 4.7 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-5461 The Forminator Forms plugin for WordPress is vulnerable to Limited File Deletion... |
medium | 6.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-96389 Missing Authorization vulnerability in Drupal Xray Audit allows Forceful Browsin... |
medium | 6.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-118539 Missing Authorization vulnerability in Drupal Commerce Core allows Forceful Brow... |
medium | 6.5 | — | — | 2026-10-30 | 2026-10-31 |
| CVE-2026-114572 Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal... |
medium | 5.4 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-107312 Allocation of Resources Without Limits or Throttling vulnerability in Drupal Exa... |
medium | 4.3 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-107267 Missing Authorization vulnerability in Drupal DKAN allows Forceful Browsing. |
medium | 5.3 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-107268 Insertion of Sensitive Information Into Sent Data vulnerability in Drupal Two Fa... |
medium | 4.3 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-107307 Incorrect Authorization vulnerability in Drupal SmartLinker AI allows Forceful B... |
medium | 4.3 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-107310 Server-Side Request Forgery (SSRF) vulnerability in Drupal Freelinking allows Se... |
medium | 4.3 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-107264 Improper Neutralization of Special Elements Used in a Template Engine vulnerabil... |
medium | 5.4 | — | — | 2026-10-30 | 2026-10-30 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.