October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,479
Critical
1,340
High
5,869
Medium
6,256
Low
648
Severity not reported
3,366
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1307), google (756), oracle (156), ibm (140), adobe (138), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-110244 IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacke... |
medium | 6.5 | — | Langflow / langflow | 2026-10-29 | 2026-10-30 |
| CVE-2026-109891 Missing Authorization vulnerability in weDevs Happy Addons for Elementor happy-e... |
medium | 6.4 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-110190 IBM Langflow OSS 1.0.0 through 1.12.4 could allow an authenticated user to trave... |
medium | 6.5 | — | Langflow / langflow | 2026-10-29 | 2026-10-30 |
| CVE-2026-104331 IBM Langflow OSS 1.0.0 through 1.12.3 is vulnerable to server-side request forge... |
medium | 5.4 | — | Langflow / langflow | 2026-10-29 | 2026-10-30 |
| CVE-2026-104308 IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacke... |
medium | 4.3 | — | Langflow / langflow | 2026-10-29 | 2026-10-30 |
| CVE-2026-104309 IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacke... |
medium | 6.5 | — | Langflow / langflow | 2026-10-29 | 2026-10-30 |
| CVE-2026-104310 IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacke... |
medium | 4.3 | — | Langflow / langflow | 2026-10-29 | 2026-10-30 |
| CVE-2026-104312 IBM Langflow OSS 1.0.0 through 1.12.3 could allow an authenticated attacker to p... |
medium | 6.8 | — | Langflow / langflow | 2026-10-29 | 2026-10-30 |
| CVE-2026-104314 IBM Langflow OSS 1.0.0 through 1.12.3 could allow an authenticated attacker with... |
medium | 6.5 | — | Langflow / langflow | 2026-10-29 | 2026-10-30 |
| CVE-2026-104315 IBM Langflow OSS 1.0.0 through 1.12.3 is vulnerable to server-side request forge... |
medium | 4.3 | — | Langflow / langflow | 2026-10-29 | 2026-10-30 |
| CVE-2026-104316 IBM Langflow OSS 1.0.0 through 1.12.3 could allow an authenticated attacker to c... |
medium | 6.5 | — | Langflow / langflow | 2026-10-29 | 2026-10-30 |
| CVE-2025-13050 Broken Function Level Authorization allows execution of poller post-restart comm... |
medium | 5.4 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-97073 Missing Authorization vulnerability in myCred myCred mycred allows Exploiting In... |
medium | 5.3 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-80067 MasterStudy LMS plugin for WordPress before 3.7.50 contains a path traversal vul... |
medium | 5.4 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-80069 MasterStudy LMS plugin for WordPress before 3.7.50 contains a missing authorizat... |
medium | 4.3 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-42691 Authorization Bypass Through User-Controlled Key vulnerability in EventPrime Eve... |
medium | 5.4 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-48884 Missing Authorization vulnerability in weDevs WP User Frontend wp-user-frontend... |
medium | 5.3 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-52708 Missing Authorization vulnerability in weDevs WP User Frontend wp-user-frontend... |
medium | 4.3 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-54852 Missing Authorization vulnerability in miniOrange Page Restriction WordPress (WP... |
medium | 5.3 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-54853 Missing Authorization vulnerability in Cozmoslabs Profile Builder profile-builde... |
medium | 5.3 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-54871 Missing Authorization vulnerability in Mamunur Rashid ShopBuilder – Elementor Wo... |
medium | 5.3 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-25448 Missing Authorization vulnerability in weDevs WP ERP erp allows Exploiting Incor... |
medium | 4.3 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-25450 Missing Authorization vulnerability in ThemeGrill User Registration user-registr... |
medium | 5.3 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-27062 Cross-Site Request Forgery (CSRF) vulnerability in WPFunnels Team WPFunnels wpfu... |
medium | 4.3 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-27063 Missing Authorization vulnerability in Kit Kit (formerly ConvertKit) convertkit... |
medium | 5.3 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-39737 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-39742 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-118092 Missing Authorization vulnerability in StylemixThemes MasterStudy LMS masterstud... |
medium | 4.3 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-118095 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-118097 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-116846 Missing Authorization vulnerability in WP User Manager WP User Manager wp-user-m... |
medium | 5.3 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-116849 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-116850 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-116856 Missing Authorization vulnerability in WP Desk Flexible Quantity – Measurement P... |
medium | 5.3 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-118088 Missing Authorization vulnerability in WPFunnels Team WPFunnels wpfunnels allows... |
medium | 5.3 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-118091 Missing Authorization vulnerability in WPFunnels Team WPFunnels wpfunnels allows... |
medium | 5.3 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-116387 Missing Authorization vulnerability in Brainstorm Force SureForms sureforms allo... |
medium | 5.3 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-116406 Missing Authorization vulnerability in Webba Plugins Webba Booking webba-booking... |
medium | 4.3 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-115711 Insertion of Sensitive Information into Externally-Accessible File or Directory... |
medium | 6.4 | — | Elastic / elastic cloud enterprise | 2026-10-29 | 2026-10-30 |
| CVE-2026-115712 Incorrect Authorization (CWE-863) in Elastic Cloud Enterprise (ECE) can lead to... |
medium | 4.3 | — | Elastic / elastic cloud enterprise | 2026-10-29 | 2026-10-30 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.