October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,479
Critical
1,340
High
5,869
Medium
6,256
Low
648
Severity not reported
3,366
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1307), google (756), oracle (156), ibm (140), adobe (138), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-115601 Missing Authorization vulnerability in WP Desk Custom Price for WooCommerce cust... |
medium | 5.3 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-115605 Missing Authorization vulnerability in Brainstorm Force SureDash suredash allows... |
medium | 4.3 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-115610 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-115706 Authorization Bypass Through User-Controlled Key (CWE-639) in Elastic Cloud Ente... |
medium | 6.8 | — | Elastic / elastic cloud enterprise | 2026-10-29 | 2026-10-30 |
| CVE-2026-115707 Insertion of Sensitive Information into Externally-Accessible File or Directory... |
medium | 6.4 | — | Elastic / elastic cloud enterprise | 2026-10-29 | 2026-10-30 |
| CVE-2026-107023 Insecure permissions in the ContentProvider component of mhss1 MyBrain v3.1.0 al... |
medium | 6.5 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-110881 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-114181 Missing Authorization vulnerability in Magepeople inc. |
medium | 5.3 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-114706 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-93009 A flaw was found in dnsmasq. |
medium | 4.3 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-93010 A flaw was found in dnsmasq. |
medium | 4.3 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-48202 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vu... |
medium | 5.3 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-54862 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-42707 Missing Authorization vulnerability in HivePress HivePress Claim Listings hivepr... |
medium | 4.3 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-48195 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-25467 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vu... |
medium | 5.3 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-39782 Missing Authorization vulnerability in Kaliforms Kali Forms kali-forms allows Ex... |
medium | 5.3 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-119051 flat through 6.0.1 contains an uncontrolled resource allocation vulnerability in... |
medium | 5.9 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-119053 lwIP 2.0.0 through 2.2.1 built with the SNMP agent contains an out-of-bounds rea... |
medium | 5.3 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-119054 Multiple Pages Generator by Themeisle before 4.2.5 contains a stored cross-site... |
medium | 5.4 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-118425 A flaw was found in the secure-redirect-uris-enforcer client policy of Keycloak,... |
medium | 6.8 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-119048 JeeSite 5.11.0 through 5.19.1 contains an insecure direct object reference vulne... |
medium | 4.2 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-116402 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vu... |
medium | 5.3 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-116857 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-93008 A flaw was found in dnsmasq. |
medium | 6.8 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-93011 A flaw was found in dnsmasq. |
medium | 5.3 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-93006 A flaw was found in dnsmasq. |
medium | 6.8 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-93007 A flaw was found in dnsmasq. |
medium | 5.3 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-52709 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-56056 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-48196 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-39735 Missing Authorization vulnerability in Crocoblock JetEngine jet-engine allows Ex... |
medium | 6.5 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-39741 Missing Authorization vulnerability in RelyWP Simple Cloudflare Turnstile simple... |
medium | 5.3 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-42703 Missing Authorization vulnerability in Kaliforms Kali Forms kali-forms allows Ex... |
medium | 6.5 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-22386 Missing Authorization vulnerability in Ahmad WP Job Portal wp-job-portal allows... |
medium | 4.3 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-24533 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-118087 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-118093 Missing Authorization vulnerability in WPFunnels Team Product Feed Manager best-... |
medium | 5.3 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-118094 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-92086 The MW WP Form plugin for WordPress is vulnerable to Sensitive Information Expos... |
medium | 5.3 | — | — | 2026-10-29 | 2026-10-29 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.