October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,479
Critical
1,340
High
5,869
Medium
6,256
Low
648
Severity not reported
3,366
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1307), google (756), oracle (156), ibm (140), adobe (138), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-114270 The GeoDirectory WordPress plugin before 2.8.197 does not honour post password p... |
medium | 5.3 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-108763 The Wallet System for WooCommerce WordPress plugin before 2.8.2 does not restric... |
medium | 4.3 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-40063 A information disclosure vulnerability exists in the /nodered/fuxa/scripts funct... |
medium | 5.3 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-42949 A authorization bypass vulnerability exists in the /api/runscript functionality... |
medium | 5.6 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-113409 The Ortto plugin for WordPress before 1.0.25 did not escape stored settings on i... |
medium | 4.8 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-114173 The Ortto plugin for WordPress before 1.0.25 did not filter the WooCommerce prod... |
medium | 5.3 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-118590 A security vulnerability has been detected in nipy nibabel up to 5.4.2. |
medium | 5.3 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-118586 A security flaw has been discovered in dfm feedfinder2 up to 0.0.4. |
medium | 5.3 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-118589 A weakness has been identified in nschloe meshio up to 5.3.5. |
medium | 5.3 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-75520 Domoticz is a free, open source home automation system for Linux, Windows, macOS... |
medium | 5.4 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-82411 Open Object provides an API and admin interface to manage objects and object typ... |
medium | 6.5 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-118577 A vulnerability was identified in maotoumao MusicFreeDesktop 0.0.6/0.0.7/0.0.8. |
medium | 6.3 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-118578 A security flaw has been discovered in maotoumao MusicFreeDesktop 0.0.6/0.0.7/0.... |
medium | 4.3 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-61573 AVideo is a video-sharing Platform. |
medium | 6.1 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-61575 AVideo is a video-sharing Platform. |
medium | 4.7 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-118754 Dolibarr ERP CRM before 24.0.2 contains a missing authorization vulnerability in... |
medium | 5.3 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-118756 gopass before 1.17.0 contains a path traversal vulnerability in the filesystem s... |
medium | 5.5 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-118757 PiWeb Disable payment method / Partial payment for WooCommerce before 1.1.10.9 c... |
medium | 6.5 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-118693 CherryTree through 1.7.2 contains a path traversal vulnerability in CtStorageXml... |
medium | 4.7 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-116641 The DB Tools rely on the TLS implementation in Golang’s standard library, which... |
medium | 6.8 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-118537 A vulnerability was found in a2ui up to 0.10.4. |
medium | 4.3 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-118538 A vulnerability was determined in a2ui-project a2ui up to 0.12.0. |
medium | 5.5 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-118667 LangGraph Python SDK is used to connect to running LangGraph API servers, manage... |
medium | 4.3 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-118661 Happy DOM is a JavaScript implementation of a web browser without its graphical... |
medium | 6.5 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-118663 @hono/node-server allows running the Hono application on Node.js. |
medium | 5.3 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-118656 Echo is a Go web framework. |
medium | 6.1 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-118657 Echo is a Go web framework. |
medium | 5.9 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-118658 Echo is a Go web framework. |
medium | 4.7 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-61529 Endatix is a self-hosted form and survey management platform with a headless API... |
medium | 4.7 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-54162 Ember is a real-time terminal dashboard for Caddy servers with FrankenPHP suppor... |
medium | 4.7 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-118651 Echo is a Go web framework. |
medium | 5.3 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-118652 Echo is a Go web framework. |
medium | 6.1 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-118653 Echo is a Go web framework. |
medium | 5.3 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-118654 Echo is a Go web framework. |
medium | 5.9 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-118655 Echo is a Go web framework. |
medium | 5.9 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-11854 The authentication endpoint generates an error message that includes reflected d... |
medium | 6.1 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-118266 Echo is a Go web framework. |
medium | 5.3 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-115415 Improper neutralization of input used for LLM prompting in the environment tool... |
medium | 6.5 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-118684 MONAI before 1.6.1 contains an insufficient integrity verification vulnerability... |
medium | 5.9 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-118685 ToolJet from 3.20.2-lts before 3.20.242-lts contains an authorization bypass in... |
medium | 6.5 | — | — | 2026-10-28 | 2026-10-29 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.