October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,479
Critical
1,340
High
5,869
Medium
6,256
Low
648
Severity not reported
3,366
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1307), google (756), oracle (156), ibm (140), adobe (138), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-90731 Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.7, LTS... |
medium | 4.9 | — | — | 2026-10-27 | 2026-10-29 |
| CVE-2026-90732 Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through LTS 2026... |
medium | 4.9 | — | — | 2026-10-27 | 2026-10-29 |
| CVE-2026-115408 In `github.com/eclipse-keypont/crypto11/v2` versions `>= 2.0.0-rc3, <= 2.0.0-rc8... |
medium | 5.5 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-41022 Eaton easySoft improperly validates TLS certificates presented by easyE4 devices... |
medium | 5.9 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-105323 Improper neutralization of input during web page generation ('cross-site scripti... |
medium | 6.1 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-10752 The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to autho... |
medium | 4.8 | — | — | 2026-10-27 | 2026-10-29 |
| CVE-2026-117541 svg-sanitizer from 0.11.0 before 1.1.0 contains an uncaught exception vulnerabil... |
medium | 5.3 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117535 REDAXO before 5.21.3 contains a reflected cross-site scripting vulnerability in... |
medium | 6.1 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117537 REDAXO before 5.21.0 contains a reflected cross-site scripting vulnerability tha... |
medium | 4.1 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117538 REDAXO before 5.21.0 contains a reflected cross-site scripting vulnerability in... |
medium | 4.1 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-116900 REDAXO before 5.21.4 contains a stored cross-site scripting vulnerability that a... |
medium | 5.4 | — | — | 2026-10-27 | 2026-10-31 |
| CVE-2026-117530 In JetBrains Junie CLI before 26.8.17 command execution was possible due to inco... |
medium | 6.7 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117533 REDAXO from 5.18.0 before 5.21.4 contains a stored cross-site scripting vulnerab... |
medium | 4.4 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117534 REDAXO before 5.21.3 contains a cross-site request forgery vulnerability in the... |
medium | 5.4 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-116893 REDAXO core before 5.21.5 contains a missing authorization vulnerability in the... |
medium | 6.8 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-116894 REDAXO before 5.21.5 contains an insufficient session expiration vulnerability t... |
medium | 4.2 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-116895 REDAXO before 5.21.5 contains a cross-site request forgery vulnerability because... |
medium | 5.4 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-116897 REDAXO core before 5.21.4 contains a missing authorization vulnerability in the... |
medium | 6.5 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-116899 REDAXO before 5.21.4 contains a broken access control vulnerability that allows... |
medium | 6.5 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-116887 Semantic MediaWiki from 3.0.0 before 7.3.1 contains a stored cross-site scriptin... |
medium | 5.4 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-116888 SemanticMediaWiki from 3.2.0 before 7.3.1 contains a stored cross-site scripting... |
medium | 5.4 | — | Semantic-mediawiki / semantic mediawiki | 2026-10-27 | 2026-10-31 |
| CVE-2026-116889 SemanticMediaWiki from 2.5.0 before 7.3.1 contains a stored cross-site scripting... |
medium | 6.1 | — | Semantic-mediawiki / semantic mediawiki | 2026-10-27 | 2026-10-28 |
| CVE-2026-116891 SemanticMediaWiki from 4.2.0 before 7.2.1 contains a reflected cross-site script... |
medium | 6.1 | — | Semantic-mediawiki / semantic mediawiki | 2026-10-27 | 2026-10-28 |
| CVE-2026-116892 SemanticMediaWiki from 3.1.0 before 7.3.1 contains a reflected cross-site script... |
medium | 6.1 | — | Semantic-mediawiki / semantic mediawiki | 2026-10-27 | 2026-10-31 |
| CVE-2026-116881 Semantic MediaWiki from 3.0.0 before 7.3.1 contains a cross-site scripting vulne... |
medium | 6.1 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-116882 Semantic MediaWiki from 4.2.0 before 7.3.1 contains a stored cross-site scriptin... |
medium | 4.8 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-116883 Semantic MediaWiki from 3.1.0 before 7.3.1 contains a stored cross-site scriptin... |
medium | 4.8 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-116884 SemanticMediaWiki from 5.0.0 before 7.3.1 contains a stored cross-site scripting... |
medium | 6.1 | — | Semantic-mediawiki / semantic mediawiki | 2026-10-27 | 2026-10-31 |
| CVE-2026-116885 Semantic MediaWiki from 3.1.0 before 7.3.1 contains a reflected cross-site scrip... |
medium | 6.1 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-116886 Semantic MediaWiki from 2.5.0 before 7.3.1 contains a stored cross-site scriptin... |
medium | 5.4 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-116874 SemanticMediaWiki from 3.1.0 before 7.3.1 contains a reflected cross-site script... |
medium | 6.1 | — | Semantic-mediawiki / semantic mediawiki | 2026-10-27 | 2026-10-28 |
| CVE-2026-116875 SemanticMediaWiki from 3.0.0 before 7.3.1 contains a reflected cross-site script... |
medium | 6.1 | — | Semantic-mediawiki / semantic mediawiki | 2026-10-27 | 2026-10-28 |
| CVE-2026-116877 Semantic MediaWiki from 2.5.0 before 7.3.1 contains an uncontrolled resource con... |
medium | 6.5 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-116879 Semantic MediaWiki from 7.3.0 before 7.3.1 contains a missing authorization vuln... |
medium | 5.4 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-65213 This issue may allow an IPMI authenticated administrator to execute commands as... |
medium | 6.6 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-65210 This issue may allow an authenticated IPMI Administrator to read arbitrary files... |
medium | 4.9 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-10511 The Jupiter X Core plugin for WordPress is vulnerable to Stored Cross-Site Scrip... |
medium | 6.4 | — | — | 2026-10-27 | 2026-10-29 |
| CVE-2026-103359 The PayDunya WooCommerce Payment Gateway WordPress plugin through 1.1.6 does not... |
medium | 5.3 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-117471 Psono Server CE && EE versions 0.1.0 through 7.2.3 accepted a user-controlled ho... |
medium | 5.4 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117472 Psono Server CE && EE versions 4.0.33 through 7.2.3 compared the request path fo... |
medium | 4.3 | — | — | 2026-10-27 | 2026-10-27 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.