October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,479
Critical
1,340
High
5,869
Medium
6,256
Low
648
Severity not reported
3,366
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1307), google (756), oracle (156), ibm (140), adobe (138), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-117468 Psono Server versions 5.3.5 through 7.2.3 used a permission class that did not e... |
medium | 6.5 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117469 Psono Server (CE & EE) versions 1.0.0 through 7.2.3 did not enforce the directio... |
medium | 5.4 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117470 Psono Server CE & EE versions 3.1.0 through 7.2.3 did not consume a stored WebAu... |
medium | 6.5 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-103312 The Payment Integration Wompi WordPress plugin through 4.0.1 does not verify the... |
medium | 5.3 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-103332 The Payex Payment Gateway for Woocommerce WordPress plugin through 1.2.10 does n... |
medium | 5.3 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-116840 llama.cpp b5854 before b11275 contains an integer overflow vulnerability in gguf... |
medium | 6.1 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-116841 DevilutionX 1.4.0 through 1.5.5 contains an out-of-bounds read vulnerability in... |
medium | 5.5 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-116842 DevilutionX 1.4.0 through 1.5.5 contains a heap buffer overflow vulnerability in... |
medium | 6.1 | — | — | 2026-10-27 | 2026-10-31 |
| CVE-2026-116844 Fclairamb ftpserverlib through 0.32.4 contains a cleartext transmission vulnerab... |
medium | 4.8 | — | — | 2026-10-27 | 2026-10-29 |
| CVE-2026-116829 llama.cpp b10398 before b11301 contains an integer overflow vulnerability in ggu... |
medium | 6.6 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-116605 A vulnerability was found in SourceCodester Online Food Ordering System 1.0. |
medium | 5.3 | — | — | 2026-10-27 | 2026-10-31 |
| CVE-2026-116608 A security vulnerability has been detected in DAMO Academy VideoLLaMA2 up to 1.1... |
medium | 5.4 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2025-71439 llama.cpp before b5649 contains a heap out-of-bounds read vulnerability in llama... |
medium | 5.5 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2024-58399 llama.cpp before b2731 contains an out-of-bounds read vulnerability in llama_mod... |
medium | 6.1 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-116826 YesWiki before 4.7.0 contains a server-side request forgery vulnerability in Dup... |
medium | 6.8 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-116827 YesWiki before 4.7.0 contains a server-side request forgery vulnerability in the... |
medium | 6.8 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-116828 YesWiki before 4.7.0 contains a sql injection vulnerability in despam.php where... |
medium | 4.9 | — | — | 2026-10-27 | 2026-10-31 |
| CVE-2026-116822 YesWiki before 4.7.0 contains a path traversal vulnerability in BazarListeAction... |
medium | 5.3 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-116823 YesWiki before 4.7.0 contains a reflected cross-site scripting vulnerability tha... |
medium | 6.1 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-116824 YesWiki before 4.7.0 contains a stored cross-site scripting vulnerability in han... |
medium | 6.1 | — | — | 2026-10-27 | 2026-10-31 |
| CVE-2026-116825 YesWiki from 4.6.2 before 4.7.0 lacks replay protection in HttpSignatureService:... |
medium | 6.5 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-116820 YesWiki from 4.6.0 before 4.7.0 contains an information disclosure vulnerability... |
medium | 5.3 | — | — | 2026-10-27 | 2026-10-31 |
| CVE-2026-116821 YesWiki before 4.7.0 contains a read-ACL bypass in AclService::updateRequestWith... |
medium | 6.5 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-116814 OpenPanel before 3.0.0 contains an information exposure vulnerability that write... |
medium | 6.5 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-116815 OpenPanel before 3.0.0 contains an improper escaping vulnerability in sankey.ser... |
medium | 4.3 | — | — | 2026-10-27 | 2026-10-31 |
| CVE-2026-116817 OpenPanel before 3.0.0 contains a missing authentication vulnerability that allo... |
medium | 6.5 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-116812 OpenPanel before 3.0.0 contains a sql injection vulnerability in profileColumnAc... |
medium | 6.5 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-116813 OpenPanel before 3.0.0 contains an sql injection vulnerability in ConversionServ... |
medium | 6.5 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-116807 OpenPanel before 3.0.0 contains an sql injection vulnerability that allows authe... |
medium | 6.5 | — | — | 2026-10-27 | 2026-10-31 |
| CVE-2026-116809 OpenPanel before 3.0.0 contains a missing authorization vulnerability in the eve... |
medium | 5.3 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-116810 OpenPanel before 3.0.0 contains a missing authorization vulnerability that allow... |
medium | 5.3 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-116804 DOMPurify from 3.4.4 before 3.4.17 contains a SAFE_FOR_TEMPLATES bypass that let... |
medium | 6.1 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-116805 OpenPanel before 3.0.0 contains an information disclosure vulnerability that all... |
medium | 4.3 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-116806 OpenPanel before 3.0.0 contains a missing authorization vulnerability in the onb... |
medium | 5.4 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-116800 WWBN AVideo before 29.5.0 contains a local file inclusion vulnerability that all... |
medium | 6.2 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-116801 Parse Server before 8.6.105 and 9.0.0 before 9.10.5-alpha.6 does not validate th... |
medium | 4.3 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-116802 DOMPurify before 3.4.17 contains a cross-site scripting vulnerability that allow... |
medium | 6.1 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-116803 DOMPurify before 3.4.17 contains a cross-site scripting vulnerability that allow... |
medium | 6.1 | — | — | 2026-10-27 | 2026-10-31 |
| CVE-2026-116603 A flaw has been found in SourceCodester Online Food Ordering System 1.0. |
medium | 4.7 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-116604 A vulnerability has been found in SourceCodester Online Food Ordering System 1.0... |
medium | 6.5 | — | — | 2026-10-27 | 2026-10-27 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.