October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,479
Critical
1,340
High
5,872
Medium
6,263
Low
649
Severity not reported
3,355
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1307), google (756), oracle (156), ibm (140), adobe (138), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-115949 Missing Authorization vulnerability in WP Smart Widgets Better Post & Filter Wid... |
medium | 6.5 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-115958 Missing Authorization vulnerability in WP Discussion Board WP Discussion Board w... |
medium | 5.3 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-116254 A vulnerability was identified in rathena FluxCP up to 98cd4b8fd83228c11b36fb3d0... |
medium | 6.5 | — | — | 2026-10-26 | 2026-10-31 |
| CVE-2026-110377 Missing Authorization vulnerability in VillaTheme Bopo – WooCommerce Product Bun... |
medium | 5.3 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-112250 A vulnerability has been identified in
BRAIN2 versions up to and including versi... |
medium | 4.4 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-112865 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-114709 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-115602 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-115613 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-95663 Insufficient Session Expiration vulnerability in Apache Camel Keycloak component... |
medium | 4.8 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-95664 Improper Neutralization of Special Elements used in an Expression Language State... |
medium | 5.4 | — | Apache / camel | 2026-10-26 | 2026-10-28 |
| CVE-2026-82943 SOEM version 2.0.0 and earlier contains vulnerabilities where a malicious device... |
medium | 6.5 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-82945 SOEM version 2.0.0 and earlier contains a vulnerability during device configurat... |
medium | 6.5 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-82946 SOEM version 2.0.0 and earlier contains a vulnerability where a malicious device... |
medium | 6.5 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-95628 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') v... |
medium | 5.4 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-95629 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') v... |
medium | 5.4 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-110376 Missing Authorization vulnerability in VillaTheme DEPART depart-deposit-and-part... |
medium | 4.3 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-112828 Missing Authorization vulnerability in Meow Apps AI Engine ai-engine allows Expl... |
medium | 4.3 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-113438 Pleasanter provided fails to properly verify passwords in LDAP authentication wh... |
medium | 6.5 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-101259 Generation of Error Message Containing Sensitive Information vulnerability in Ap... |
medium | 5.3 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-116124 A security vulnerability has been detected in GNOME libgsf up to 1.14.60. |
medium | 6.3 | — | — | 2026-10-26 | 2026-10-29 |
| CVE-2026-116223 A flaw has been found in icret EasyImage up to 2.8.7. |
medium | 6.5 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-116224 A vulnerability has been found in fr0tt benotes up to 2.8.1. |
medium | 4.3 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-111974 The GiveWP WordPress plugin before 4.19.0.1 does not restrict the currency of a... |
medium | 5.3 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-103306 The Online Payments with iK Pay Gateway WordPress plugin before 3.0.4 does not p... |
medium | 5.3 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-103319 The OPay Payment Gateway for WooCommerce WordPress plugin through 2.5.5 does not... |
medium | 5.3 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-103381 The Mintpay for WooCommerce WordPress plugin through 2.2.3 does not verify the a... |
medium | 6.5 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-103298 The CCAvenue Payment Gateway for WooCommerce WordPress plugin through 3.1 does n... |
medium | 5.3 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-103299 The Payment Gateway WordPress plugin through 2.2.0 does not ensure a shared secr... |
medium | 5.3 | — | — | 2026-10-26 | 2026-10-30 |
| CVE-2026-103300 The Eurobank WooCommerce Payment Gateway WordPress plugin through 2.1.1 does not... |
medium | 5.3 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-116120 A vulnerability was determined in NocoDB up to 2026.07.0. |
medium | 5.6 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-116118 A vulnerability has been found in Z.ai Zcode up to 3.14.3/3.15.1. |
medium | 6.3 | — | — | 2026-10-26 | 2026-10-29 |
| CVE-2026-116119 A vulnerability was found in NocoDB up to 2026.08.0. |
medium | 5.5 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-116113 A security flaw has been discovered in GouGuOA up to 6.1.2. |
medium | 6.3 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-116109 A vulnerability has been found in continuedev Continue 2.0.0. |
medium | 6.3 | — | — | 2026-10-26 | 2026-10-29 |
| CVE-2026-116107 A vulnerability was detected in Datafeedr Product Sets Plugin up to 1.3.24 on Wo... |
medium | 5.4 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-116108 A flaw has been found in openbq-org OpenBB up to 4.7.2/5.0.0. |
medium | 4.3 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-116101 A vulnerability was found in itsourcecode Online Cake Ordering System 1.0. |
medium | 6.3 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-116102 A vulnerability was determined in QuantGeekDev docker-mcp 0.1.0/0.2.0. |
medium | 6.3 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-116103 A vulnerability was identified in Sony Neural Network Libraries up to 1.39.0. |
medium | 6.3 | — | — | 2026-10-26 | 2026-10-29 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.