October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,479
Critical
1,340
High
5,872
Medium
6,263
Low
649
Severity not reported
3,355
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1307), google (756), oracle (156), ibm (140), adobe (138), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-116069 NiubiGEO before 0.3.2 contains an unauthenticated server-side request forgery vu... |
medium | 6.5 | — | — | 2026-10-25 | 2026-10-26 |
| CVE-2026-116070 Docker-Proxy through 5.1.9 contains a missing authentication vulnerability in th... |
medium | 6.5 | — | — | 2026-10-25 | 2026-10-29 |
| CVE-2026-116071 rotki before 1.44.2 contains a weak key derivation vulnerability that allows att... |
medium | 5.9 | — | — | 2026-10-25 | 2026-10-29 |
| CVE-2026-116072 Infinity for Reddit through 8.3.4 contains a login cross-site request forgery vu... |
medium | 5.4 | — | — | 2026-10-25 | 2026-10-26 |
| CVE-2026-116073 Leon before commit 50df142 contains a path traversal vulnerability in getModelFi... |
medium | 6.5 | — | — | 2026-10-25 | 2026-10-26 |
| CVE-2026-116066 Firecrawl before 2.11.586 contains a server-side request forgery vulnerability i... |
medium | 6.8 | — | — | 2026-10-25 | 2026-10-29 |
| CVE-2026-116047 A vulnerability has been found in Privoce Vocechat up to 0.9.121. |
medium | 4.3 | — | — | 2026-10-25 | 2026-10-29 |
| CVE-2026-116046 A flaw has been found in eventcatalog sdk up to 2.29.0. |
medium | 5.3 | — | — | 2026-10-25 | 2026-10-26 |
| CVE-2026-116045 A vulnerability was detected in 1999AZZAR designer-mcp up to 2.1.0. |
medium | 4.3 | — | — | 2026-10-25 | 2026-10-29 |
| CVE-2026-94295 The Chikkili- Google Pay India for Woocommerce WordPress plugin through 1.0.6 do... |
medium | 5.3 | — | — | 2026-10-25 | 2026-10-26 |
| CVE-2026-116044 A security vulnerability has been detected in prasathmani TinyFileManager up to... |
medium | 6.3 | — | — | 2026-10-25 | 2026-10-29 |
| CVE-2026-110285 The WP Stripe Checkout WordPress plugin before 1.2.2.62 does not verify the Stri... |
medium | 5.3 | — | — | 2026-10-25 | 2026-10-26 |
| CVE-2026-111976 The GiveWP WordPress plugin before 4.19.0.1 does not perform any status or capab... |
medium | 5.3 | — | — | 2026-10-25 | 2026-10-26 |
| CVE-2026-111978 The GiveWP WordPress plugin before 4.19.0.1 does not properly validate a user-su... |
medium | 6.0 | — | — | 2026-10-25 | 2026-10-26 |
| CVE-2026-111979 The GiveWP WordPress plugin before 4.19.0.1 does not properly sanitise and escap... |
medium | 6.8 | — | — | 2026-10-25 | 2026-10-26 |
| CVE-2026-111980 The GiveWP WordPress plugin before 4.19.0.1 does not correctly determine which p... |
medium | 5.5 | — | — | 2026-10-25 | 2026-10-26 |
| CVE-2026-114740 The WPVR WordPress plugin before 9.1.3 does not correctly check user capabilitie... |
medium | 4.9 | — | — | 2026-10-25 | 2026-10-26 |
| CVE-2026-115997 A flaw has been found in pig-mesh pig up to 4.1.0. |
medium | 6.3 | — | — | 2026-10-25 | 2026-10-29 |
| CVE-2026-115982 A vulnerability was detected in phpIPAM up to 1.8.3. |
medium | 4.3 | — | — | 2026-10-24 | 2026-10-29 |
| CVE-2026-115971 A vulnerability was found in Travisun Opptrix 0.4.0. |
medium | 5.3 | — | — | 2026-10-24 | 2026-10-26 |
| CVE-2026-115972 A vulnerability was determined in FaveoSuite Faveo Helpdesk up to 2.0.3. |
medium | 5.3 | — | — | 2026-10-24 | 2026-10-29 |
| CVE-2026-114192 Missing Authorization vulnerability in Magepeople inc. |
medium | 6.5 | — | — | 2026-10-24 | 2026-10-26 |
| CVE-2026-116017 Xiaozhi-esp32-server before 0.9.8 contains an insecure direct object reference v... |
medium | 4.3 | — | — | 2026-10-24 | 2026-10-29 |
| CVE-2026-116018 ONEARMY community-platform before 2.165.2 contains an insecure direct object ref... |
medium | 4.3 | — | — | 2026-10-24 | 2026-10-29 |
| CVE-2026-116020 BookStack before 26.09.2 contains an incorrect authorization vulnerability in At... |
medium | 5.4 | — | — | 2026-10-24 | 2026-10-26 |
| CVE-2026-116015 yudao-cloud through 2026.09 contains an insecure direct object reference vulnera... |
medium | 4.3 | — | — | 2026-10-24 | 2026-10-26 |
| CVE-2026-116008 DaybydayCRM through 2.2.1 contains a missing authorization vulnerability in Proj... |
medium | 4.3 | — | — | 2026-10-24 | 2026-10-26 |
| CVE-2026-116010 RosarioSIS before 12.9.1 contains a missing authorization vulnerability that all... |
medium | 4.3 | — | — | 2026-10-24 | 2026-10-29 |
| CVE-2026-114705 Missing Authorization vulnerability in quadlayers WP Social Feed Gallery insta-g... |
medium | 6.5 | — | — | 2026-10-24 | 2026-10-26 |
| CVE-2026-115994 BOLA Allows Cross-Project Target Tampering
in Cervantes version v1.3-beta could... |
medium | 5.4 | — | — | 2026-10-24 | 2026-10-26 |
| CVE-2026-115998 IDOR in Cervantes version v1.3-beta could allow an authenticated attacker ca acc... |
medium | 4.3 | — | — | 2026-10-24 | 2026-10-26 |
| CVE-2026-114194 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-24 | 2026-10-26 |
| CVE-2026-115993 Stored XSS vulnerability in the “Notes” field of the Checklists in Cervantes ver... |
medium | 6.8 | — | — | 2026-10-24 | 2026-10-26 |
| CVE-2026-114693 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-24 | 2026-10-26 |
| CVE-2026-114190 Insertion of Sensitive Information Into Sent Data vulnerability in Hai Zheng / L... |
medium | 5.9 | — | — | 2026-10-24 | 2026-10-26 |
| CVE-2026-110892 Missing Authorization vulnerability in Brainstorm Force SureDash suredash allows... |
medium | 6.5 | — | — | 2026-10-24 | 2026-10-26 |
| CVE-2026-115802 A weakness has been identified in InternScience InternAgent 1.5.0. |
medium | 4.3 | — | — | 2026-10-24 | 2026-10-29 |
| CVE-2026-115803 A flaw has been found in Scada-LTS 2.8.0. |
medium | 4.3 | — | — | 2026-10-24 | 2026-10-26 |
| CVE-2026-108013 BigFix Platform uses Mozilla CA certificate bundle (PEM). |
medium | 6.8 | — | — | 2026-10-24 | 2026-10-26 |
| CVE-2026-114429 The WPVR WordPress plugin before 9.0.3 does not properly sanitise and escape som... |
medium | 6.8 | — | — | 2026-10-24 | 2026-10-26 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.