October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,479
Critical
1,340
High
5,872
Medium
6,263
Low
649
Severity not reported
3,355
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1307), google (756), oracle (156), ibm (140), adobe (138), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-87835 The Front End Users WordPress plugin through 3.2.35 does not restrict which acco... |
medium | 6.5 | — | — | 2026-10-24 | 2026-10-26 |
| CVE-2026-97352 The News Kit Addons For Elementor WordPress plugin before 1.4.9 does not perform... |
medium | 4.3 | — | — | 2026-10-24 | 2026-10-26 |
| CVE-2026-97353 The News Kit Addons For Elementor WordPress plugin through 1.4.7 does not perfor... |
medium | 5.4 | — | — | 2026-10-24 | 2026-10-26 |
| CVE-2026-113489 The GeoDirectory WordPress plugin before 2.8.194 does not verify that a referenc... |
medium | 4.3 | — | — | 2026-10-24 | 2026-10-26 |
| CVE-2026-113490 The GeoDirectory WordPress plugin before 2.8.194 does not perform any status or... |
medium | 5.3 | — | — | 2026-10-24 | 2026-10-26 |
| CVE-2026-113491 The GeoDirectory WordPress plugin before 2.8.194 does not validate a user-suppli... |
medium | 6.4 | — | — | 2026-10-24 | 2026-10-26 |
| CVE-2026-113492 The GeoDirectory WordPress plugin before 2.8.194 does not perform status, owners... |
medium | 5.3 | — | — | 2026-10-24 | 2026-10-26 |
| CVE-2026-113493 The GeoDirectory WordPress plugin before 2.8.194 does not sanitise and escape so... |
medium | 6.8 | — | — | 2026-10-24 | 2026-10-26 |
| CVE-2026-107887 The Advanced Twenty Seventeen WordPress plugin through 1.3.1 does not perform an... |
medium | 5.4 | — | — | 2026-10-24 | 2026-10-26 |
| CVE-2026-107907 The MAS Videos WordPress plugin through 1.3.4 does not perform any capability or... |
medium | 6.5 | — | — | 2026-10-24 | 2026-10-26 |
| CVE-2026-105199 The Pixel Tag Manager for WooCommerce WordPress plugin before 2.2.3 does not per... |
medium | 6.8 | — | — | 2026-10-24 | 2026-10-26 |
| CVE-2026-115929 MongoDB Compass relies on Electron, a third-party runtime that carries its own T... |
medium | 6.8 | — | — | 2026-10-24 | 2026-10-26 |
| CVE-2026-115886 MLflow is an open source AI engineering platform for agents, large language mode... |
medium | 6.5 | — | — | 2026-10-23 | 2026-10-29 |
| CVE-2026-115801 A security flaw has been discovered in Kakao khaiii up to 0.4. |
medium | 5.3 | — | — | 2026-10-23 | 2026-10-29 |
| CVE-2026-75524 OpenReception's appointment booking software provides an end-to-end encrypted ap... |
medium | 5.4 | — | — | 2026-10-23 | 2026-10-29 |
| CVE-2026-75525 OpenReception's appointment booking software provides an end-to-end encrypted ap... |
medium | 5.3 | — | — | 2026-10-23 | 2026-10-30 |
| CVE-2026-115800 A vulnerability was identified in UbiquitousLearning mllm up to 2.0.2. |
medium | 5.3 | — | — | 2026-10-23 | 2026-10-26 |
| CVE-2026-115877 Twisted is an event-based framework for internet applications, supporting Python... |
medium | 5.4 | — | — | 2026-10-23 | 2026-10-29 |
| CVE-2026-115774 Twisted is an event-based framework for internet applications, supporting Python... |
medium | 4.9 | — | — | 2026-10-23 | 2026-10-29 |
| CVE-2026-79981 The DNS stub resolver in subsys/net/lib/dns/resolve.c binds one UDP socket per c... |
medium | 6.5 | — | — | 2026-10-23 | 2026-10-26 |
| CVE-2026-79980 The DHCPv4 client in subsys/net/lib/dhcpv4/dhcpv4.c maintained its transaction i... |
medium | 5.6 | — | — | 2026-10-23 | 2026-10-26 |
| CVE-2026-115796 A security flaw has been discovered in Tenda F6 12.02.01.73. |
medium | 4.3 | — | — | 2026-10-23 | 2026-10-29 |
| CVE-2026-115845 An incomplete list of disallowed inputs in the Python code validator of the run_... |
medium | 6.4 | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-115813 Server-side request forgery in the model download path in Amazon Web Services Mu... |
medium | 5.8 | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-106072 A flaw in Node.js TLS hostname verification allows a certificate with only a DNS... |
medium | 6.7 | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-106074 A flaw in Node.js `crypto` causes the internal entropy caches used by `crypto.ra... |
medium | 4.8 | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-105481 A flaw in Node.js HTTP Agent connection reuse can cause a client to accept as va... |
medium | 6.5 | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-55463 The Goobi viewer is a web application that allows digitised material to be displ... |
medium | 6.5 | — | — | 2026-10-23 | 2026-10-29 |
| CVE-2026-55465 The Goobi viewer is a web application that allows digitised material to be displ... |
medium | 5.3 | — | — | 2026-10-23 | 2026-10-29 |
| CVE-2026-49442 Cacti is an open source performance and fault management framework. |
medium | 5.3 | — | — | 2026-10-23 | 2026-10-30 |
| CVE-2026-55222 Isar is an integration system for automated root filesystem generation. |
medium | 5.1 | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-55442 The Goobi viewer is a web application that allows digitised material to be displ... |
medium | 5.3 | — | — | 2026-10-23 | 2026-10-29 |
| CVE-2026-55444 The Goobi viewer is a web application that allows digitised material to be displ... |
medium | 5.3 | — | — | 2026-10-23 | 2026-10-29 |
| CVE-2026-46346 The Goobi viewer is a web application that allows digitised material to be displ... |
medium | 6.5 | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-46347 The Goobi viewer is a web application that allows digitised material to be displ... |
medium | 6.8 | — | — | 2026-10-23 | 2026-10-29 |
| CVE-2026-46531 Cacti is an open source performance and fault management framework. |
medium | 5.5 | — | — | 2026-10-23 | 2026-10-29 |
| CVE-2026-112333 GFI Archiver before 15.14 contains a stored cross-site scripting vulnerability i... |
medium | 5.4 | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-93633 A CSS sanitization vulnerability in Zimbra Collaboration Suite (ZCS) allows an a... |
medium | 5.4 | — | Synacor / zimbra collaboration suite | 2026-10-23 | 2026-10-28 |
| CVE-2026-93634 A cross-account authorization vulnerability in Zimbra Collaboration Suite (ZCS)... |
medium | 4.3 | — | Synacor / zimbra collaboration suite | 2026-10-23 | 2026-10-28 |
| CVE-2026-93636 An LDAP filter injection vulnerability in Zimbra Collaboration Suite (ZCS) allow... |
medium | 4.3 | — | Synacor / zimbra collaboration suite | 2026-10-23 | 2026-10-28 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.