October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,479
Critical
1,340
High
5,872
Medium
6,263
Low
649
Severity not reported
3,355
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1307), google (756), oracle (156), ibm (140), adobe (138), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-93638 A reflected cross-site scripting vulnerability in the login page of Zimbra Colla... |
medium | 6.1 | — | Synacor / zimbra collaboration suite | 2026-10-23 | 2026-10-28 |
| CVE-2026-57207 NetBox MCP Server is a simple read-only Model Context Protocol server for NetBox... |
medium | 5.9 | — | — | 2026-10-23 | 2026-10-30 |
| CVE-2026-93627 An organizer authentication vulnerability in the email calendar processing of Zi... |
medium | 5.3 | — | — | 2026-10-23 | 2026-10-28 |
| CVE-2026-93628 An attendee authentication vulnerability in the email calendar processing of Zim... |
medium | 5.3 | — | — | 2026-10-23 | 2026-10-28 |
| CVE-2026-93629 An organizer authentication vulnerability in Zimbra Collaboration Suite (ZCS) al... |
medium | 5.3 | — | — | 2026-10-23 | 2026-10-28 |
| CVE-2026-93630 A hostname canonicalization vulnerability in the email HTML sanitizers of Zimbra... |
medium | 4.3 | — | — | 2026-10-23 | 2026-10-28 |
| CVE-2026-55606 odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. |
medium | 6.5 | — | — | 2026-10-23 | 2026-10-29 |
| CVE-2026-115479 baserCMS is a website development framework. |
medium | 5.3 | — | — | 2026-10-23 | 2026-10-30 |
| CVE-2026-115480 baserCMS is a website development framework. |
medium | 5.3 | — | — | 2026-10-23 | 2026-10-29 |
| CVE-2026-115754 serialize-javascript from 7.0.1 before 7.1.3 contains a cross-site scripting vul... |
medium | 4.7 | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-115785 An SMTP command injection vulnerability in the data-source testing functionality... |
medium | 4.3 | — | — | 2026-10-23 | 2026-10-29 |
| CVE-2026-115786 A mailbox quota-accounting vulnerability in Zimbra Collaboration Suite (ZCS) all... |
medium | 6.5 | — | — | 2026-10-23 | 2026-10-28 |
| CVE-2026-114623 baserCMS is a website development framework. |
medium | 6.5 | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-115752 Signal K Server from 2.28.0-beta.2 before 2.34.0 contains a server-side request... |
medium | 4.2 | — | — | 2026-10-23 | 2026-10-29 |
| CVE-2026-55190 Event Schedule is an open-source platform to share events, sell tickets and brin... |
medium | 6.5 | — | — | 2026-10-23 | 2026-10-29 |
| CVE-2026-55422 conda-forge is a GitHub organization containing repositories of conda recipes. |
medium | 4.6 | — | — | 2026-10-23 | 2026-10-29 |
| CVE-2026-115729 @pdfme/common from 5.5.10 before 6.2.6 contains a server-side request forgery vu... |
medium | 6.8 | — | — | 2026-10-23 | 2026-10-29 |
| CVE-2026-94263 The Advanced Custom Fields: Extended and Advanced Custom Fields: Extended PRO Wo... |
medium | 4.8 | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-115725 Chatwoot before 4.17.0 contains an authorization bypass vulnerability that allow... |
medium | 4.2 | — | — | 2026-10-23 | 2026-10-29 |
| CVE-2026-115722 RPly through 1.1.4 contains an improper array index validation vulnerability in... |
medium | 6.1 | — | — | 2026-10-23 | 2026-10-29 |
| CVE-2026-111965 The Profile Builder WordPress plugin from 4.0.0 to 4.0.4 does not enforce its re... |
medium | 4.3 | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-112821 Missing Authorization vulnerability in Knit Pay Knit Pay knit-pay allows Exploit... |
medium | 6.5 | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-112825 Missing Authorization vulnerability in Magepeople inc. |
medium | 6.5 | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-63243 An
authentication vulnerability in the Bluetooth Low Energy (BLE) implementation... |
medium | 4.3 | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-94264 The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced C... |
medium | 6.8 | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-112219 The Download Monitor WordPress plugin before 5.3.5 does not correctly restrict m... |
medium | 4.9 | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-113472 The Depicter — Popup & Slider Builder WordPress plugin before 4.8.2 does not pro... |
medium | 5.4 | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-109933 The Otter Blocks WordPress plugin before 3.2.8 does not properly sanitize and es... |
medium | 6.8 | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-109934 The Otter Blocks WordPress plugin before 3.2.8 does not correctly determine whet... |
medium | 5.3 | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-109935 The Otter Blocks WordPress plugin before 3.2.8 does not enforce its block visibi... |
medium | 5.3 | — | — | 2026-10-23 | 2026-10-24 |
| CVE-2026-111738 The Speed Optimizer WordPress plugin before 7.8.5 does not verify network-level... |
medium | 5.5 | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-111966 The User Profile Builder WordPress plugin before 4.0.5 does not sanitise and esc... |
medium | 6.8 | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-86020 Part-DB is an open source inventory management system for electronic components. |
medium | 4.6 | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-59188 Part-DB is an open source inventory management system for electronic components. |
medium | 5.4 | — | — | 2026-10-23 | 2026-10-29 |
| CVE-2026-89419 OpenStack Ironic before 39.0.1 sometimes allows a user to change the maintenance... |
medium | 5.0 | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-90458 OpenStack Ironic before 39.0.1 allows DELETE and GET via vendor_passthru, e.g.,... |
medium | 5.4 | — | — | 2026-10-23 | 2026-10-29 |
| CVE-2026-54631 Part-DB is an open source inventory management system for electronic components. |
medium | 6.3 | — | — | 2026-10-23 | 2026-10-29 |
| CVE-2026-115638 OpenStack Ironic through 39.0.1 allows a denial of service via a configdrive tha... |
medium | 4.3 | — | — | 2026-10-23 | 2026-10-29 |
| CVE-2026-115536 A security flaw has been discovered in gedelumbung HospitalManagement up to c2d4... |
medium | 4.3 | — | — | 2026-10-23 | 2026-10-29 |
| CVE-2026-115537 A weakness has been identified in gedelumbung HospitalManagement up to c2d455437... |
medium | 4.3 | — | — | 2026-10-23 | 2026-10-23 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.