October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,479
Critical
1,340
High
5,872
Medium
6,263
Low
649
Severity not reported
3,355
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1307), google (756), oracle (156), ibm (140), adobe (138), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-13411 Mattermost versions 11.7.x <= 11.7.11 fail to validate null elements when decodi... |
medium | 4.3 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-115326 QloApps through 1.7.0 contains an insecure direct object reference vulnerability... |
medium | 5.4 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-115327 libyang through 6.4.13 contains an uninitialized pointer free vulnerability in l... |
medium | 5.3 | — | — | 2026-10-22 | 2026-10-29 |
| CVE-2026-115207 A flaw was found in GNU patch. |
medium | 5.5 | — | — | 2026-10-22 | 2026-10-28 |
| CVE-2026-115321 Bytebase before 3.16.0 contains an authorization bypass vulnerability in the Upd... |
medium | 4.3 | — | — | 2026-10-22 | 2026-10-23 |
| CVE-2026-115322 Bytebase before 3.16.0 contains an authorization bypass vulnerability in GetTask... |
medium | 4.3 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-114665 Goploy 1.18.0 before 1.18.1 contains a link following vulnerability in the /depl... |
medium | 6.5 | — | — | 2026-10-22 | 2026-10-29 |
| CVE-2026-112842 Missing Authorization vulnerability in Cozmoslabs Paid Member Subscriptions paid... |
medium | 6.5 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2024-58394 Retool before 3.88.0 contains a cross-site scripting vulnerability that allows u... |
medium | 6.1 | — | — | 2026-10-22 | 2026-10-29 |
| CVE-2022-51025 Penta Security WAPPLES 4.0.54.1, 5.0, and 6.0 contains a path traversal vulnerab... |
medium | 6.5 | — | — | 2026-10-22 | 2026-10-23 |
| CVE-2023-54413 WPML Multilingual CMS plugin for WordPress before 4.6.1 contains a reflected cro... |
medium | 6.1 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2020-37284 Sickbeard through build-507 contains a reflected cross-site scripting vulnerabil... |
medium | 6.1 | — | — | 2026-10-22 | 2026-10-28 |
| CVE-2017-20290 Discourse 1.9.0.beta2 before 1.9.0.beta13 contains a reflected cross-site script... |
medium | 6.1 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2017-20288 QCubed 2.2.0 through 3.1.1 contains a reflected cross-site scripting vulnerabili... |
medium | 6.1 | — | — | 2026-10-22 | 2026-10-29 |
| CVE-2026-114348 webpack-dev-server is a development server that provides live reloading for webp... |
medium | 5.3 | — | Webpack.js / webpack-dev-server | 2026-10-22 | 2026-10-29 |
| CVE-2026-114703 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-114195 Insertion of Sensitive Information into Externally-Accessible File or Directory... |
medium | 5.3 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-114696 Missing Authorization vulnerability in miniOrange Page Restriction WordPress (WP... |
medium | 5.3 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-114698 Authorization Bypass Through User-Controlled Key vulnerability in myCred myCred... |
medium | 5.4 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-114699 Missing Authorization vulnerability in yoomoney ЮKassa для WooCommerce yookassa... |
medium | 5.3 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-114700 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-114701 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-114702 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-112218 Missing Authorization vulnerability in Ahmad Majestic Support majestic-support a... |
medium | 5.3 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-112311 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') v... |
medium | 6.5 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-112845 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-110893 Missing Authorization vulnerability in Brainstorm Force SureDash suredash allows... |
medium | 5.3 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-110894 Missing Authorization vulnerability in Brainstorm Force SureDash suredash allows... |
medium | 5.3 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-111842 Missing Authorization vulnerability in WP Sunshine Sunshine Photo Cart sunshine-... |
medium | 5.3 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-114180 Missing Authorization vulnerability in Wpmet Metform metform allows Exploiting I... |
medium | 5.3 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-114182 Missing Authorization vulnerability in IdeaBox Creations PowerPack Addons for El... |
medium | 4.3 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-114184 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-114458 A flaw was found in mod_qos. |
medium | 5.9 | — | — | 2026-10-22 | 2026-10-26 |
| CVE-2026-114460 A flaw was found in mod_qos. |
medium | 5.3 | — | — | 2026-10-22 | 2026-10-30 |
| CVE-2026-111847 Missing Authorization vulnerability in Kings Plugins MarketKing marketking-multi... |
medium | 5.4 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-112826 Missing Authorization vulnerability in eLightUp Falcon – WordPress Optimizations... |
medium | 5.3 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-112843 Missing Authorization vulnerability in WP Chill Strong Testimonials strong-testi... |
medium | 4.3 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-112867 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-114175 Missing Authorization vulnerability in DigitalME eRoom eroom-zoom-meetings-webin... |
medium | 5.4 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-103634 Out-of-bounds read and write in the Count-Min sketch deserialization of Apache D... |
medium | 5.3 | — | — | 2026-10-22 | 2026-10-26 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.