October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,479
Critical
1,340
High
5,872
Medium
6,263
Low
649
Severity not reported
3,355
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1307), google (756), oracle (156), ibm (140), adobe (138), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-114395 Trudesk through 1.2.11 contains an authorization bypass vulnerability in apiMess... |
medium | 4.3 | — | Trudesk Project / trudesk | 2026-10-21 | 2026-10-30 |
| CVE-2026-114398 Trudesk through 1.2.11 contains an unrestricted file upload vulnerability that a... |
medium | 5.4 | — | Trudesk Project / trudesk | 2026-10-21 | 2026-10-29 |
| CVE-2026-114388 Chamilo LMS 2.0.0 pre-releases from 2.0.0-alpha.1 before 2.0.0-RC.3 contain a mi... |
medium | 5.3 | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2026-114389 Chamilo LMS from 2.0.0-alpha.4 before 2.0.0-RC.3 contains a missing authorizatio... |
medium | 4.3 | — | — | 2026-10-21 | 2026-10-22 |
| CVE-2026-114390 Chamilo LMS from 2.0.0-alpha.1 before 2.0.0-RC.3 contains a missing authorizatio... |
medium | 5.3 | — | — | 2026-10-21 | 2026-10-22 |
| CVE-2026-114392 Trudesk through 1.2.11 contains an authorization bypass vulnerability that allow... |
medium | 5.3 | — | Trudesk Project / trudesk | 2026-10-21 | 2026-10-30 |
| CVE-2026-114393 Trudesk through 1.2.11 contains an authorization bypass vulnerability that allow... |
medium | 4.3 | — | Trudesk Project / trudesk | 2026-10-21 | 2026-10-30 |
| CVE-2026-114248 A security vulnerability has been detected in dhikshitha29 Insurance-Management-... |
medium | 5.3 | — | — | 2026-10-21 | 2026-10-21 |
| CVE-2026-114386 Pydantic AI Harness before 0.59.0 fails to enforce UsageLimits.tool_calls_limit... |
medium | 4.8 | — | — | 2026-10-21 | 2026-10-22 |
| CVE-2026-111849 Missing Authorization vulnerability in Magepeople inc. |
medium | 5.3 | — | — | 2026-10-21 | 2026-10-21 |
| CVE-2026-114120 SchedulePress before 5.3.5 contains a missing authorization vulnerability that a... |
medium | 5.4 | — | — | 2026-10-21 | 2026-10-22 |
| CVE-2026-66392 Apache bRPC versions before 1.18.0 validate the server certificate chain when cl... |
medium | 5.9 | — | — | 2026-10-21 | 2026-10-30 |
| CVE-2026-96405 NLnet Labs Unbound up to and including version 1.26.1 limits compression-pointer... |
medium | 5.3 | — | — | 2026-10-21 | 2026-10-29 |
| CVE-2026-14556 The HappyForms WordPress plugin before 1.26.15 does not sanitise or escape a use... |
medium | 5.4 | — | — | 2026-10-21 | 2026-10-21 |
| CVE-2026-50106 When NLnet Labs Unbound up to and including version 1.26.1 is configured with bo... |
medium | 6.5 | — | — | 2026-10-21 | 2026-10-29 |
| CVE-2026-105256 The LatePoint WordPress plugin before 5.7.5 does not validate the client-supplie... |
medium | 5.3 | — | — | 2026-10-21 | 2026-10-21 |
| CVE-2026-107447 The Contest Gallery WordPress plugin before 34.0.1 does not reliably validate th... |
medium | 5.3 | — | — | 2026-10-21 | 2026-10-21 |
| CVE-2026-109125 In NLnet Labs Unbound up to and including version 1.26.1, an observable cache-le... |
medium | 5.3 | — | — | 2026-10-21 | 2026-10-29 |
| CVE-2026-101138 The CMP – Coming Soon & Maintenance WordPress plugin before 4.1.21 does not corr... |
medium | 5.3 | — | — | 2026-10-21 | 2026-10-21 |
| CVE-2026-103301 The Payment Gateway for Telcell WordPress plugin before 2.0.5 does not verify th... |
medium | 5.3 | — | — | 2026-10-21 | 2026-10-21 |
| CVE-2026-104641 The Simple Shopping Cart WordPress plugin before 5.3.3 does not verify that a Pa... |
medium | 5.3 | — | — | 2026-10-21 | 2026-10-21 |
| CVE-2026-17557 A flaw was found in the `lm-evaluation-harness` component of Red Hat OpenShift A... |
medium | 6.5 | — | — | 2026-10-21 | 2026-10-22 |
| CVE-2026-93856 In OpenStack Cinder through 29.0.0, cross-project information disclosure can occ... |
medium | 4.3 | — | — | 2026-10-21 | 2026-10-22 |
| CVE-2026-86611 The Download Manager WordPress plugin before 3.3.71, Download Manager WordPress... |
medium | 4.3 | — | — | 2026-10-21 | 2026-10-21 |
| CVE-2026-87837 The Wava Payment Plugin WordPress plugin before 0.3.10 does not verify the authe... |
medium | 5.3 | — | — | 2026-10-21 | 2026-10-21 |
| CVE-2026-87838 The Wava Payment Plugin WordPress plugin before 0.3.10 does not perform any auth... |
medium | 6.5 | — | — | 2026-10-21 | 2026-10-21 |
| CVE-2026-92999 The Click n Chat (Chat Widget Integration) WordPress plugin before 1.1.3 does no... |
medium | 5.3 | — | — | 2026-10-21 | 2026-10-21 |
| CVE-2026-81812 The Elementor Website Builder WordPress plugin before 4.3.5 does not sanitize up... |
medium | 6.4 | — | — | 2026-10-21 | 2026-10-21 |
| CVE-2026-81813 The Elementor Website Builder WordPress plugin before 4.3.5 does not sanitize th... |
medium | 6.8 | — | — | 2026-10-21 | 2026-10-21 |
| CVE-2026-110982 The AI Engine WordPress plugin before 3.8.6 does not check that the caller is al... |
medium | 4.9 | — | — | 2026-10-21 | 2026-10-21 |
| CVE-2026-111596 The Kliken: Ads + Pixel for Meta WordPress plugin before 1.2.3 does not verify t... |
medium | 5.3 | — | — | 2026-10-21 | 2026-10-21 |
| CVE-2026-111947 The Pricing Table WordPress Plugin WordPress plugin before 4.1.3 does not perfor... |
medium | 5.5 | — | — | 2026-10-21 | 2026-10-21 |
| CVE-2026-111955 The WholesaleX WordPress plugin before 3.0.9 does not check that a stored accoun... |
medium | 6.5 | — | — | 2026-10-21 | 2026-10-21 |
| CVE-2026-111956 The WholesaleX WordPress plugin before 3.0.9 does not protect or remove the user... |
medium | 5.9 | — | — | 2026-10-21 | 2026-10-21 |
| CVE-2026-111957 The SUMIT Payment Gateway for WooCommerce WordPress plugin before 4.0.0 does not... |
medium | 5.3 | — | — | 2026-10-21 | 2026-10-21 |
| CVE-2026-15261 The TI WooCommerce Wishlist WordPress plugin before 2.13.0 does not enforce the... |
medium | 5.3 | — | — | 2026-10-21 | 2026-10-21 |
| CVE-2026-107788 The SmartyParcel WordPress plugin before 1.23.4 does not perform authorisation c... |
medium | 4.3 | — | — | 2026-10-21 | 2026-10-21 |
| CVE-2026-107789 The SmartyParcel WordPress plugin before 1.23.4 does not perform authorisation c... |
medium | 5.3 | — | — | 2026-10-21 | 2026-10-21 |
| CVE-2026-107790 The HireZoot WordPress plugin before 4.1.1 does not sanitise and escape some of... |
medium | 6.8 | — | — | 2026-10-21 | 2026-10-21 |
| CVE-2026-108073 The SureCart WordPress plugin before 4.9.5 does not restrict which related objec... |
medium | 5.3 | — | — | 2026-10-21 | 2026-10-21 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.