October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,479
Critical
1,340
High
5,872
Medium
6,263
Low
649
Severity not reported
3,355
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1307), google (756), oracle (156), ibm (140), adobe (138), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-109926 The Productive Commerce WordPress plugin before 1.1.49 does not perform a capabi... |
medium | 4.3 | — | — | 2026-10-21 | 2026-10-21 |
| CVE-2026-110514 The WPZOOM Portfolio Lite WordPress plugin before 1.4.34 does not check that a u... |
medium | 4.9 | — | — | 2026-10-21 | 2026-10-21 |
| CVE-2026-110651 The Swift Performance Lite WordPress plugin before 2.3.7.4 does not properly san... |
medium | 6.8 | — | — | 2026-10-21 | 2026-10-21 |
| CVE-2026-105992 The Ettrick Escape Room Booking WordPress plugin before 1.3.1 does not verify a... |
medium | 5.3 | — | — | 2026-10-21 | 2026-10-21 |
| CVE-2026-105996 The Booking Package WordPress plugin before 1.7.31 does not generate booking can... |
medium | 4.8 | — | — | 2026-10-21 | 2026-10-21 |
| CVE-2026-105998 The Booking Package WordPress plugin before 1.7.31 does not perform any authoriz... |
medium | 5.3 | — | — | 2026-10-21 | 2026-10-21 |
| CVE-2026-105999 The Booking Package WordPress plugin before 1.7.31 does not perform authorizatio... |
medium | 5.3 | — | — | 2026-10-21 | 2026-10-21 |
| CVE-2026-106932 The Moloni WordPress plugin before 5.0.14 does not perform capability or nonce c... |
medium | 6.5 | — | — | 2026-10-21 | 2026-10-21 |
| CVE-2026-107128 The Uncanny Toolkit for LearnDash WordPress plugin before 3.8.2 does not verify... |
medium | 5.0 | — | — | 2026-10-21 | 2026-10-21 |
| CVE-2026-103302 The Payment Gateway for Idram WordPress plugin before 2.1.6 does not verify the... |
medium | 5.3 | — | — | 2026-10-21 | 2026-10-21 |
| CVE-2026-100145 The Synchrony Financing WordPress plugin before 1.1.2 does not properly authoris... |
medium | 6.5 | — | — | 2026-10-21 | 2026-10-21 |
| CVE-2026-92823 A flaw was found in libmodulemd. |
medium | 6.2 | — | — | 2026-10-21 | 2026-10-30 |
| CVE-2026-92824 A flaw was found in libmodulemd. |
medium | 6.2 | — | — | 2026-10-21 | 2026-10-30 |
| CVE-2026-92822 A flaw was found in libmodulemd. |
medium | 6.2 | — | — | 2026-10-21 | 2026-10-30 |
| CVE-2026-114039 A weakness has been identified in projectworlds Advanced Library Management Syst... |
medium | 6.3 | — | — | 2026-10-21 | 2026-10-21 |
| CVE-2026-113743 A weakness has been identified in Tenstorrent tt-metal up to 0.80.0. |
medium | 6.3 | — | — | 2026-10-21 | 2026-10-27 |
| CVE-2026-114117 Vyper 0.3.8 through 0.5.0b1 contains an optimizer miscompilation in which (msg.v... |
medium | 5.9 | — | — | 2026-10-21 | 2026-10-22 |
| CVE-2026-114118 Vyper 0.3.4 through 0.5.0b1 computes the remaining blueprint size in create_from... |
medium | 4.8 | — | — | 2026-10-21 | 2026-10-27 |
| CVE-2026-114110 Astral uv before 0.11.6 contains a path traversal vulnerability that allows atta... |
medium | 5.3 | — | — | 2026-10-21 | 2026-10-22 |
| CVE-2026-114114 Vyper 0.1.0b1 before 0.1.0b12, 0.1.0b14, and 0.4.1 through 0.5.0b1 mix character... |
medium | 5.3 | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2026-114116 Vyper 0.1.0b1 before 0.1.0b17 and 0.4.1 through 0.5.0b1 builds its source-line t... |
medium | 5.3 | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2026-114103 adm-zip 0.6.0 contains a decompression bomb protection bypass that allows attack... |
medium | 5.3 | — | — | 2026-10-21 | 2026-10-27 |
| CVE-2026-114104 adm-zip before 0.6.1 contains an inconsistent entry resolution vulnerability tha... |
medium | 5.9 | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2026-114105 Adm-zip before 0.6.1 contains an incorrect permission assignment vulnerability t... |
medium | 6.2 | — | — | 2026-10-21 | 2026-10-21 |
| CVE-2026-114099 Coraza from 3.0.0 before 3.8.1 has a JSON body processor that flattens nested pr... |
medium | 5.8 | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2026-114100 Coraza from 3.0.4 before 3.8.1 contains a request body inspection bypass because... |
medium | 5.8 | — | — | 2026-10-21 | 2026-10-22 |
| CVE-2026-114101 Coraza before 3.8.1 extracts multipart upload filenames with Go's mime.ParseMedi... |
medium | 4.0 | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2026-114091 Trigger.dev before 4.5.0 looks up runs by friendlyId alone in the api.v1.runs.$r... |
medium | 5.3 | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2026-114092 Trigger.dev before 4.5.0 performs no authentication or organization check in the... |
medium | 6.5 | — | — | 2026-10-21 | 2026-10-22 |
| CVE-2026-114093 Trigger.dev before 4.5.6 contains a cross-site request forgery vulnerability tha... |
medium | 4.3 | — | — | 2026-10-21 | 2026-10-27 |
| CVE-2026-114095 Dulwich before 1.2.9 contains a denial of service vulnerability in Pack.resolve_... |
medium | 6.5 | — | — | 2026-10-21 | 2026-10-21 |
| CVE-2026-114086 Trigger.dev before 4.5.5 contains a missing authentication vulnerability in the... |
medium | 5.3 | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2026-114088 Trigger.dev before 4.5.4 contains a hardcoded default secret vulnerability in th... |
medium | 6.5 | — | — | 2026-10-21 | 2026-10-27 |
| CVE-2026-114079 Trigger.dev before 4.5.6 contains an improper authorization vulnerability that a... |
medium | 5.4 | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2026-114080 Trigger.dev before 4.5.2 contains a blind server-side request forgery vulnerabil... |
medium | 5.0 | — | — | 2026-10-21 | 2026-10-21 |
| CVE-2026-114072 The Trigger.dev webapp before 4.5.12 contains a cross-site request forgery vulne... |
medium | 4.3 | — | — | 2026-10-21 | 2026-10-22 |
| CVE-2026-114073 Trigger.dev CLI before 4.5.9 contains an information disclosure vulnerability th... |
medium | 5.5 | — | — | 2026-10-21 | 2026-10-27 |
| CVE-2026-114074 Trigger.dev before 4.5.10 contains a server-side request forgery vulnerability t... |
medium | 5.4 | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2026-114075 Trigger.dev before 4.5.12 contains an authorization bypass vulnerability that al... |
medium | 5.4 | — | — | 2026-10-21 | 2026-10-21 |
| CVE-2026-114076 Trigger.dev before 4.5.2 contains a blind server-side request forgery vulnerabil... |
medium | 5.4 | — | — | 2026-10-21 | 2026-10-28 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.