October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,479
Critical
1,340
High
5,869
Medium
6,256
Low
648
Severity not reported
3,366
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1307), google (756), oracle (156), ibm (140), adobe (138), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-112016 Netcore NR256CN through 1.5.140116 contains an unauthenticated file write vulner... |
medium | 6.5 | — | — | 2026-10-18 | 2026-10-19 |
| CVE-2026-112017 JeecgBoot before 3.9.5 contains an sql injection vulnerability that allows authe... |
medium | 6.5 | — | — | 2026-10-18 | 2026-10-19 |
| CVE-2026-112019 cgltf through 1.15 contains a heap out-of-bounds read vulnerability in cgltf_acc... |
medium | 6.1 | — | — | 2026-10-18 | 2026-10-20 |
| CVE-2026-112007 Schism Tracker through 20260524 contains a heap out-of-bounds write vulnerabilit... |
medium | 6.1 | — | — | 2026-10-18 | 2026-10-19 |
| CVE-2026-112008 libmng through 2.0.3 contains a heap-based buffer overflow vulnerability in mng_... |
medium | 6.1 | — | — | 2026-10-18 | 2026-10-19 |
| CVE-2026-112009 smpeg through 2.0.0 contains a heap out-of-bounds read vulnerability in MPEGsyst... |
medium | 5.5 | — | — | 2026-10-18 | 2026-10-19 |
| CVE-2026-112010 smpeg through 2.0.0 contains an integer underflow vulnerability in stream_header... |
medium | 5.5 | — | — | 2026-10-18 | 2026-10-19 |
| CVE-2026-112011 libtta through 2.3 contains an integer overflow vulnerability in tta_decoder_ini... |
medium | 5.3 | — | — | 2026-10-18 | 2026-10-19 |
| CVE-2026-112012 libtta through 2.3 contains a stack out-of-bounds read and write vulnerability i... |
medium | 5.3 | — | — | 2026-10-18 | 2026-10-19 |
| CVE-2026-112002 ProjectSend 2.5.0 before 2.7.0 contains an unverified password change vulnerabil... |
medium | 6.8 | — | — | 2026-10-18 | 2026-10-19 |
| CVE-2026-112003 ProjectSend 2.0.0 before 2.7.0 contains a path validation flaw in OrphanFileScan... |
medium | 5.9 | — | — | 2026-10-18 | 2026-10-19 |
| CVE-2026-112006 OpenTelemetry opentelemetry-exporter-otlp-proto-http 1.5.0 before 1.45.0 contain... |
medium | 6.5 | — | — | 2026-10-18 | 2026-10-19 |
| CVE-2026-111984 A vulnerability has been found in AUTOMATIC1111 stable-diffusion-webui up to 1.1... |
medium | 4.3 | — | — | 2026-10-18 | 2026-10-19 |
| CVE-2026-111985 A vulnerability was found in AUTOMATIC1111 stable-diffusion-webui up to 1.10.1. |
medium | 4.3 | — | — | 2026-10-18 | 2026-10-19 |
| CVE-2026-110880 Missing Authorization vulnerability in Kit Kit (formerly ConvertKit) convertkit... |
medium | 6.5 | — | — | 2026-10-18 | 2026-10-19 |
| CVE-2026-110883 Authentication Bypass by Primary Weakness vulnerability in VideoWhisper.com 2Way... |
medium | 6.5 | — | — | 2026-10-18 | 2026-10-19 |
| CVE-2026-110885 Improper Control of Generation of Code ('Code Injection') vulnerability in HiveP... |
medium | 6.5 | — | — | 2026-10-18 | 2026-10-19 |
| CVE-2026-110365 Missing Authorization vulnerability in WPExperts Advanced File Manager file-mana... |
medium | 6.5 | — | — | 2026-10-18 | 2026-10-19 |
| CVE-2026-111877 A vulnerability was determined in dext34-morgan Books4Cash up to a8d3e357db75c07... |
medium | 4.3 | — | — | 2026-10-18 | 2026-10-22 |
| CVE-2026-111942 A weakness has been identified in hrisikeshpal Blood_Bank_Management_System 1.0.... |
medium | 4.3 | — | — | 2026-10-18 | 2026-10-19 |
| CVE-2026-87844 The PickPlugins Product Designer for WooCommerce WordPress plugin through 1.0.40... |
medium | 5.3 | — | — | 2026-10-18 | 2026-10-19 |
| CVE-2026-110032 The Salon Booking System WordPress plugin before 10.31.11 does not restrict whic... |
medium | 5.5 | — | — | 2026-10-18 | 2026-10-19 |
| CVE-2026-110033 The Salon Booking System WordPress plugin before 10.31.11 does not validate a us... |
medium | 6.8 | — | — | 2026-10-18 | 2026-10-19 |
| CVE-2026-110035 The Salon Booking System WordPress plugin before 10.31.11 does not restrict one... |
medium | 4.3 | — | — | 2026-10-18 | 2026-10-19 |
| CVE-2026-110069 The Modern Events Calendar Lite WordPress plugin before 7.37.0 does not perform... |
medium | 4.3 | — | — | 2026-10-18 | 2026-10-19 |
| CVE-2026-110070 The Modern Events Calendar Lite WordPress plugin before 7.36.4 does not verify t... |
medium | 6.5 | — | — | 2026-10-18 | 2026-10-19 |
| CVE-2026-110976 The AI Engine WordPress plugin before 3.7.9 does not check that the item passed... |
medium | 4.9 | — | — | 2026-10-18 | 2026-10-19 |
| CVE-2026-111041 The AI Engine WordPress plugin before 3.7.9 does not verify that the user perfor... |
medium | 4.9 | — | — | 2026-10-18 | 2026-10-19 |
| CVE-2026-110026 The Tasty Recipes Lite WordPress plugin before 1.2.11 does not correctly check u... |
medium | 4.9 | — | — | 2026-10-18 | 2026-10-19 |
| CVE-2026-109937 The Otter Blocks WordPress plugin before 3.2.3 does not validate that a user-sup... |
medium | 5.4 | — | — | 2026-10-18 | 2026-10-19 |
| CVE-2026-111876 A vulnerability was found in alexpasmantier television up to 0.15.9. |
medium | 5.3 | — | — | 2026-10-18 | 2026-10-19 |
| CVE-2026-111875 A vulnerability has been found in David-Crty Databasement up to 1.8.1. |
medium | 4.7 | — | — | 2026-10-18 | 2026-10-19 |
| CVE-2026-111870 A security flaw has been discovered in itsmeravitejak Online-Examination-System... |
medium | 5.3 | — | — | 2026-10-18 | 2026-10-19 |
| CVE-2026-111869 A vulnerability was identified in makeplane plane up to 1.4.2. |
medium | 5.3 | — | — | 2026-10-18 | 2026-10-22 |
| CVE-2026-111868 A vulnerability was determined in datastax pulsar-jms up to 9.0.3. |
medium | 6.3 | — | — | 2026-10-18 | 2026-10-19 |
| CVE-2026-111865 A security flaw has been discovered in THU-MIG yoloe up to 40cd606cabdbe2b566d6f... |
medium | 5.3 | — | — | 2026-10-17 | 2026-10-19 |
| CVE-2026-111931 Coder from 2.0.0 before 2.34.8 contains an open redirect vulnerability in handle... |
medium | 4.3 | — | — | 2026-10-17 | 2026-10-19 |
| CVE-2026-111928 Coder from 2.0.0 before 2.34.8 contains an incorrect authorization vulnerability... |
medium | 5.4 | — | — | 2026-10-17 | 2026-10-19 |
| CVE-2026-111929 Coder from 2.30.0 before 2.34.8 contains an authorization bypass vulnerability i... |
medium | 5.3 | — | — | 2026-10-17 | 2026-10-19 |
| CVE-2026-111930 Coder from 2.26.0 before 2.34.8 contains an incorrect authorization flaw in the... |
medium | 4.3 | — | — | 2026-10-17 | 2026-10-19 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.