October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,479
Critical
1,340
High
5,869
Medium
6,256
Low
648
Severity not reported
3,366
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1307), google (756), oracle (156), ibm (140), adobe (138), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-111916 Admidio before 5.0.16 contains an information disclosure vulnerability that allo... |
medium | 5.3 | — | — | 2026-10-17 | 2026-10-21 |
| CVE-2026-111917 Vikunja 2.3.0 before 2.7.0 contains an improper session validation vulnerability... |
medium | 6.5 | — | — | 2026-10-17 | 2026-10-19 |
| CVE-2026-111918 Vikunja from 1.0.0-rc0 before 2.7.0 contains an improper authorization vulnerabi... |
medium | 5.4 | — | — | 2026-10-17 | 2026-10-19 |
| CVE-2026-111919 Vikunja 0.22.0 before 2.7.0 contains an improper access revocation vulnerability... |
medium | 6.5 | — | — | 2026-10-17 | 2026-10-19 |
| CVE-2026-111920 Vikunja 2.6.0 contains a broken access control flaw in getProjectAccessForUser (... |
medium | 4.3 | — | — | 2026-10-17 | 2026-10-19 |
| CVE-2026-111921 Vikunja 0.13.0 before 2.7.0 contains an incorrect authorization vulnerability th... |
medium | 5.4 | — | — | 2026-10-17 | 2026-10-21 |
| CVE-2026-111922 Vikunja from 2.2.0 before 2.7.0 contains a permissive CORS configuration that tr... |
medium | 6.3 | — | — | 2026-10-17 | 2026-10-19 |
| CVE-2026-111910 phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an authorizatio... |
medium | 6.5 | — | — | 2026-10-17 | 2026-10-21 |
| CVE-2026-111912 Admidio from 5.0.0 before 5.0.16 contains an insecure direct object reference vu... |
medium | 6.5 | — | — | 2026-10-17 | 2026-10-19 |
| CVE-2026-111913 Admidio from 5.0.0 before 5.0.16 contains an authorization bypass vulnerability... |
medium | 4.3 | — | — | 2026-10-17 | 2026-10-19 |
| CVE-2026-111914 Admidio from 5.0.11 before 5.0.16 contains a broken access control vulnerability... |
medium | 6.5 | — | — | 2026-10-17 | 2026-10-19 |
| CVE-2026-111902 phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an authorization bypass vulnerab... |
medium | 5.3 | — | — | 2026-10-17 | 2026-10-19 |
| CVE-2026-111903 phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains a stored cross-site scripting vu... |
medium | 5.4 | — | — | 2026-10-17 | 2026-10-19 |
| CVE-2026-111904 phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an information disclosure vulner... |
medium | 5.3 | — | — | 2026-10-17 | 2026-10-18 |
| CVE-2026-111905 phpMyFAQ 3.2.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an insecu... |
medium | 6.0 | — | — | 2026-10-17 | 2026-10-21 |
| CVE-2026-111906 phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains a cross-site re... |
medium | 6.5 | — | — | 2026-10-17 | 2026-10-19 |
| CVE-2026-111894 phpMyFAQ 3.2.1 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains a stored... |
medium | 5.4 | — | — | 2026-10-17 | 2026-10-21 |
| CVE-2026-111895 phpMyFAQ 3.2.0 before 4.0.0 and 4.0.2 before 4.2.0-beta contains an authenticati... |
medium | 6.8 | — | — | 2026-10-17 | 2026-10-19 |
| CVE-2026-111896 phpMyFAQ from 4.2.0-alpha before 4.2.0-beta contains a stored cross-site scripti... |
medium | 5.4 | — | — | 2026-10-17 | 2026-10-19 |
| CVE-2026-111900 phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an improper aut... |
medium | 4.3 | — | — | 2026-10-17 | 2026-10-21 |
| CVE-2026-111889 phpMyFAQ from 4.1.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains a mi... |
medium | 4.3 | — | — | 2026-10-17 | 2026-10-18 |
| CVE-2026-111890 phpMyFAQ from 4.2.0-alpha.2 before 4.2.0-beta contains a privilege escalation vu... |
medium | 5.5 | — | — | 2026-10-17 | 2026-10-19 |
| CVE-2026-111891 phpMyFAQ from 4.2.0-alpha.2 before 4.2.0-beta contains a privilege escalation vu... |
medium | 5.5 | — | — | 2026-10-17 | 2026-10-19 |
| CVE-2026-111892 phpMyFAQ 4.2.0-alpha before 4.2.0-beta lacks effective rate limiting on the unau... |
medium | 6.5 | — | — | 2026-10-17 | 2026-10-19 |
| CVE-2026-111893 phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains a privilege escalation vulnerabi... |
medium | 6.5 | — | — | 2026-10-17 | 2026-10-18 |
| CVE-2026-111885 phpMyFAQ from 4.2.0-alpha before 4.2.0-beta contains a missing authorization vul... |
medium | 5.5 | — | — | 2026-10-17 | 2026-10-18 |
| CVE-2026-111886 phpMyFAQ from 4.2.0-alpha.2 before 4.2.0-beta lacks brute-force lockout in the r... |
medium | 6.5 | — | — | 2026-10-17 | 2026-10-18 |
| CVE-2026-111887 phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an account enum... |
medium | 5.3 | — | — | 2026-10-17 | 2026-10-18 |
| CVE-2025-71435 Coder before 2.23.0 contains a session expiration bypass vulnerability that allo... |
medium | 4.2 | — | — | 2026-10-17 | 2026-10-24 |
| CVE-2026-110882 Missing Authorization vulnerability in Cozy Vision Technologies Pvt. |
medium | 4.3 | — | — | 2026-10-17 | 2026-10-19 |
| CVE-2024-58398 Coder 2.3.1 before 2.14.4, 2.15.x before 2.15.3, and 2.16.0 before 2.16.1 contai... |
medium | 4.3 | — | — | 2026-10-17 | 2026-10-21 |
| CVE-2026-109983 The YMC Filter plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site... |
medium | 6.4 | — | — | 2026-10-17 | 2026-10-19 |
| CVE-2026-110253 The weForms – Easy Drag & Drop Contact Form Builder For WordPress plugin for Wor... |
medium | 5.4 | — | — | 2026-10-17 | 2026-10-19 |
| CVE-2026-92432 The Patreon WordPress plugin before 1.10.0 does not validate a user-supplied red... |
medium | 4.3 | — | — | 2026-10-17 | 2026-10-19 |
| CVE-2026-92433 The Patreon WordPress plugin before 1.10.0 does not verify a nonce when connecti... |
medium | 6.5 | — | — | 2026-10-17 | 2026-10-19 |
| CVE-2026-97314 The ThirstyAffiliates WordPress plugin before 3.12.1 does not check the status o... |
medium | 6.5 | — | — | 2026-10-17 | 2026-10-19 |
| CVE-2026-104122 The Ukr-To-Lat WordPress plugin through 1.3.5 does not sanitize and escape a ter... |
medium | 6.8 | — | — | 2026-10-17 | 2026-10-19 |
| CVE-2026-104246 The Contact Form 7 Signature Addon WordPress plugin through 4.2.2 does not sanit... |
medium | 5.9 | — | — | 2026-10-17 | 2026-10-19 |
| CVE-2026-106470 The WP Data Access WordPress plugin before 5.5.88 does not have authorisation an... |
medium | 5.0 | — | — | 2026-10-17 | 2026-10-19 |
| CVE-2026-110527 The WP User Manager WordPress plugin before 2.9.20 does not roll back the WordPr... |
medium | 5.3 | — | — | 2026-10-17 | 2026-10-19 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.