October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,479
Critical
1,340
High
5,869
Medium
6,256
Low
648
Severity not reported
3,366
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1307), google (756), oracle (156), ibm (140), adobe (138), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-110378 Missing Authorization vulnerability in WP E-Signature Ninja Forms Signature Cont... |
medium | 5.3 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-109897 Missing Authorization vulnerability in WP Chill Strong Testimonials strong-testi... |
medium | 5.4 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-110360 Missing Authorization vulnerability in WPdreams Ajax Search Lite ajax-search-lit... |
medium | 5.3 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-110361 Insertion of Sensitive Information Into Sent Data vulnerability in ClikIT Infini... |
medium | 6.5 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-110362 Missing Authorization vulnerability in Planet studio PlanetStudio Payment Gatewa... |
medium | 5.3 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-110364 Missing Authorization vulnerability in WP Desk Flexible Quantity – Measurement P... |
medium | 5.3 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-109689 Missing Authorization vulnerability in WP Sunshine Sunshine Photo Cart sunshine-... |
medium | 5.3 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-109893 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-108499 Missing Authorization vulnerability in WebberZone Knowledge Base knowledgebase a... |
medium | 5.3 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-109131 The Hub collection module documentation renderer in the unified Ansible Automati... |
medium | 5.4 | — | — | 2026-10-15 | 2026-10-19 |
| CVE-2026-106604 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-106701 ELADMIN v2.7 and before is vulnerable to Cross Site Scripting (XSS) via the comp... |
medium | 6.1 | — | — | 2026-10-15 | 2026-10-20 |
| CVE-2026-103083 Authorization Bypass Through User-Controlled Key vulnerability in ELEXtensions E... |
medium | 5.4 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-55875 Helium is a free online student planner for classes, homework, grades, and notes... |
medium | 4.3 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-61702 OpenPrinting CUPS is an open source printing system for Linux and other Unix-lik... |
medium | 5.3 | — | Openprinting / cups | 2026-10-15 | 2026-10-28 |
| CVE-2026-54683 NL Portal Backend Libraries provide backend components for Dutch government port... |
medium | 6.5 | — | — | 2026-10-15 | 2026-10-28 |
| CVE-2026-55414 NL Portal Backend Libraries provide backend components for Dutch government port... |
medium | 5.3 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-55480 OpenPrinting CUPS is an open source printing system for Linux and other Unix-lik... |
medium | 5.7 | — | Openprinting / cups | 2026-10-15 | 2026-10-20 |
| CVE-2026-110381 Authorization Bypass Through User-Controlled Key vulnerability in NSquared Simpl... |
medium | 6.3 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-110888 Missing Authorization vulnerability in Meow Apps AI Engine ai-engine allows Expl... |
medium | 4.3 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-110890 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-110891 Missing Authorization vulnerability in WordLift Srl WordLift wordlift allows Exp... |
medium | 5.4 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-108175 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-110367 Missing Authorization vulnerability in WPExperts APIExperts Square for WooCommer... |
medium | 5.3 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-110371 Missing Authorization vulnerability in WP Chill Strong Testimonials strong-testi... |
medium | 4.3 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-106706 XXL-JOB through 3.5.0-SNAPSHOT is vulnerable to stored cross-site scripting (XSS... |
medium | 5.4 | — | — | 2026-10-15 | 2026-10-19 |
| CVE-2026-106707 XXL-JOB <=3.5.0-SNAPSHOT contains a stored Cross-Site Scripting (XSS) vulnerabil... |
medium | 5.4 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-104266 tinytag is a Python library for reading audio file metadata. |
medium | 6.5 | — | — | 2026-10-15 | 2026-10-21 |
| CVE-2026-102740 The AsyncHttpClient library allows Java applications to execute HTTP requests an... |
medium | 5.8 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-103350 Improper Validation of Specified Quantity in Input vulnerability in Magepeople i... |
medium | 5.3 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-78850 An issue in Matomo v.5.11.2 allows a remote attacker to obtain sensitive informa... |
medium | 5.0 | — | — | 2026-10-15 | 2026-10-26 |
| CVE-2026-78851 Directory Traversal vulnerability in Grav CMS 2.0.3 through 2.0.6 allows a remot... |
medium | 6.5 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-58391 OPNsense is a FreeBSD based firewall and routing platform. |
medium | 5.4 | — | — | 2026-10-15 | 2026-10-20 |
| CVE-2026-58392 OPNsense is a FreeBSD based firewall and routing platform. |
medium | 5.4 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-58393 OPNsense is a FreeBSD based firewall and routing platform. |
medium | 5.9 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-58394 OPNsense is a FreeBSD based firewall and routing platform. |
medium | 5.2 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-58395 OPNsense is a FreeBSD based firewall and routing platform. |
medium | 4.3 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-52167 A stack overflow in the gensub_ParsePsb() function of AOC LC32D1320 v2.05 allows... |
medium | 6.2 | — | — | 2026-10-15 | 2026-10-26 |
| CVE-2026-111095 In JetBrains TeamCity before 2026.2,
2026.1.4,
2025.11.8 stored XSS in the cla... |
medium | 5.4 | — | Jetbrains / teamcity | 2026-10-15 | 2026-10-16 |
| CVE-2026-111096 In JetBrains TeamCity before 2026.2,
2026.1.4,
2025.11.8 stored XSS in the cla... |
medium | 5.4 | — | Jetbrains / teamcity | 2026-10-15 | 2026-10-16 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.