October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,390
Critical
1,328
High
5,808
Medium
6,216
Low
648
Severity not reported
3,390
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1307), google (756), oracle (156), ibm (140), adobe (138), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-100355 Campfire is a web-based chat application. |
low | 3.1 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119567 vsftpd through 3.0.5 contains an access control bypass vulnerability that allows... |
low | 3.1 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119558 OpenCart through 4.1.0.4 contains a business logic vulnerability that allows log... |
low | 3.1 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119548 Lago through 1.55.0 contains an authorization bypass vulnerability in Invoices::... |
low | 3.1 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119550 Jellyfin through 12.4 contains an information disclosure vulnerability in Playli... |
low | 3.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119428 phpMyAdmin through 5.2.3 contains a server-side request forgery vulnerability th... |
low | 3.7 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119417 CakePHP 4.5.12, 4.6.5, 5.1.8 through 5.1.10, 5.2.14 through 5.2.15, 5.3.7, and 5... |
low | 3.7 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119415 CakePHP through 5.4.3 contains a header injection vulnerability in FormDataPart... |
low | 3.7 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119377 SQLite before 3.54.0 contains an authorization bypass vulnerability in lookupNam... |
low | 2.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-101209 Dell OpenManage Enterprise, versions prior to 4.8.0, contains a Server-Side Requ... |
low | 2.7 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-115456 A flaw was found in gcc. |
low | 3.7 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-59385 A user with SpaceDeveloper privileges could modify the URL of a space-scoped bro... |
low | 2.7 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-114555 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripti... |
low | 3.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-107306 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripti... |
low | 3.8 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-107308 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripti... |
low | 3.1 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-107309 Missing Authorization vulnerability in Drupal Easy Breadcrumb allows Forceful Br... |
low | 3.7 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-107311 Improper Check for Unusual or Exceptional Conditions vulnerability in Drupal Per... |
low | 3.7 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-112922 A flaw was found in Ghostscript. |
low | 3.3 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-118475 A flaw was found in Eye of GNOME. |
low | 3.6 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119280 MariaDB Connector/J is used to connect applications developed in Java to MariaDB... |
low | 3.7 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-118775 Forge (also called node-forge) is a native implementation of Transport Layer Sec... |
low | 3.7 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-118776 Forge (also called node-forge) is a native implementation of Transport Layer Sec... |
low | 3.7 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-118780 Forge (also called node-forge) is a native implementation of Transport Layer Sec... |
low | 3.7 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-118781 Forge (also called node-forge) is a native implementation of Transport Layer Sec... |
low | 2.9 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-118774 Forge (also called node-forge) is a native implementation of Transport Layer Sec... |
low | 3.7 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-119133 Wasmtime 47.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a memory misalig... |
low | 2.6 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-119125 Parse Server before 8.6.107 and 9.0.0 before 9.10.5-alpha.8 returns the stored v... |
low | 3.1 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-119126 Parse Server before 8.6.106 and 9.0.0 before 9.10.5-alpha.7 mishandles dot notat... |
low | 3.1 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-119130 Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 does not... |
low | 2.6 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-119123 ImageMagick before 7.1.2-34 contains a stack overflow vulnerability in the TIFF... |
low | 3.7 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-115303 The Contact Form by Supsystic WordPress plugin before 1.11.1 does not strip CR/L... |
low | 3.7 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-85498 A flaw was found in polkit. |
low | 3.5 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-85007 The Video Player for YouTube WordPress plugin before 2.1.4 does not perform a ca... |
low | 3.8 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-105258 The Appointment Booking Plugin WordPress plugin before 5.7.6 does not escape sev... |
low | 3.5 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-108685 The WP Post Author WordPress plugin before 4.2.0 does not check that the account... |
low | 3.7 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-108686 The WP Post Author WordPress plugin before 4.2.0 does not restrict the integrati... |
low | 3.7 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2024-3586 The LetterPress WordPress plugin before 2.4.0 does not sanitise and escape some... |
low | 3.5 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-118585 A vulnerability was identified in configuroweb inventariobasico c9377cdba474deb3... |
low | 3.5 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-118691 xianyu-auto-reply-fix through 2.0.7 contains a missing authorization vulnerabili... |
low | 3.7 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-3583 When the `allowed_scopes` configuration is enabled, the OAuth2 token introspecti... |
low | 3.1 | — | — | 2026-10-28 | 2026-10-29 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.