October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,371
Critical
1,328
High
5,804
Medium
6,212
Low
648
Severity not reported
3,379
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1307), google (756), oracle (156), ibm (140), adobe (138), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-116148 ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains an injection vulne... |
low | 3.6 | — | — | 2026-10-25 | 2026-10-26 |
| CVE-2026-116140 ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 incorrectly parses delegate... |
low | 3.3 | — | — | 2026-10-25 | 2026-10-26 |
| CVE-2026-116137 adm-zip through 0.6.1 contains a duplicate-entry validation bypass that allows a... |
low | 3.7 | — | — | 2026-10-25 | 2026-10-29 |
| CVE-2026-114743 The InstaWP Connect WordPress plugin before 0.1.4.2 does not perform a capabilit... |
low | 3.1 | — | — | 2026-10-25 | 2026-10-26 |
| CVE-2026-115183 The Qi Addons For Elementor WordPress plugin before 1.11.2 does not properly san... |
low | 2.4 | — | — | 2026-10-25 | 2026-10-26 |
| CVE-2026-111981 The GiveWP WordPress plugin before 4.19.0.1 does not perform a capability check... |
low | 2.7 | — | — | 2026-10-25 | 2026-10-26 |
| CVE-2026-114741 The WPVR WordPress plugin before 9.0.3 does not perform object-level authorizati... |
low | 3.8 | — | — | 2026-10-25 | 2026-10-26 |
| CVE-2026-114742 The WPVR WordPress plugin before 9.0.3 does not perform object-level ownership c... |
low | 2.7 | — | — | 2026-10-25 | 2026-10-26 |
| CVE-2025-15705 The Contact Form by Supsystic WordPress plugin before 1.8.0 does not sanitise an... |
low | 3.5 | — | — | 2026-10-25 | 2026-10-26 |
| CVE-2026-116007 A flaw has been found in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.09. |
low | 3.7 | — | — | 2026-10-25 | 2026-10-26 |
| CVE-2026-116004 A security vulnerability has been detected in onyx-dot-app Onyx up to 5.0.0. |
low | 3.5 | — | — | 2026-10-25 | 2026-10-29 |
| CVE-2026-115996 A vulnerability was detected in Unitree Robotics Unitree Go2 up to 1.1.13/1.1.14... |
low | 3.7 | — | — | 2026-10-24 | 2026-10-26 |
| CVE-2026-115981 A security vulnerability has been detected in phpIPAM up to 1.8.3. |
low | 2.4 | — | — | 2026-10-24 | 2026-10-26 |
| CVE-2026-116012 Ghidra before 12.2 contains a numeric truncation vulnerability in PackedDecode::... |
low | 3.6 | — | — | 2026-10-24 | 2026-10-26 |
| CVE-2026-116013 OpenResty lua-resty-dns before 0.24 contains an improper input validation vulner... |
low | 3.7 | — | — | 2026-10-24 | 2026-10-29 |
| CVE-2026-113674 The GeoDirectory WordPress plugin before 2.8.194 does not correctly verify owner... |
low | 3.7 | — | — | 2026-10-24 | 2026-10-26 |
| CVE-2026-83813 Twisted is an event-based framework for internet applications, supporting Python... |
low | 3.1 | — | — | 2026-10-23 | 2026-10-29 |
| CVE-2026-79978 The RTIO streaming completion callback adxl345_process_fifo_samples_cb() in driv... |
low | 3.6 | — | — | 2026-10-23 | 2026-10-26 |
| CVE-2026-115797 A weakness has been identified in Tenda F6 12.02.01.73. |
low | 3.7 | — | — | 2026-10-23 | 2026-10-29 |
| CVE-2026-115569 Fallow is a codebase intelligence tool for TypeScript and JavaScript. |
low | 3.3 | — | — | 2026-10-23 | 2026-10-30 |
| CVE-2026-106071 A flaw in Node.js Permission Model filesystem enforcement can grant access to pa... |
low | 3.6 | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-106073 A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSyn... |
low | 3.3 | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-106070 A flaw in the Node.js `zlib.ZipFile` API can cause it to return bytes that do no... |
low | 3.7 | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-115749 hydra-ray-launcher 1.1.0.dev1 before 1.2.2 and 1.4.0.dev4 before 1.4.0rc2 contai... |
low | 3.3 | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-115750 mcp-from-openapi from 2.5.0 before 2.9.0 contains a credential exposure vulnerab... |
low | 3.7 | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-115751 Agentfront mcp-from-openapi from 2.2.0 before 2.9.0 contains a server-side reque... |
low | 3.7 | — | — | 2026-10-23 | 2026-10-29 |
| CVE-2026-115730 i18next-http-backend 4.0.2 contains an incomplete fix in interpolateUrl() that a... |
low | 3.1 | — | — | 2026-10-23 | 2026-10-29 |
| CVE-2026-115724 VLC for Android before 3.7.2 contains a confused-deputy file overwrite vulnerabi... |
low | 2.9 | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-112230 The Popup Builder WordPress plugin before 4.4.6 does not perform authorization c... |
low | 3.7 | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-113501 The LiteSpeed Cache WordPress plugin before 7.9.2 does not perform a capability... |
low | 3.1 | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-110510 The Essential Addons for Elementor WordPress plugin before 6.8.7 does not valida... |
low | 3.5 | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-110537 The Essential Addons for Elementor WordPress plugin before 6.8.7 does not verify... |
low | 3.8 | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-111737 The Speed Optimizer WordPress plugin before 7.8.5 does not sanitise or escape so... |
low | 3.5 | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-115535 A vulnerability was identified in gedelumbung HospitalManagement up to c2d455437... |
low | 2.4 | — | — | 2026-10-23 | 2026-10-29 |
| CVE-2026-115449 A flaw was found in libslirp. |
low | 3.5 | — | — | 2026-10-22 | 2026-10-23 |
| CVE-2026-114614 Authlib is a Python library which builds OAuth and OpenID Connect servers. |
low | 3.5 | — | Authlib / authlib | 2026-10-22 | 2026-10-29 |
| CVE-2026-115507 Vikunja 2.2.0 before 2.7.1 contains an HTML injection vulnerability in CreateCon... |
low | 3.5 | — | — | 2026-10-22 | 2026-10-23 |
| CVE-2026-95721 A memory corruption vulnerability exists in the web-based management interface o... |
low | 3.3 | — | — | 2026-10-22 | 2026-10-26 |
| CVE-2026-115393 Wasmtime before 24.0.12, 25.0.0 before 36.0.13, 37.0.0 before 46.0.2, and 47.0.0... |
low | 3.8 | — | — | 2026-10-22 | 2026-10-29 |
| CVE-2026-115389 Wasmtime before 36.0.16, 37.0.0 before 48.0.3, and 49.0.0 before 49.0.1 does not... |
low | 2.3 | — | — | 2026-10-22 | 2026-10-29 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.