October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,371
Critical
1,328
High
5,804
Medium
6,212
Low
648
Severity not reported
3,379
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1307), google (756), oracle (156), ibm (140), adobe (138), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-112038 A vulnerability has been found in diem-project diem up to 116974edfb9a5b8bd69cb1... |
low | 2.4 | — | — | 2026-10-19 | 2026-10-22 |
| CVE-2026-112039 A vulnerability was found in diem-project diem up to 116974edfb9a5b8bd69cb13586d... |
low | 2.4 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-112041 A vulnerability was identified in diem-project diem up to 116974edfb9a5b8bd69cb1... |
low | 3.7 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-112031 A vulnerability was determined in Chamilo LMS up to 1.11.40/2.0.3/3.0.1. |
low | 3.5 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-112029 A vulnerability has been found in diem-project diem up to 5.1.3. |
low | 2.5 | — | — | 2026-10-18 | 2026-10-19 |
| CVE-2026-112026 A security vulnerability has been detected in light0011 cms c774dce31c6df0055568... |
low | 3.7 | — | — | 2026-10-18 | 2026-10-22 |
| CVE-2026-97204 Deleting a label compared the ID of the repository in the request against the or... |
low | 3.1 | — | — | 2026-10-18 | 2026-10-19 |
| CVE-2026-111993 A flaw has been found in Soarkey StudentManagement up to e08f7f1d5015af407aa4cca... |
low | 3.3 | — | — | 2026-10-18 | 2026-10-19 |
| CVE-2026-112050 Gitify before 7.10.0 contains a login cross-site request forgery vulnerability t... |
low | 3.1 | — | — | 2026-10-18 | 2026-10-19 |
| CVE-2026-112004 Teable before 2026-10-12T12-45-53Z.3331 contains an authorization bypass vulnera... |
low | 3.1 | — | — | 2026-10-18 | 2026-10-20 |
| CVE-2026-111874 A flaw has been found in OpenCATS 0.10.0. |
low | 3.7 | — | — | 2026-10-18 | 2026-10-19 |
| CVE-2026-111932 Coder before 2.29.17, 2.30.0 before 2.32.7, 2.33.0 before 2.33.8, and 2.34.0 bef... |
low | 3.4 | — | — | 2026-10-17 | 2026-10-22 |
| CVE-2026-111933 Coder before 2.29.17, 2.30.0 before 2.32.7, 2.33.0 before 2.33.8, and 2.34.0 bef... |
low | 3.7 | — | — | 2026-10-17 | 2026-10-24 |
| CVE-2026-111934 Coder before 2.34.7 contains an IP spoofing vulnerability in the ExtractRealIPAd... |
low | 3.7 | — | — | 2026-10-17 | 2026-10-24 |
| CVE-2026-111926 Coder from 2.10.0 before 2.34.8 has an unauthenticated agent debug HTTP server o... |
low | 3.3 | — | — | 2026-10-17 | 2026-10-19 |
| CVE-2026-111888 phpMyFAQ from 4.0.0 before 4.1.9 contains an incorrect authorization vulnerabili... |
low | 2.7 | — | — | 2026-10-17 | 2026-10-18 |
| CVE-2026-92431 The Patreon WordPress plugin before 1.10.0 does not perform an authorization che... |
low | 3.7 | — | — | 2026-10-17 | 2026-10-19 |
| CVE-2026-111602 The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress... |
low | 3.7 | — | — | 2026-10-17 | 2026-10-19 |
| CVE-2026-17591 A flaw was found in libarchive. |
low | 3.6 | — | — | 2026-10-16 | 2026-10-19 |
| CVE-2026-17068 IBM i 7.3, 7.4, 7.5, and 7.6 could allow a local attacker to bypass NFS version... |
low | 3.3 | — | Ibm / i | 2026-10-16 | 2026-10-23 |
| CVE-2026-111714 tarteaucitron.js before 1.37.0 contains a regular expression denial of service v... |
low | 3.1 | — | — | 2026-10-16 | 2026-10-21 |
| CVE-2026-111678 Antiword through 0.37 contains a stack out-of-bounds read vulnerability in vGet8... |
low | 3.3 | — | Antiword Project / antiword | 2026-10-16 | 2026-10-23 |
| CVE-2026-111658 SiteServer SSCMS through 7.4.0 contains an authorization bypass vulnerability in... |
low | 3.8 | — | — | 2026-10-16 | 2026-10-23 |
| CVE-2026-111655 ThinkAdmin think-plugs-admin through 1.0.81 contains an insecure direct object r... |
low | 3.8 | — | — | 2026-10-16 | 2026-10-19 |
| CVE-2026-111648 BuildAdmin through 2.3.9 contains an insecure direct object reference vulnerabil... |
low | 2.7 | — | — | 2026-10-16 | 2026-10-23 |
| CVE-2026-111624 Umbraco CMS before 17.7.1 and 18.2.1 contains a missing authorization vulnerabil... |
low | 3.7 | — | — | 2026-10-16 | 2026-10-21 |
| CVE-2026-111609 PKP Open Journal Systems through 3.5.0-5 contains an insecure direct object refe... |
low | 3.8 | — | — | 2026-10-16 | 2026-10-21 |
| CVE-2026-111604 eladmin through 2.7 contains an authorization bypass vulnerability that allows d... |
low | 3.8 | — | — | 2026-10-16 | 2026-10-21 |
| CVE-2026-109839 IBM Db2 Genius Hub 1.0 could allow a remote authenticated attacker to bypass sec... |
low | 3.1 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-111581 A flaw was found in libblockdev. |
low | 3.3 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-110805 Server-side request forgery in PingOne groups endpoint in Devolutions Server 202... |
low | 2.6 | — | Devolutions / devolutions server | 2026-10-16 | 2026-10-23 |
| CVE-2026-110039 The Smush WordPress plugin before 4.3.4 does not restrict changes to a network-w... |
low | 2.7 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-110191 The Product Delivery Date for WooCommerce WordPress plugin before 3.3.2 does not... |
low | 2.7 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-109401 The WP Mail Logging plugin for WordPress is vulnerable to Sensitive Information... |
low | 2.7 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-111448 Wheels 4.0.0 through 4.1.2 uses case-insensitive comparisons in path-containment... |
low | 3.7 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-111354 crmeb_java through 3.1 contains an authorization bypass vulnerability that allow... |
low | 3.1 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-111332 OxiCloud 0.9.1 through 0.9.3 contains an incorrect authorization vulnerability t... |
low | 3.7 | — | — | 2026-10-15 | 2026-10-23 |
| CVE-2026-111169 La Suite Docs through 6.0.1 contains an authorization bypass vulnerability that... |
low | 3.1 | — | — | 2026-10-15 | 2026-10-26 |
| CVE-2026-55876 Helium is a free online student planner for classes, homework, grades, and notes... |
low | 3.5 | — | — | 2026-10-15 | 2026-10-21 |
| CVE-2026-55453 OpenPrinting CUPS is an open source printing system for Linux and other Unix-lik... |
low | 3.3 | — | Openprinting / cups | 2026-10-15 | 2026-10-20 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.