October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
16,979
Critical
1,280
High
5,617
Medium
5,999
Low
633
Severity not reported
3,450
In CISA KEV
19
Most affected vendors (by CPE data where available): microsoft (1302), google (733), ibm (140), adobe (128), oracle (120), broadcom (61), langflow (56), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-61993 Unauthenticated Cross Site Scripting (XSS) in Blockonomics 3.11.0 versions. |
high | 7.1 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-61995 Unauthenticated Cross Site Scripting (XSS) in YouTube Showcase |
high | 7.1 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-61996 Subscriber SQL Injection in MLS On The Fly |
high | 8.5 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-61988 Unauthenticated Cross Site Scripting (XSS) in Auction Nudge – Your eBay on Your... |
high | 7.1 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-61989 Unauthenticated Cross Site Scripting (XSS) in Easy Property Listings |
high | 7.1 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-54864 Unauthenticated Cross Site Scripting (XSS) in Post Video Players |
high | 7.1 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-54866 Unauthenticated Cross Site Scripting (XSS) in Razorpay Payment Button Elementor... |
high | 7.1 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-42692 Unauthenticated Cross Site Scripting (XSS) in WP Crowdfunding |
high | 7.1 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-42701 Shop manager PHP Object Injection in YayMail |
high | 7.2 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-119144 Frappe Framework before 15.111.0 and 16.x before 16.21.0 contains a server-side... |
high | 8.8 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-27394 Unauthenticated Cross Site Scripting (XSS) in Eventer |
high | 7.1 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-119127 ZITADEL 4.0.0 before 4.19.5 contains a host header injection vulnerability in th... |
high | 8.1 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-119128 ZITADEL 4.0.0 before 4.19.5 contains an authentication bypass vulnerability in t... |
high | 7.4 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-119129 ZITADEL 3.0.0 through 3.4.15 and 4.0.0 before 4.19.5 contains a missing authoriz... |
high | 8.1 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-119119 Crawl4AI before 0.9.5 contains a denial of service vulnerability in the Docker A... |
high | 7.5 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-119120 Crawl4AI from 0.9.0 before 0.9.5 fails to filter the CosineStrategy model_name f... |
high | 7.5 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-118082 Subscriber Privilege Escalation in Buddyboss Platform |
high | 8.8 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-118083 Unauthenticated Sensitive Data Exposure in WP Crowdfunding |
high | 7.5 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-118085 Unauthenticated Cross Site Scripting (XSS) in GlobalPayments WooCommerce |
high | 7.1 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-118074 Shop manager PHP Object Injection in Finale Lite |
high | 7.2 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-118075 Contributor PHP Object Injection in WP Media folders |
high | 8.8 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-118076 Contributor PHP Object Injection in Frisbii Pay |
high | 8.8 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-118077 Author PHP Object Injection in Sastra Essential Addons for Elementor |
high | 7.2 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-118078 Shop manager PHP Object Injection in Product Catalog Feed by PixelYourSite |
high | 7.2 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-118079 Shop manager PHP Object Injection in FV Flowplayer Video Player |
high | 7.2 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-118080 Contributor PHP Object Injection in Social Snap |
high | 8.8 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-118081 Contributor PHP Object Injection in 10Web Social Photo Feed |
high | 8.8 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-116864 Author PHP Object Injection in WPCargo Track & Trace |
high | 7.2 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-116865 Editor PHP Object Injection in Zippy |
high | 7.2 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-116866 Contributor PHP Object Injection in Extra Fees Plugin for WooCommerce |
high | 8.8 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-116867 Contributor PHP Object Injection in Dynamic QR Code – generator |
high | 8.8 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-116868 Subscriber PHP Object Injection in BuddyPress Xprofile Custom Field Types |
high | 8.8 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-116869 Shop manager PHP Object Injection in myPOS Checkout |
high | 7.2 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-118073 Subscriber PHP Object Injection in News Kit Elementor Addons |
high | 8.8 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-114148 Incorrect default permissions in ASP.NET Core allows an authorized attacker to e... |
high | 7.8 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-110309 IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacke... |
high | 8.8 | — | Langflow / langflow | 2026-10-29 | 2026-10-30 |
| CVE-2026-110193 IBM Langflow OSS 1.0.0 through 1.12.8 could allow a remote attacker with a low-p... |
high | 8.8 | — | Langflow / langflow | 2026-10-29 | 2026-10-30 |
| CVE-2026-110196 IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote attacker with a low-p... |
high | 8.8 | — | Langflow / langflow | 2026-10-29 | 2026-10-30 |
| CVE-2026-110245 IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote attacker to obtain se... |
high | 7.5 | — | Langflow / langflow | 2026-10-29 | 2026-10-30 |
| CVE-2026-108494 Unauthenticated Cross Site Scripting (XSS) in Chained Quiz |
high | 7.1 | — | — | 2026-10-29 | 2026-10-29 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.