October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
16,979
Critical
1,280
High
5,617
Medium
5,999
Low
633
Severity not reported
3,450
In CISA KEV
19
Most affected vendors (by CPE data where available): microsoft (1302), google (733), ibm (140), adobe (128), oracle (120), broadcom (61), langflow (56), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-107042 Insecure permissions in USP Ultimate Screenshot Painter versionCode 240213.009 a... |
high | 7.5 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-107326 IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacke... |
high | 8.8 | — | Langflow / langflow | 2026-10-29 | 2026-10-30 |
| CVE-2026-107327 IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacke... |
high | 8.8 | — | Langflow / langflow | 2026-10-29 | 2026-10-30 |
| CVE-2026-107328 IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacke... |
high | 8.8 | — | Langflow / langflow | 2026-10-29 | 2026-10-30 |
| CVE-2026-107329 IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacke... |
high | 8.8 | — | Langflow / langflow | 2026-10-29 | 2026-10-30 |
| CVE-2026-107037 Insecure permissions in the NotificationHelper component of NoNonsense Notes ver... |
high | 7.5 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-107026 Insecure permissions in Share to Clipboard v1.14.1 (versionCode 32) allows unaut... |
high | 7.5 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-104324 IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacke... |
high | 8.8 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-104328 IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacke... |
high | 8.8 | — | Langflow / langflow | 2026-10-29 | 2026-10-30 |
| CVE-2026-103092 IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacke... |
high | 8.8 | — | Langflow / langflow | 2026-10-29 | 2026-10-30 |
| CVE-2026-102590 IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacke... |
high | 7.7 | — | Langflow / langflow | 2026-10-29 | 2026-10-30 |
| CVE-2026-101288 IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacke... |
high | 8.8 | — | Langflow / langflow | 2026-10-29 | 2026-10-30 |
| CVE-2026-115709 Improper Link Resolution Before File Access ('Link Following') (CWE-59) in Elast... |
high | 8.2 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-115713 Improper Link Resolution Before File Access ('Link Following') (CWE-59) in Elast... |
high | 7.5 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-115708 Improper Link Resolution Before File Access ('Link Following') (CWE-59) in Elast... |
high | 7.2 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-107020 An issue in the activity.LoadLinkLaterActivity component of FeedEx / Handy News... |
high | 7.5 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-39736 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
high | 8.5 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-119052 llama.cpp b2877 before b11935 contains an uncaught exception vulnerability in th... |
high | 7.5 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-119049 FreeMail before 5.3.2 contains an authorization bypass vulnerability that allows... |
high | 7.6 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-119050 Agno through 3.1.11 contains an unsafe reflection vulnerability in PandasTools t... |
high | 8.1 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-116399 Cross-Site Request Forgery (CSRF) vulnerability in InstaWP InstaWP Connect insta... |
high | 8.8 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2019-25781 Python-Markdown 3.0 through 3.11.2 contains an algorithmic complexity vulnerabil... |
high | 7.5 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-49142 OpenEMR before 8.5.0 contains an authenticated SQL injection vulnerability in th... |
high | 8.8 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-96767 The NEX-Forms – Ultimate Forms Plugin for WordPress plugin for WordPress is vuln... |
high | 7.2 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-119025 open 7.2.0 before 11.0.0 contains an OS command injection vulnerability that all... |
high | 7.5 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-119027 oapi-codegen 2.5.0 before 2.8.1 contains a code injection vulnerability that all... |
high | 7.5 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-119028 oapi-codegen 2.0.0 before 2.8.1 contains a code injection vulnerability that all... |
high | 8.8 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-115821 The NewsmanApp plugin for WordPress is vulnerable to Stored Cross-Site Scripting... |
high | 7.2 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-110184 The Newsmatic theme for WordPress is vulnerable to blind SQL Injection via the '... |
high | 7.5 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-103665 The installer for Yamaha LAN Monitor for Windows provided by Yamaha Corporation... |
high | 7.8 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-33924 Two OS command injection vulnerabilities were discovered in the update installat... |
high | 7.2 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-33923 A signature verification vulnerability was discovered in the update installation... |
high | 7.2 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-115963 Missing Authorization vulnerability in VideoWhisper.com Broadcast Live Video vid... |
high | 7.1 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-115965 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
high | 8.5 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-115967 Weak Authentication vulnerability in Hamid Alinia Login with phone number login-... |
high | 8.8 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-116409 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-115599 Missing Authorization vulnerability in ThimPress LearnPress learnpress allows Ex... |
high | 7.5 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-115611 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-115592 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-114193 Missing Authorization vulnerability in Eyal Fitoussi GEO my WordPress geo-my-wp... |
high | 7.5 | — | — | 2026-10-29 | 2026-10-29 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.