October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,016
Critical
1,287
High
5,651
Medium
6,027
Low
637
Severity not reported
3,414
In CISA KEV
19
Most affected vendors (by CPE data where available): microsoft (1303), google (735), oracle (145), ibm (140), adobe (128), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-107026 Insecure permissions in Share to Clipboard v1.14.1 (versionCode 32) allows unaut... |
high | 7.5 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-104324 IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacke... |
high | 8.8 | — | Langflow / langflow | 2026-10-29 | 2026-10-30 |
| CVE-2026-104328 IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacke... |
high | 8.8 | — | Langflow / langflow | 2026-10-29 | 2026-10-30 |
| CVE-2026-103092 IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacke... |
high | 8.8 | — | Langflow / langflow | 2026-10-29 | 2026-10-30 |
| CVE-2026-102590 IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacke... |
high | 7.7 | — | Langflow / langflow | 2026-10-29 | 2026-10-30 |
| CVE-2026-101288 IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacke... |
high | 8.8 | — | Langflow / langflow | 2026-10-29 | 2026-10-30 |
| CVE-2026-115709 Improper Link Resolution Before File Access ('Link Following') (CWE-59) in Elast... |
high | 8.2 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-115713 Improper Link Resolution Before File Access ('Link Following') (CWE-59) in Elast... |
high | 7.5 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-115708 Improper Link Resolution Before File Access ('Link Following') (CWE-59) in Elast... |
high | 7.2 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-107020 An issue in the activity.LoadLinkLaterActivity component of FeedEx / Handy News... |
high | 7.5 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-39736 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
high | 8.5 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-119052 llama.cpp b2877 before b11935 contains an uncaught exception vulnerability in th... |
high | 7.5 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-119049 FreeMail before 5.3.2 contains an authorization bypass vulnerability that allows... |
high | 7.6 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-119050 Agno through 3.1.11 contains an unsafe reflection vulnerability in PandasTools t... |
high | 8.1 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-116399 Cross-Site Request Forgery (CSRF) vulnerability in InstaWP InstaWP Connect insta... |
high | 8.8 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2019-25781 Python-Markdown 3.0 through 3.11.2 contains an algorithmic complexity vulnerabil... |
high | 7.5 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-49142 OpenEMR before 8.5.0 contains an authenticated SQL injection vulnerability in th... |
high | 8.8 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-96767 The NEX-Forms – Ultimate Forms Plugin for WordPress plugin for WordPress is vuln... |
high | 7.2 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-119025 open 7.2.0 before 11.0.0 contains an OS command injection vulnerability that all... |
high | 7.5 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-119027 oapi-codegen 2.5.0 before 2.8.1 contains a code injection vulnerability that all... |
high | 7.5 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-119028 oapi-codegen 2.0.0 before 2.8.1 contains a code injection vulnerability that all... |
high | 8.8 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-115821 The NewsmanApp plugin for WordPress is vulnerable to Stored Cross-Site Scripting... |
high | 7.2 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-110184 The Newsmatic theme for WordPress is vulnerable to blind SQL Injection via the '... |
high | 7.5 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-103665 The installer for Yamaha LAN Monitor for Windows provided by Yamaha Corporation... |
high | 7.8 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-33924 Two OS command injection vulnerabilities were discovered in the update installat... |
high | 7.2 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-33923 A signature verification vulnerability was discovered in the update installation... |
high | 7.2 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-115963 Missing Authorization vulnerability in VideoWhisper.com Broadcast Live Video vid... |
high | 7.1 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-115965 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
high | 8.5 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-115967 Weak Authentication vulnerability in Hamid Alinia Login with phone number login-... |
high | 8.8 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-116409 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-115599 Missing Authorization vulnerability in ThimPress LearnPress learnpress allows Ex... |
high | 7.5 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-115611 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-115592 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-114193 Missing Authorization vulnerability in Eyal Fitoussi GEO my WordPress geo-my-wp... |
high | 7.5 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-112827 Missing Authorization vulnerability in VillaTheme HANDMADE – Dropshipping for Et... |
high | 7.1 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-111417 A broken access control vulnerability exists in the Foxit official website’s HTM... |
high | 7.5 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-111418 A server-side request forgery (SSRF) vulnerability exists in the Foxit official... |
high | 7.5 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-111419 A sensitive information exposure vulnerability exists on the Foxit official webs... |
high | 8.6 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-107743 The Mapster WP Maps plugin for WordPress is vulnerable to Stored Cross-Site Scri... |
high | 7.2 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-86794 The Community Events WordPress plugin before 1.6.0 does not have authorisation o... |
high | 8.8 | — | — | 2026-10-29 | 2026-10-29 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.