October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,016
Critical
1,287
High
5,651
Medium
6,027
Low
637
Severity not reported
3,414
In CISA KEV
19
Most affected vendors (by CPE data where available): microsoft (1303), google (735), oracle (145), ibm (140), adobe (128), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-89216 The vTables WordPress plugin before 0.3 does not properly sanitise and escape a... |
high | 8.6 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-115301 The Contact Form by Supsystic WordPress plugin before 1.11.1 does not sandbox th... |
high | 7.2 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-118905 Node Version Manager (nvm) is a POSIX-compliant shell function for managing mult... |
high | 7.0 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-15564 Wildfly's IIOP listener may permit deserialization of input streams before authe... |
high | 7.4 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-114488 A flaw was found in Wildfly. |
high | 7.4 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-111739 The Two Factor Authentication WordPress plugin before 1.17.0, All-In-One Securit... |
high | 7.5 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-96228 SSL Wireless SMS Notification for WordPress is vulnerable to Authentication Bypa... |
high | 8.1 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-96666 The Schema App Structured Data plugin for WordPress is vulnerable to Stored Cros... |
high | 7.2 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-96669 The Food Store – Online Food Delivery & Pickup plugin for WordPress is vulnerabl... |
high | 7.2 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-96741 The DSGVO All in one for WP plugin for WordPress is vulnerable to Stored Cross-S... |
high | 7.2 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-93904 The Social Web Suite – Social Media Auto Post, Social Media Auto Publish plugin... |
high | 7.5 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-93757 The Wild Apricot Login plugin for WordPress is vulnerable to Authentication Bypa... |
high | 7.5 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-93855 The SendPress Newsletters plugin for WordPress is vulnerable to time-based SQL I... |
high | 7.5 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-113387 The Ortto plugin for WordPress before 1.0.25 did not authenticate configuration... |
high | 8.6 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-85749 MailWatch for MailScanner is a web-based front-end to MailScanner. |
high | 8.1 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-93851 Mattermost versions 11.9.x |
high | 8.0 | — | — | 2026-10-28 | 2026-10-30 |
| CVE-2026-61569 AVideo is a video-sharing Platform. |
high | 7.5 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-61571 AVideo is a video-sharing Platform. |
high | 7.3 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-61572 AVideo is a video-sharing Platform. |
high | 8.6 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-54453 OpenCATS is an open-source applicant tracking system and recruitment CRM for sta... |
high | 7.2 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-54455 OpenCATS is an open-source applicant tracking system and recruitment CRM for sta... |
high | 7.6 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-118753 FreeImage (danoli3 fork) before 3.19.25 contains a heap buffer overflow vulnerab... |
high | 7.8 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-118755 Volmarg Personal Management System through 2.1.0 contains an OS command injectio... |
high | 7.2 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-118803 Bricks Theme 2.4.3 and before contains an unauthenticated dynamic-data tag injec... |
high | 7.5 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-118804 Bricks Builder 2.4.3 and before contains a broken access control vulnerability t... |
high | 7.5 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-118692 CherryTree through 1.7.2 contains an OS command injection vulnerability in CtAct... |
high | 7.0 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-118694 python-markdown2 through 2.5.5 contains a denial of service vulnerability that a... |
high | 7.5 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-118752 FreeImage (danoli3 fork) before 3.19.22 contains a heap buffer overflow vulnerab... |
high | 7.8 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-118682 KaringX ClashMi through 1.0.32.1801 disables TLS certificate validation by defau... |
high | 7.5 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-118689 OvenMediaEngine through 0.21.0 contains a denial of service vulnerability in Ovt... |
high | 7.5 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-118660 Happy DOM is a JavaScript implementation of a web browser without its graphical... |
high | 8.6 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-118659 Happy DOM is a JavaScript implementation of a web browser without its graphical... |
high | 7.5 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-76418 A vulnerability in the Remote Access SSL VPN service of Cisco Secure Firewall Ad... |
high | 8.6 | Listed | Cisco / adaptive security appliance software | 2026-10-28 | 2026-10-30 |
| CVE-2026-78674 The BPMN System REST APIs do not sufficiently validate input parameters, allowin... |
high | 8.8 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-6647 In deployments of WSO2 Identity Server configured with a case-insensitive user s... |
high | 7.4 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-61542 Gearboy is a Game Boy, Game Boy Color, and Super Game Boy emulator and debugger... |
high | 8.6 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-13451 A flaw was found in KServe. |
high | 7.7 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-118650 Echo is a Go web framework. |
high | 7.5 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-109411 An access control bypass flaw was found in Samba's vfs_ceph_rgw module in it's o... |
high | 8.1 | — | — | 2026-10-28 | 2026-10-30 |
| CVE-2025-14260 Due to the improper implementation of access control rules, the WSO2 product acc... |
high | 8.3 | — | — | 2026-10-28 | 2026-10-29 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.