October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,116
Critical
1,298
High
5,694
Medium
6,075
Low
636
Severity not reported
3,413
In CISA KEV
19
Most affected vendors (by CPE data where available): microsoft (1303), google (745), oracle (156), ibm (140), adobe (128), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-116149 ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a stack-based buff... |
high | 8.1 | — | — | 2026-10-25 | 2026-10-29 |
| CVE-2026-116068 Dokploy through 0.30.10 contains an authorization bypass vulnerability that allo... |
high | 8.8 | — | — | 2026-10-25 | 2026-10-26 |
| CVE-2026-116067 Paisa before 0.7.8 contains a path traversal vulnerability in the GetFile, GetSh... |
high | 8.2 | — | — | 2026-10-25 | 2026-10-29 |
| CVE-2026-116049 A flaw has been found in krupalshah EmployeeRecruitmentSystem up to 922ff6d20827... |
high | 7.3 | — | — | 2026-10-25 | 2026-10-26 |
| CVE-2026-116050 A vulnerability has been found in krupalshah Employee Recruitment System up to 9... |
high | 7.3 | — | — | 2026-10-25 | 2026-10-29 |
| CVE-2026-116048 A vulnerability was detected in krupalshah EmployeeRecruitmentSystem up to 922ff... |
high | 7.3 | — | — | 2026-10-25 | 2026-10-29 |
| CVE-2026-115251 The Duplicator WordPress plugin before 5.0.0 does not restrict its one-click upg... |
high | 7.2 | — | — | 2026-10-25 | 2026-10-26 |
| CVE-2026-116006 A vulnerability was detected in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.09... |
high | 7.3 | — | — | 2026-10-25 | 2026-10-29 |
| CVE-2026-116000 A security flaw has been discovered in Zylon PrivateGPT 1.0.0/1.0.1. |
high | 7.3 | — | — | 2026-10-25 | 2026-10-26 |
| CVE-2026-115999 A vulnerability has been found in mansi-k Restaurant_IMS d7ad49f61ab7cc1ec6eb359... |
high | 7.3 | — | — | 2026-10-25 | 2026-10-29 |
| CVE-2026-115973 A vulnerability was identified in FaveoSuite Faveo Helpdesk 2.0.3. |
high | 7.3 | — | — | 2026-10-24 | 2026-10-29 |
| CVE-2026-115970 A vulnerability has been found in Travisun Opptrix 0.4.0. |
high | 7.3 | — | — | 2026-10-24 | 2026-10-29 |
| CVE-2026-115969 A flaw has been found in Travisun Opptrix 0.4.0. |
high | 7.3 | — | — | 2026-10-24 | 2026-10-29 |
| CVE-2026-114704 Deserialization of Untrusted Data vulnerability in Christoph Vielgrader Relevans... |
high | 7.2 | — | — | 2026-10-24 | 2026-10-26 |
| CVE-2026-114191 Missing Authorization vulnerability in Knit Pay UPI QR Code Payment Gateway for... |
high | 7.5 | — | — | 2026-10-24 | 2026-10-26 |
| CVE-2026-116019 Grav 2.0.15 before 2.2.13 contains an allowlist bypass vulnerability that allows... |
high | 8.8 | — | — | 2026-10-24 | 2026-10-26 |
| CVE-2026-116011 Crow before 1.3.4 contains an uncontrolled recursion vulnerability in crow::json... |
high | 7.5 | — | — | 2026-10-24 | 2026-10-26 |
| CVE-2026-116014 open62541 1.5.0 before 1.5.7 contains an integer overflow in UA_DataType_fromStr... |
high | 8.1 | — | — | 2026-10-24 | 2026-10-29 |
| CVE-2026-116016 yudao-cloud through 2026.09 contains an authorization bypass vulnerability that... |
high | 7.1 | — | — | 2026-10-24 | 2026-10-26 |
| CVE-2026-116009 Camaleon CMS before 2.9.3 contains a path traversal vulnerability that allows us... |
high | 8.8 | — | — | 2026-10-24 | 2026-10-29 |
| CVE-2026-110018 The aBlocks – Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Buil... |
high | 8.8 | — | — | 2026-10-24 | 2026-10-26 |
| CVE-2026-114694 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-24 | 2026-10-26 |
| CVE-2026-114695 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-24 | 2026-10-26 |
| CVE-2026-114697 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-24 | 2026-10-26 |
| CVE-2026-115975 Broken access control in JiraController in Cervantes version v1.3-beta could all... |
high | 7.1 | — | — | 2026-10-24 | 2026-10-26 |
| CVE-2026-112844 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-24 | 2026-10-26 |
| CVE-2026-112869 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-24 | 2026-10-26 |
| CVE-2026-114178 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-24 | 2026-10-26 |
| CVE-2026-114179 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-24 | 2026-10-26 |
| CVE-2026-112207 The Download Monitor WordPress plugin before 5.3.4 does not properly validate th... |
high | 7.1 | — | — | 2026-10-24 | 2026-10-26 |
| CVE-2026-113673 The GeoDirectory WordPress plugin before 2.8.194 does not properly escape admini... |
high | 7.2 | — | — | 2026-10-24 | 2026-10-26 |
| CVE-2026-115807 The User Profile Builder – Beautiful User Registration Forms, User Profiles & Us... |
high | 7.1 | — | — | 2026-10-24 | 2026-10-29 |
| CVE-2026-115935 The app/process-api-response-headers action accepts fake Craft API response head... |
high | 8.8 | — | — | 2026-10-23 | 2026-10-26 |
| CVE-2026-115937 The Mollie webhook endpoint accepts two independent, attacker-controlled paramet... |
high | 7.5 | — | — | 2026-10-23 | 2026-10-26 |
| CVE-2026-115938 Craft CMS allows any authenticated control panel user to submit an element-searc... |
high | 8.8 | — | — | 2026-10-23 | 2026-10-26 |
| CVE-2026-115887 GraphQL Scalars is a library of custom GraphQL scalars for creating precise type... |
high | 7.5 | — | — | 2026-10-23 | 2026-10-26 |
| CVE-2026-115895 Happy DOM is a JavaScript implementation of a web browser without its graphical... |
high | 8.8 | — | — | 2026-10-23 | 2026-10-26 |
| CVE-2026-58202 OpenReception's appointment booking software provides an end-to-end encrypted ap... |
high | 8.3 | — | — | 2026-10-23 | 2026-10-29 |
| CVE-2026-65824 OpenReception's appointment booking software provides an end-to-end encrypted ap... |
high | 7.4 | — | — | 2026-10-23 | 2026-10-26 |
| CVE-2026-65825 OpenReception's appointment booking software provides an end-to-end encrypted ap... |
high | 7.5 | — | — | 2026-10-23 | 2026-10-26 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.