October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,140
Critical
1,303
High
5,710
Medium
6,092
Low
636
Severity not reported
3,399
In CISA KEV
19
Most affected vendors (by CPE data where available): microsoft (1303), google (745), oracle (156), ibm (140), adobe (128), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-112904 Vvveb is a powerful and easy to use CMS with page builder to build websites, blo... |
high | 8.7 | — | — | 2026-10-23 | 2026-10-29 |
| CVE-2026-112837 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
high | 8.5 | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-112838 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-25716 Missing Authorization vulnerability in Hallo Welt! |
high | 7.1 | — | — | 2026-10-23 | 2026-10-29 |
| CVE-2026-112359 Missing Authorization vulnerability in Amauri.IO WPMobile.App wpappninja allows... |
high | 7.5 | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-112835 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-94262 The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced C... |
high | 8.1 | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-94268 The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced C... |
high | 8.1 | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-111982 The User Profile Builder WordPress plugin before 4.0.5 does not verify that a us... |
high | 7.2 | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-113499 The LiteSpeed Cache WordPress plugin before 7.9.2 does not restrict one of its H... |
high | 7.5 | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-113500 The LiteSpeed Cache WordPress plugin before 7.9.2 does not limit one of its HTML... |
high | 7.5 | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-109936 The Otter Blocks WordPress plugin before 3.2.8 does not correctly bound a patter... |
high | 7.5 | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-115497 The Music Store – WordPress eCommerce plugin for WordPress is vulnerable to Dire... |
high | 7.5 | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-109198 The Anti-Spam by CleanTalk – Spam Protection Without CAPTCHA plugin for WordPres... |
high | 7.2 | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-115546 Okta Access Gateway (OAG) does not validate the selected authentication source d... |
high | 8.1 | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-115484 A flaw was found in the iscsiuio component of open-iscsi. |
high | 7.6 | — | — | 2026-10-23 | 2026-10-29 |
| CVE-2026-115486 A flaw was found in the iscsiuio component of open-iscsi. |
high | 7.1 | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-92450 The authentication framework used by affected Kiloview E3 NDI encoder firmware s... |
high | 7.5 | — | — | 2026-10-22 | 2026-10-23 |
| CVE-2026-110491 The ONVIF service on the E3 can be rendered unresponsive by sending malformed or... |
high | 7.5 | — | — | 2026-10-22 | 2026-10-23 |
| CVE-2026-110825 The ONVIF device service on affected Kiloview E3 NDI encoder firmware accepts ho... |
high | 7.5 | — | — | 2026-10-22 | 2026-10-23 |
| CVE-2026-96185 Stack-based buffer overflow in Microsoft Exchange Online allows an authorized at... |
high | 7.5 | — | — | 2026-10-22 | 2026-10-24 |
| CVE-2026-111594 InterSystems IRIS for Health has TLS/SSL encryption turned off by default, which... |
high | 8.1 | — | — | 2026-10-22 | 2026-10-23 |
| CVE-2026-108456 Server-side request forgery (ssrf) in Azure AI Foundry allows an authorized atta... |
high | 7.7 | — | — | 2026-10-22 | 2026-10-26 |
| CVE-2026-115417 Memory allocation with excessive size value in the MQTT 3.1.1 compatibility adap... |
high | 7.5 | — | — | 2026-10-22 | 2026-10-29 |
| CVE-2026-115419 The A2A server component in Amazon Strands Agents SDK for Python before 1.43.0 a... |
high | 8.1 | — | — | 2026-10-22 | 2026-10-23 |
| CVE-2026-115504 CFITSIO through 4.7.0 contains an out-of-bounds write vulnerability in ffgcls2()... |
high | 7.8 | — | — | 2026-10-22 | 2026-10-29 |
| CVE-2026-115505 libsmb2 before 6.3 contains integer overflow vulnerabilities in the DCE/RPC NDR... |
high | 7.6 | — | — | 2026-10-22 | 2026-10-29 |
| CVE-2026-115506 libexpat through 2.9.0 contains a denial of service vulnerability because billio... |
high | 7.5 | — | — | 2026-10-22 | 2026-10-23 |
| CVE-2026-112330 Motor.NET before 0.19.0 contains a denial of service vulnerability that allows a... |
high | 7.5 | — | — | 2026-10-22 | 2026-10-23 |
| CVE-2026-112331 Motor.NET before 0.19.0 contains a denial-of-service vulnerability that allows a... |
high | 7.5 | — | — | 2026-10-22 | 2026-10-23 |
| CVE-2026-112332 Motor.NET before 0.19.0 contains an uncaught exception vulnerability in JsonNetD... |
high | 7.5 | — | — | 2026-10-22 | 2026-10-29 |
| CVE-2026-95712 A sensitive information disclosure vulnerability in the PAPI protocol of AOS-8 c... |
high | 7.1 | — | — | 2026-10-22 | 2026-10-26 |
| CVE-2026-95713 An unauthenticated buffer overflow vulnerability exists in the command line inte... |
high | 7.0 | — | — | 2026-10-22 | 2026-10-26 |
| CVE-2026-95704 A vulnerability in the web-based management interface of wireless network manage... |
high | 7.2 | — | — | 2026-10-22 | 2026-10-26 |
| CVE-2026-95705 Command injection vulnerabilities in the affected interface of AOS-8 could allow... |
high | 7.2 | — | — | 2026-10-22 | 2026-10-26 |
| CVE-2026-95706 Command injection vulnerabilities in the affected interface of AOS-8 could allow... |
high | 7.2 | — | — | 2026-10-22 | 2026-10-26 |
| CVE-2026-95707 A buffer overflow vulnerability in the PAPI protocol of AOS-8 could allow an aut... |
high | 7.2 | — | — | 2026-10-22 | 2026-10-26 |
| CVE-2026-95708 Command injection vulnerabilities exist in the affected interface of AOS-10 that... |
high | 7.2 | — | — | 2026-10-22 | 2026-10-26 |
| CVE-2026-95709 Command injection vulnerabilities exist in the affected interface of AOS-10 that... |
high | 7.2 | — | — | 2026-10-22 | 2026-10-26 |
| CVE-2026-95710 An unauthenticated buffer overflow vulnerability exists in the underlying operat... |
high | 7.1 | — | — | 2026-10-22 | 2026-10-26 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.