October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,254
Critical
1,318
High
5,767
Medium
6,150
Low
636
Severity not reported
3,383
In CISA KEV
19
Most affected vendors (by CPE data where available): microsoft (1303), google (745), oracle (156), ibm (140), adobe (129), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-66282 In EmberZNet 9.1.1 and earlier, a malformed Publish Billing Period command can r... |
high | 7.5 | — | Silabs / emberznet | 2026-10-22 | 2026-10-29 |
| CVE-2026-66281 In EmberZNet 9.1.1 and earlier, a malformed Discover Attributes command can resu... |
high | 7.5 | — | Silabs / emberznet | 2026-10-22 | 2026-10-29 |
| CVE-2026-113582 UNSUPPORTED WHEN ASSIGNED Improper restriction of XML external entity references... |
high | 7.5 | — | — | 2026-10-22 | 2026-10-30 |
| CVE-2026-115330 Lotus through 0.10.2 contains an sql injection vulnerability that allows authent... |
high | 8.8 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-115331 Lotus through 0.10.2 contains an sql injection vulnerability that allows authent... |
high | 8.8 | — | — | 2026-10-22 | 2026-10-29 |
| CVE-2026-115332 Lotus through 0.10.2 contains an sql injection vulnerability that allows authent... |
high | 8.8 | — | — | 2026-10-22 | 2026-10-29 |
| CVE-2026-115323 EverShop 1.2.2 before 2.2.1 contains a missing authorization vulnerability in th... |
high | 7.3 | — | — | 2026-10-22 | 2026-10-29 |
| CVE-2026-115324 mem0 0.1.117 before 1.0.8 contains an sql injection vulnerability in mem0/vector... |
high | 8.1 | — | — | 2026-10-22 | 2026-10-29 |
| CVE-2026-115325 Netmaker through 1.7.0 contains an authorization bypass vulnerability in the upd... |
high | 8.3 | — | — | 2026-10-22 | 2026-10-23 |
| CVE-2026-115328 JSON-SCADA before 0.65-alpha contains an sql injection vulnerability in opcApi()... |
high | 8.8 | — | — | 2026-10-22 | 2026-10-29 |
| CVE-2026-112822 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
high | 8.5 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-112820 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP... |
high | 8.1 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-112313 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-111079 A flaw was found in Goose. |
high | 7.4 | — | — | 2026-10-22 | 2026-10-23 |
| CVE-2024-58396 YouDataSum CPAS Audit Management System V4 contains a path traversal vulnerabili... |
high | 7.5 | — | — | 2026-10-22 | 2026-10-27 |
| CVE-2025-71434 Weaver E-cology 8.0, 9.0, and 10.0 prior to 10.76 contains an unauthenticated SQ... |
high | 8.2 | — | — | 2026-10-22 | 2026-10-28 |
| CVE-2022-51023 PHPOK 4.5.000 before 5.4.081 contains an SQL injection vulnerability that allows... |
high | 8.2 | — | — | 2026-10-22 | 2026-10-29 |
| CVE-2022-51024 Kavita 0.5.2 before 0.5.4.1 contains a path traversal vulnerability that allows... |
high | 7.5 | — | — | 2026-10-22 | 2026-10-29 |
| CVE-2024-58393 i-Netsolution Readymade Unilevel Ecommerce MLM (2024-03-15 build) contains an SQ... |
high | 8.2 | — | — | 2026-10-22 | 2026-10-29 |
| CVE-2021-48013 Weaver E-cology 8.0 contains a path traversal vulnerability that allows unauthen... |
high | 7.5 | — | — | 2026-10-22 | 2026-10-29 |
| CVE-2021-48015 JeeWMS before commit 0a610e8 contains an unauthenticated path traversal vulnerab... |
high | 7.5 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2021-48017 OrbiTeam BSCW Server 5.x before 5.2.5 and 7.x before 7.4.4 contains an unauthent... |
high | 7.5 | — | — | 2026-10-22 | 2026-10-29 |
| CVE-2022-51021 NotificationX plugin for WordPress 2.0.0 before 2.3.12 contains an unauthenticat... |
high | 8.2 | — | — | 2026-10-22 | 2026-10-23 |
| CVE-2017-20289 Broadstreet Ad Widget plugin for WordPress 2.2.0 before 2.12.0 contains a local... |
high | 7.5 | — | — | 2026-10-22 | 2026-10-23 |
| CVE-2018-25438 Intermesh Group-Office 3.3.0 before 3.5.5 contains an unauthenticated path trave... |
high | 7.5 | — | — | 2026-10-22 | 2026-10-28 |
| CVE-2018-25439 MetInfo CMS 6.0.0 before 6.1.1 contains a path traversal vulnerability in /inclu... |
high | 7.5 | — | — | 2026-10-22 | 2026-10-29 |
| CVE-2019-25778 SeaCMS through 8.7 contains an unauthenticated SQL injection vulnerability that... |
high | 8.2 | — | — | 2026-10-22 | 2026-10-23 |
| CVE-2019-25779 WooThemes Diarise through 1.5.9 contains a file read vulnerability that allows u... |
high | 7.5 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2017-20287 Javo Spot theme for WordPress before 3.0.0 contains a path traversal vulnerabili... |
high | 7.5 | — | — | 2026-10-22 | 2026-10-28 |
| CVE-2026-112085 webpack-dev-server is a development server that provides live reloading for webp... |
high | 8.2 | — | Webpack.js / webpack-dev-server | 2026-10-22 | 2026-10-29 |
| CVE-2026-112242 Incorrect Privilege Assignment vulnerability in Cozmoslabs Profile Builder profi... |
high | 8.8 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-112312 Missing Authorization vulnerability in ACF Extended ACF Extended acf-extended al... |
high | 7.5 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-112379 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-111830 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-111851 Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection... |
high | 7.6 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-114177 Cross-Site Request Forgery (CSRF) vulnerability in Xpro Xpro Elementor Addons xp... |
high | 8.8 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-97328 The WebP Express WordPress plugin before 0.25.16 does not escape values that its... |
high | 7.5 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-111958 The Royal MCP WordPress plugin before 1.5.7 does not limit a preview-link token... |
high | 7.5 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-109927 The HIPAA Forms WordPress plugin before 3.3.2 does not perform a capability chec... |
high | 7.2 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-109987 The PixelYourSite WordPress plugin before 11.4.3, PixelYourSite Pro WordPress pl... |
high | 7.2 | — | — | 2026-10-22 | 2026-10-22 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.