October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,300
Critical
1,323
High
5,783
Medium
6,188
Low
643
Severity not reported
3,363
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1303), google (745), oracle (156), ibm (140), adobe (129), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-114391 ZenTao PMS before 22.3 contains an authorization bypass vulnerability in commonM... |
high | 7.1 | — | — | 2026-10-21 | 2026-10-22 |
| CVE-2026-114245 A weakness has been identified in dhikshitha29 Insurance-Management-System 91de5... |
high | 7.3 | — | — | 2026-10-21 | 2026-10-21 |
| CVE-2026-114387 Shopper from 2.0.0 before 2.6.0 contains a missing authorization vulnerability t... |
high | 8.8 | — | — | 2026-10-21 | 2026-10-27 |
| CVE-2026-114243 A security flaw has been discovered in dhikshitha29 Insurance-Management-System... |
high | 7.3 | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2026-80463 Unbounded memory accumulation in the stream message reassembly path of Apache bR... |
high | 7.5 | — | — | 2026-10-21 | 2026-10-30 |
| CVE-2026-81755 Uncontrolled resource consumption in the streaming RPC component of Apache bRPC... |
high | 7.5 | — | — | 2026-10-21 | 2026-10-30 |
| CVE-2026-78048 A reachable-assertion flaw in the HPACK header-compression decoder of the HTTP/2... |
high | 7.5 | — | — | 2026-10-21 | 2026-10-30 |
| CVE-2026-78058 Uncontrolled resource consumption in the HTTP/2 (h2) receive path of Apache bRPC... |
high | 7.5 | — | — | 2026-10-21 | 2026-10-30 |
| CVE-2026-78066 Resource exhaustion in Apache bRPC (version < 1.18.0) on all platforms: multiple... |
high | 7.5 | — | — | 2026-10-21 | 2026-10-30 |
| CVE-2026-79704 An out-of-bounds read vulnerability exists in the streaming RPC client of Apache... |
high | 7.5 | — | — | 2026-10-21 | 2026-10-30 |
| CVE-2026-61902 Apache bRPC versions before 1.18.0 do not consistently enforce the configured ma... |
high | 7.5 | — | — | 2026-10-21 | 2026-10-30 |
| CVE-2026-61916 Out-of-bounds reads in URL parsing and case-insensitive header lookup in Apache... |
high | 7.5 | — | — | 2026-10-21 | 2026-10-30 |
| CVE-2026-74755 An integer underflow in the mcpack2pb component of Apache bRPC (version < 1.18.0... |
high | 7.5 | — | — | 2026-10-21 | 2026-10-30 |
| CVE-2026-74757 Uncontrolled resource allocation in the mcpack2pb component in Apache bRPC (vers... |
high | 7.5 | — | — | 2026-10-21 | 2026-10-26 |
| CVE-2026-74758 A heap use-after-free in the RTMP protocol component of Apache bRPC (versions <... |
high | 7.5 | — | — | 2026-10-21 | 2026-10-30 |
| CVE-2026-54425 Uncontrolled recursion in the HTTP/2 HPACK decoder in Apache bRPC before 1.18.0... |
high | 7.5 | — | — | 2026-10-21 | 2026-10-30 |
| CVE-2026-54426 Uncontrolled recursion in the Redis reply parser in Apache bRPC < 1.18.0 allows... |
high | 7.5 | — | — | 2026-10-21 | 2026-10-30 |
| CVE-2026-54427 Uncontrolled recursion in the AMF parser in Apache bRPC < 1.18.0 allows a remote... |
high | 7.5 | — | — | 2026-10-21 | 2026-10-30 |
| CVE-2026-56386 Integer underflow and out-of-bounds read in the HTTP/2 server DATA frame parser... |
high | 7.5 | — | — | 2026-10-21 | 2026-10-26 |
| CVE-2026-56387 The RTMP AMF parser in Apache bRPC accepts AMF string lengths and array counts d... |
high | 7.5 | — | — | 2026-10-21 | 2026-10-30 |
| CVE-2026-58064 The Redis protocol implementation in Apache bRPC allowed inline command parsing... |
high | 7.5 | — | — | 2026-10-21 | 2026-10-30 |
| CVE-2026-59229 The Legacy Pipe receiver protocol (handshake / sendPipeData) uses a
hardcoded SU... |
high | 8.8 | — | — | 2026-10-21 | 2026-10-30 |
| CVE-2026-114242 A vulnerability was identified in dhikshitha29 Insurance-Management-System 91de5... |
high | 7.3 | — | — | 2026-10-21 | 2026-10-27 |
| CVE-2026-41114 Uncontrolled Resource Consumption vulnerability in Apache IoTDB JDBC driver. |
high | 7.5 | — | — | 2026-10-21 | 2026-10-30 |
| CVE-2026-110369 Deserialization of Untrusted Data vulnerability in GS Plugins WordPress Team Mem... |
high | 8.8 | — | — | 2026-10-21 | 2026-10-21 |
| CVE-2026-110370 Deserialization of Untrusted Data vulnerability in GS Plugins GS Pins for Pinter... |
high | 8.8 | — | — | 2026-10-21 | 2026-10-21 |
| CVE-2026-110884 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-21 | 2026-10-21 |
| CVE-2026-85683 The Jane Menu WordPress plugin before 1.5.1 does not have any capability or nonc... |
high | 8.8 | — | — | 2026-10-21 | 2026-10-21 |
| CVE-2026-97206 NLnet Labs Unbound, 1.22.0 up to and including version 1.26.1, contains a DNS-ov... |
high | 7.5 | — | — | 2026-10-21 | 2026-10-29 |
| CVE-2026-110899 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-21 | 2026-10-21 |
| CVE-2026-107435 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-21 | 2026-10-21 |
| CVE-2026-85642 The Formidable Forms WordPress plugin before 7.0 does not verify the identity of... |
high | 7.5 | — | — | 2026-10-21 | 2026-10-21 |
| CVE-2026-88784 The Translate WordPress with Weglot 2.0 WordPress plugin before 6.4.3 does not e... |
high | 7.5 | — | — | 2026-10-21 | 2026-10-21 |
| CVE-2026-92997 The Click n Chat (Chat Widget Integration) WordPress plugin before 1.1.3 does no... |
high | 8.6 | — | — | 2026-10-21 | 2026-10-21 |
| CVE-2026-92998 The Click n Chat (Chat Widget Integration) WordPress plugin before 1.1.3 does no... |
high | 8.6 | — | — | 2026-10-21 | 2026-10-21 |
| CVE-2026-79627 The Advanced File Manager WordPress plugin before 6.0.0 does not correctly deter... |
high | 7.1 | — | — | 2026-10-21 | 2026-10-21 |
| CVE-2026-111574 The Redirection for Contact Form 7 WordPress plugin before 3.2.12 does not sanit... |
high | 7.5 | — | — | 2026-10-21 | 2026-10-21 |
| CVE-2026-111948 The User Profile Builder WordPress plugin before 4.0.1 does not escape the curre... |
high | 7.1 | — | — | 2026-10-21 | 2026-10-21 |
| CVE-2026-111949 The miniOrange 2FA WordPress plugin before 6.3.1 does not prevent a pending pass... |
high | 7.5 | — | — | 2026-10-21 | 2026-10-21 |
| CVE-2026-109147 The WP Booking System WordPress plugin before 2.1.0.3 does not validate and esca... |
high | 7.1 | — | — | 2026-10-21 | 2026-10-21 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.