October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,332
Critical
1,326
High
5,794
Medium
6,202
Low
648
Severity not reported
3,362
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1303), google (745), oracle (156), ibm (140), adobe (129), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-110884 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-21 | 2026-10-21 |
| CVE-2026-85683 The Jane Menu WordPress plugin before 1.5.1 does not have any capability or nonc... |
high | 8.8 | — | — | 2026-10-21 | 2026-10-21 |
| CVE-2026-97206 NLnet Labs Unbound, 1.22.0 up to and including version 1.26.1, contains a DNS-ov... |
high | 7.5 | — | — | 2026-10-21 | 2026-10-29 |
| CVE-2026-110899 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-21 | 2026-10-21 |
| CVE-2026-107435 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-21 | 2026-10-21 |
| CVE-2026-85642 The Formidable Forms WordPress plugin before 7.0 does not verify the identity of... |
high | 7.5 | — | — | 2026-10-21 | 2026-10-21 |
| CVE-2026-88784 The Translate WordPress with Weglot 2.0 WordPress plugin before 6.4.3 does not e... |
high | 7.5 | — | — | 2026-10-21 | 2026-10-21 |
| CVE-2026-92997 The Click n Chat (Chat Widget Integration) WordPress plugin before 1.1.3 does no... |
high | 8.6 | — | — | 2026-10-21 | 2026-10-21 |
| CVE-2026-92998 The Click n Chat (Chat Widget Integration) WordPress plugin before 1.1.3 does no... |
high | 8.6 | — | — | 2026-10-21 | 2026-10-21 |
| CVE-2026-79627 The Advanced File Manager WordPress plugin before 6.0.0 does not correctly deter... |
high | 7.1 | — | — | 2026-10-21 | 2026-10-21 |
| CVE-2026-111574 The Redirection for Contact Form 7 WordPress plugin before 3.2.12 does not sanit... |
high | 7.5 | — | — | 2026-10-21 | 2026-10-21 |
| CVE-2026-111948 The User Profile Builder WordPress plugin before 4.0.1 does not escape the curre... |
high | 7.1 | — | — | 2026-10-21 | 2026-10-21 |
| CVE-2026-111949 The miniOrange 2FA WordPress plugin before 6.3.1 does not prevent a pending pass... |
high | 7.5 | — | — | 2026-10-21 | 2026-10-21 |
| CVE-2026-109147 The WP Booking System WordPress plugin before 2.1.0.3 does not validate and esca... |
high | 7.1 | — | — | 2026-10-21 | 2026-10-21 |
| CVE-2026-110523 The WP User Manager WordPress plugin before 2.9.26 does not keep its paid-regist... |
high | 8.1 | — | — | 2026-10-21 | 2026-10-21 |
| CVE-2026-105262 The Falang multilanguage for WordPress plugin before 1.4.6 does not perform a ca... |
high | 8.0 | — | — | 2026-10-21 | 2026-10-21 |
| CVE-2026-107127 The Uncanny Toolkit for LearnDash WordPress plugin before 3.8.2 does not validat... |
high | 7.5 | — | — | 2026-10-21 | 2026-10-21 |
| CVE-2026-107237 The Backup and Staging by WP Time Capsule WordPress plugin before 1.22.28 does n... |
high | 8.2 | — | — | 2026-10-21 | 2026-10-21 |
| CVE-2026-107506 The Simple Banner WordPress plugin before 3.3.3 does not correctly limit the cap... |
high | 7.5 | — | — | 2026-10-21 | 2026-10-21 |
| CVE-2026-102499 The Modern Events Calendar Lite WordPress plugin before 7.37.0, Modern Event Cal... |
high | 7.7 | — | — | 2026-10-21 | 2026-10-21 |
| CVE-2026-82814 The Duplicator and Duplicator Pro plugins for WordPress are vulnerable to PHP Ob... |
high | 8.8 | — | — | 2026-10-21 | 2026-10-22 |
| CVE-2026-114106 HKUDS Vibe-Trading from 0.1.0 before 0.1.7 contains a path traversal vulnerabili... |
high | 7.5 | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2026-114107 HKUDS Vibe-Trading from 0.1.0 before 0.1.7 contains an indirect prompt injection... |
high | 8.8 | — | — | 2026-10-21 | 2026-10-22 |
| CVE-2026-114109 uv before 0.11.15 contains a path traversal vulnerability that allows malicious... |
high | 8.8 | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2026-114097 Dulwich from 0.23.1 before 1.2.8 contains a path traversal vulnerability in Comm... |
high | 7.8 | — | — | 2026-10-21 | 2026-10-22 |
| CVE-2026-114098 Dulwich from 0.22.5 before 1.2.8 contains a path traversal vulnerability in stas... |
high | 7.8 | — | — | 2026-10-21 | 2026-10-27 |
| CVE-2026-114102 adm-zip before 0.6.1 contains a denial of service vulnerability that allows unau... |
high | 7.5 | — | — | 2026-10-21 | 2026-10-22 |
| CVE-2026-114094 Dulwich before 1.2.9 fails to validate DOS drive letter prefixes in Git tree pat... |
high | 8.8 | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2026-114096 Dulwich from 0.24.0 before 1.2.8 contains a symlink following vulnerability in p... |
high | 7.8 | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2026-114085 Trigger.dev through 4.7.6 contains a missing authentication vulnerability in the... |
high | 7.9 | — | — | 2026-10-21 | 2026-10-21 |
| CVE-2026-114087 Trigger.dev before 4.5.6 self-hosted Docker Compose deployments using the defaul... |
high | 8.1 | — | — | 2026-10-21 | 2026-10-22 |
| CVE-2026-114089 Trigger.dev before 4.5.2 contains a cross-site request forgery vulnerability in... |
high | 8.8 | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2026-114090 Trigger.dev cli-v3 from 3.0.0 before 4.5.4 contains a missing authentication vul... |
high | 7.1 | — | — | 2026-10-21 | 2026-10-22 |
| CVE-2026-114078 Trigger.dev before 4.5.6 contains an authorization bypass vulnerability in Delet... |
high | 8.1 | — | — | 2026-10-21 | 2026-10-27 |
| CVE-2026-114081 Trigger.dev before 4.5.6 contains an SQL injection vulnerability in the TSQL que... |
high | 7.7 | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2026-114082 Trigger.dev before 4.6.2 contains an authorization vulnerability that allows pub... |
high | 8.1 | — | — | 2026-10-21 | 2026-10-22 |
| CVE-2026-114083 Trigger.dev before 4.5.0-rc.3 contains a path traversal vulnerability in the api... |
high | 8.1 | — | — | 2026-10-21 | 2026-10-27 |
| CVE-2026-114084 Trigger.dev before 4.5.6 contains an SQL injection vulnerability in the /realtim... |
high | 7.7 | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2026-114077 Trigger.dev before 4.5.6 contains an authorization bypass vulnerability in creat... |
high | 7.1 | — | — | 2026-10-21 | 2026-10-22 |
| CVE-2026-114066 Trigger.dev before 4.7.0 contains a missing authorization vulnerability that all... |
high | 8.1 | — | — | 2026-10-21 | 2026-10-28 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.