October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,371
Critical
1,328
High
5,804
Medium
6,212
Low
648
Severity not reported
3,379
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1307), google (756), oracle (156), ibm (140), adobe (138), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-112015 Omnigent 0.3.0 before 0.14.0 contains a path traversal vulnerability that allows... |
high | 7.5 | — | — | 2026-10-18 | 2026-10-19 |
| CVE-2026-112018 cgltf through 1.15 contains a heap out-of-bounds write vulnerability in cgltf_ac... |
high | 7.0 | — | — | 2026-10-18 | 2026-10-19 |
| CVE-2026-112000 Vanus 0.8.0 through 0.9.0 contains a missing authorization vulnerability in the... |
high | 7.6 | — | — | 2026-10-18 | 2026-10-22 |
| CVE-2026-112001 ProjectSend 2.0.0 before 2.7.0 contains an incorrect authorization vulnerability... |
high | 7.2 | — | — | 2026-10-18 | 2026-10-19 |
| CVE-2026-112005 WhoDB 0.104.0 before 0.135.0 contains a path traversal vulnerability that allows... |
high | 7.7 | — | — | 2026-10-18 | 2026-10-22 |
| CVE-2026-111999 Vanus 0.8.0 through 0.9.0 contains a missing authentication vulnerability that a... |
high | 7.5 | — | — | 2026-10-18 | 2026-10-20 |
| CVE-2026-110895 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
high | 8.5 | — | — | 2026-10-18 | 2026-10-19 |
| CVE-2026-110897 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-18 | 2026-10-19 |
| CVE-2026-108485 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-18 | 2026-10-19 |
| CVE-2026-109895 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-18 | 2026-10-19 |
| CVE-2026-110373 Incorrect Privilege Assignment vulnerability in Hamid Alinia Login with phone nu... |
high | 8.1 | — | — | 2026-10-18 | 2026-10-19 |
| CVE-2026-110382 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-18 | 2026-10-19 |
| CVE-2026-110383 Authorization Bypass Through User-Controlled Key vulnerability in WP E-Signature... |
high | 7.5 | — | — | 2026-10-18 | 2026-10-19 |
| CVE-2026-107436 Deserialization of Untrusted Data vulnerability in WP Chill Strong Testimonials... |
high | 8.8 | — | — | 2026-10-18 | 2026-10-19 |
| CVE-2026-96534 The Modern Events Calendar Lite WordPress plugin before 7.37.0, Modern Event Cal... |
high | 7.7 | — | — | 2026-10-18 | 2026-10-19 |
| CVE-2026-110031 The Salon Booking System WordPress plugin before 10.31.11 does not prevent users... |
high | 7.2 | — | — | 2026-10-18 | 2026-10-19 |
| CVE-2026-110981 The WP Photo Album Plus WordPress plugin before 9.2.11.002 does not properly esc... |
high | 7.1 | — | — | 2026-10-18 | 2026-10-19 |
| CVE-2026-111873 A vulnerability was detected in itsmeravitejak Online-Examination-System up to e... |
high | 7.3 | — | — | 2026-10-18 | 2026-10-22 |
| CVE-2026-111871 A weakness has been identified in itsmeravitejak Online-Examination-System up to... |
high | 7.3 | — | — | 2026-10-18 | 2026-10-19 |
| CVE-2026-111872 A security vulnerability has been detected in itsmeravitejak Online-Examination-... |
high | 7.3 | — | — | 2026-10-18 | 2026-10-19 |
| CVE-2026-111866 A weakness has been identified in nemoTyrant manong up to 7c9e5228e133b9267ad3a4... |
high | 7.3 | — | — | 2026-10-18 | 2026-10-19 |
| CVE-2026-111923 Fleet before 4.89.0 contains an unbounded recursion vulnerability in Apple MDM e... |
high | 7.5 | — | — | 2026-10-17 | 2026-10-19 |
| CVE-2026-111924 Fleet before 4.83.0 contains a denial of service vulnerability that allows unaut... |
high | 7.5 | — | — | 2026-10-17 | 2026-10-19 |
| CVE-2026-111927 Coder before 2.29.20, 2.33.0 before 2.33.12, 2.34.0 before 2.34.8, and 2.35.0 be... |
high | 7.7 | — | — | 2026-10-17 | 2026-10-21 |
| CVE-2026-111908 phpMyFAQ 4.0.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains a broken... |
high | 8.3 | — | — | 2026-10-17 | 2026-10-19 |
| CVE-2026-111909 phpMyFAQ before 4.1.9 contains a missing authorization vulnerability in the dele... |
high | 8.1 | — | — | 2026-10-17 | 2026-10-18 |
| CVE-2026-111907 phpMyFAQ 4.0.0 before 4.1.9 contains a cross-site request forgery vulnerability... |
high | 7.1 | — | — | 2026-10-17 | 2026-10-19 |
| CVE-2026-111897 phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an authorization bypass vulnerab... |
high | 7.1 | — | — | 2026-10-17 | 2026-10-19 |
| CVE-2026-111898 phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an authentication bypass vulnera... |
high | 7.5 | — | — | 2026-10-17 | 2026-10-18 |
| CVE-2026-111901 phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an uncontrolled resource consump... |
high | 7.5 | — | — | 2026-10-17 | 2026-10-19 |
| CVE-2026-111881 FreeRDP from 3.14.1 before 3.32.0 contains an integer underflow in the WinPR BMP... |
high | 7.6 | — | — | 2026-10-17 | 2026-10-19 |
| CVE-2026-111882 phpMyFAQ 3.2.0-alpha before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an... |
high | 8.1 | — | — | 2026-10-17 | 2026-10-18 |
| CVE-2026-111884 phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta does not require the cur... |
high | 8.3 | — | — | 2026-10-17 | 2026-10-18 |
| CVE-2026-111880 FreeRDP versions from 2.0.0 before 3.32.0 contain a heap out-of-bounds write in... |
high | 7.4 | — | — | 2026-10-17 | 2026-10-19 |
| CVE-2026-109701 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-17 | 2026-10-19 |
| CVE-2026-110889 Generation of Error Message Containing Sensitive Information vulnerability in Ga... |
high | 7.5 | — | — | 2026-10-17 | 2026-10-19 |
| CVE-2026-111110 The Payment forms, Buy now buttons, and Invoicing System | GetPaid plugin for Wo... |
high | 7.2 | — | — | 2026-10-17 | 2026-10-19 |
| CVE-2026-100316 The European VAT Compliance Assistant for WooCommerce plugin for WordPress is vu... |
high | 7.2 | — | — | 2026-10-17 | 2026-10-19 |
| CVE-2026-110384 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-17 | 2026-10-19 |
| CVE-2026-92798 The User Registration & Membership plugin for WordPress is vulnerable to Arbitra... |
high | 8.1 | — | — | 2026-10-17 | 2026-10-19 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.