October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,417
Critical
1,331
High
5,820
Medium
6,228
Low
648
Severity not reported
3,390
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1307), google (756), oracle (156), ibm (140), adobe (138), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-103525 The FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler plugin for... |
high | 7.5 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-103895 The miniOrange OTP Login, Verification and SMS Notifications plugin for WordPres... |
high | 8.1 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-107659 The Modula Image Gallery – Photo Grid & Video Gallery plugin for WordPress is vu... |
high | 7.5 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-107746 The FunnelKit – Funnel Builder for WooCommerce Checkout plugin for WordPress is... |
high | 7.5 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-97339 The Complianz GDPR/CCPA Cookie Consent Banner plugin for WordPress is vulnerable... |
high | 7.2 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-93953 The Backuply – Backup, Restore, Migrate and Clone plugin for WordPress is vulner... |
high | 8.0 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-111451 Wheels CLI 4.0.0 through 4.1.1 insufficiently validates or escapes caller-suppli... |
high | 7.8 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-111445 Wheels 4.0.0 through 4.1.2 before 4.2.0 replaces incoming scope conditions with... |
high | 8.1 | — | — | 2026-10-16 | 2026-10-19 |
| CVE-2026-111446 Wheels 4.0.0 through 4.1.2 exposes password-less development tools under /wheels... |
high | 8.6 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-111447 Wheels 1.1 through 4.1.2 resolves nestedProperties() records by posted primary k... |
high | 8.1 | — | — | 2026-10-16 | 2026-10-21 |
| CVE-2026-109207 The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video... |
high | 7.2 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-109990 The Flying Scripts: Delay JavaScript to Improve Site Speed & Performance plugin... |
high | 7.2 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-107758 The Colibri Page Builder plugin for WordPress is vulnerable to Stored Cross-Site... |
high | 7.2 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-104745 The Customer Email Verification for WooCommerce plugin for WordPress is vulnerab... |
high | 8.1 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-111389 Frappe HRMS 14.x before 14.38.2, 15.x before 15.64.0, and 16.x before 16.18.0 co... |
high | 7.7 | — | — | 2026-10-16 | 2026-10-18 |
| CVE-2026-111380 FreeRDP from 3.29.0 before 3.32.0 contains an integer overflow in the Apple audi... |
high | 8.8 | — | Freerdp / freerdp | 2026-10-16 | 2026-10-21 |
| CVE-2026-111381 FreeRDP before 3.32.0 contains a heap buffer overflow vulnerability in persisten... |
high | 7.3 | — | Freerdp / freerdp | 2026-10-16 | 2026-10-20 |
| CVE-2026-111382 FreeRDP before 3.32.0 contains a client-side heap out-of-bounds write vulnerabil... |
high | 8.8 | — | Freerdp / freerdp | 2026-10-16 | 2026-10-20 |
| CVE-2026-111373 FreeRDP before 3.32.0 contains a NULL pointer dereference vulnerability in the w... |
high | 7.5 | — | Freerdp / freerdp | 2026-10-16 | 2026-10-20 |
| CVE-2026-111378 FreeRDP from 3.0.0 before 3.32.0 contains an uncontrolled resource consumption v... |
high | 7.5 | — | Freerdp / freerdp | 2026-10-16 | 2026-10-20 |
| CVE-2026-111379 FreeRDP before 3.32.0 contains a heap buffer overflow vulnerability in persisten... |
high | 7.3 | — | Freerdp / freerdp | 2026-10-16 | 2026-10-27 |
| CVE-2026-92629 A potential improper authorization vulnerability was reported in Lenovo Baiying... |
high | 7.3 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-75941 A potential vulnerability was reported in the Lenovo Legion Zone application, di... |
high | 8.0 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-84823 A flaw was found in WildFly. |
high | 7.1 | — | — | 2026-10-16 | 2026-10-26 |
| CVE-2026-111210 A vulnerability was determined in bitcoinj up to 0.17. |
high | 7.3 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-111369 ClassroomIO through 1.0.0 contains an incorrect authorization vulnerability in t... |
high | 7.1 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-111366 cool-admin-midway through 8.0.0 contains an authorization bypass vulnerability t... |
high | 7.2 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-111352 ThinkCMF through 8.0.1 contains an incorrect authorization vulnerability in Rest... |
high | 8.8 | — | — | 2026-10-15 | 2026-10-23 |
| CVE-2026-111356 MacCMS v10 through 2026.1000.4056 does not limit attempts on the six-digit passw... |
high | 7.4 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-111359 CRMEB 5.6.1 through 6.0.0 contains an insecure direct object reference vulnerabi... |
high | 7.1 | — | — | 2026-10-15 | 2026-10-21 |
| CVE-2026-111312 OpenHealth through 0.2.0 contains a missing authentication and authorization vul... |
high | 7.7 | — | — | 2026-10-15 | 2026-10-23 |
| CVE-2026-111279 Dragonfly through 2.0.2 contains an unbounded memory allocation vulnerability th... |
high | 7.5 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-111280 snap7 through 1.4.3 contains an out-of-bounds write vulnerability in TSnap7Micro... |
high | 7.4 | — | — | 2026-10-15 | 2026-10-23 |
| CVE-2026-111282 Driftregion iso14229 before 0.10.1 contains an integer wraparound in Handle_0x38... |
high | 8.2 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-111277 NivoCart through 2.5.1 contains a missing authorization vulnerability in the dow... |
high | 7.5 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-110919 Use after free in V8 in Google Chrome prior to 155.0.8059.84 allowed a remote at... |
high | 8.8 | — | Google / chrome | 2026-10-15 | 2026-10-19 |
| CVE-2026-110920 Memory corruption in V8 in Google Chrome prior to 155.0.8059.84 allowed a remote... |
high | 8.8 | — | Google / chrome | 2026-10-15 | 2026-10-19 |
| CVE-2026-110921 Use after free in V8 in Google Chrome prior to 155.0.8059.84 allowed a remote at... |
high | 8.8 | — | Google / chrome | 2026-10-15 | 2026-10-19 |
| CVE-2026-110922 Use after free in Prerender in Google Chrome prior to 155.0.8059.84 allowed a re... |
high | 8.8 | — | Google / chrome | 2026-10-15 | 2026-10-19 |
| CVE-2026-110913 Memory corruption in DOM in Google Chrome prior to 155.0.8059.84 allowed a remot... |
high | 8.8 | — | Google / chrome | 2026-10-15 | 2026-10-19 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.