October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,481
Critical
1,390
High
6,087
Medium
6,446
Low
659
Severity not reported
2,899
In CISA KEV
21
Most affected vendors (by CPE data where available): microsoft (1359), google (759), oracle (376), apple (282), ibm (149), adobe (138), apache (73), imagemagick (72), broadcom (61), freerdp (60)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-118636 **UNSUPPORTED WHEN ASSIGNED**
JavaNativeMessageDecoder in the MINA 3.0 codec m... |
critical | 9.8 | — | — | 2026-10-31 | 2026-11-02 |
| CVE-2026-120209 AJ-Report through 1.7.1 signs share tokens with a hard-coded JWT secret, allowin... |
critical | 9.8 | — | — | 2026-10-31 | 2026-11-02 |
| CVE-2026-120201 Jpom 2.10.0 through 2.11.12 contains an authentication bypass vulnerability that... |
critical | 9.8 | — | — | 2026-10-31 | 2026-11-02 |
| CVE-2026-118235 The SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifica... |
critical | 9.8 | — | — | 2026-10-31 | 2026-11-02 |
| CVE-2026-103882 The Acadlix LMS – AI Quiz Maker, Online Exam & Course Plugin for WordPress plugi... |
critical | 9.1 | — | — | 2026-10-31 | 2026-11-02 |
| CVE-2026-119096 The Uncanny Toolkit for LearnDash plugin for WordPress is vulnerable to Authenti... |
critical | 9.8 | — | — | 2026-10-31 | 2026-11-02 |
| CVE-2026-116512 The Project Manager – AI Powered Project Management, Task Management, Kanban Boa... |
critical | 9.8 | — | — | 2026-10-31 | 2026-11-02 |
| CVE-2026-89270 The Popup Builder – Create highly converting, mobile friendly marketing popups. |
critical | 9.1 | — | — | 2026-10-31 | 2026-11-02 |
| CVE-2026-116557 The WP Booking System - Booking Calendar plugin for WordPress is vulnerable to u... |
critical | 9.1 | — | — | 2026-10-31 | 2026-11-02 |
| CVE-2026-109220 The PDF Invoice for WooCommerce + Drag and Drop Template Builder plugin for Word... |
critical | 9.8 | — | — | 2026-10-31 | 2026-11-03 |
| CVE-2026-63377 TAKO AI Agent for Okta is a local-first AI agent that helps Okta administrators... |
critical | 9.8 | — | — | 2026-10-30 | 2026-11-02 |
| CVE-2026-62849 ThingLinks is an enterprise IoT platform. |
critical | 9.1 | — | — | 2026-10-30 | 2026-11-02 |
| CVE-2026-62853 ThingLinks is an enterprise IoT platform. |
critical | 9.9 | — | — | 2026-10-30 | 2026-11-02 |
| CVE-2026-62863 MoLing is a computer-use and browser-use based MCP server. |
critical | 9.6 | — | — | 2026-10-30 | 2026-11-02 |
| CVE-2026-78403 Stack-based buffer overflow and missing
authorization vulnerability in Thales Se... |
critical | 9.8 | — | — | 2026-10-30 | 2026-11-02 |
| CVE-2026-55598 PinePods is a complete, self-hosted podcast management system written in Rust. |
critical | 9.1 | — | — | 2026-10-30 | 2026-11-02 |
| CVE-2026-61620 HoneySQL turns Clojure data structures into SQL. |
critical | 9.8 | — | — | 2026-10-30 | 2026-11-02 |
| CVE-2026-116244 When a pgAdmin 4 connection was not meant to use a Kerberos user's delegated cre... |
critical | 9.6 | — | Pgadmin / pgadmin 4 | 2026-10-30 | 2026-11-04 |
| CVE-2026-116245 libpq looks a connection service up in the service file of the operating-system... |
critical | 9.6 | — | Pgadmin / pgadmin 4 | 2026-10-30 | 2026-11-04 |
| CVE-2026-116247 When a server in pgAdmin 4 had no password file, client certificate or client ke... |
critical | 9.6 | — | Pgadmin / pgadmin 4 | 2026-10-30 | 2026-11-04 |
| CVE-2026-116242 pgAdmin 4 opens SSH tunnels with the sshtunnel library but gave it neither host_... |
critical | 9.6 | — | Pgadmin / pgadmin 4 | 2026-10-30 | 2026-11-04 |
| CVE-2026-90888 Unauthenticated PHP Object Injection in LeadSnap <= 1.25 versions. |
critical | 9.8 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-39732 Unauthenticated SQL Injection in Transliterator <= 2.5.13 versions. |
critical | 9.3 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-39738 Deserialization of Untrusted Data vulnerability in Aman FunnelKit Automations wp... |
critical | 9.8 | — | — | 2026-10-30 | 2026-11-01 |
| CVE-2026-119526 Deserialization of Untrusted Data vulnerability in ThemeREX Royal Event allows O... |
critical | 9.8 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-116852 Author Remote Code Execution (RCE) in Widget Options <= 4.2.5 versions. |
critical | 9.1 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-116386 Unauthenticated Privilege Escalation in SMS Alert Order Notifications <= 4.0.2 v... |
critical | 9.8 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-118697 In JetBrains Toolbox App before 3.9.1 and 3.8.2; IntelliJ IDEA, PyCharm, PhpStor... |
critical | 9.0 | — | — | 2026-10-30 | 2026-11-02 |
| CVE-2026-61826 Bazarr is a companion application to Sonarr and Radarr. |
critical | 10.0 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2025-49602 An issue was discovered in Keyfactor EJBCA 9. |
critical | 9.8 | — | — | 2026-10-30 | 2026-11-04 |
| CVE-2026-119716 pybars3 through 0.9.7 and pybars4 through 0.9.13 contain a code injection vulner... |
critical | 9.8 | — | — | 2026-10-30 | 2026-11-02 |
| CVE-2026-119706 InternLM LMDeploy 0.9.0 through 0.18.0 contains an unauthenticated remote code e... |
critical | 9.8 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-61729 SOCFortress CoPilot focuses on providing a single pane of glass for all your sec... |
critical | 9.4 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-61730 SOCFortress CoPilot focuses on providing a single pane of glass for all your sec... |
critical | 9.3 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-61737 ng-antd-admin is an Angular and NestJS administration system template. |
critical | 9.8 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-61738 SOCFortress CoPilot focuses on providing a single pane of glass for all your sec... |
critical | 10.0 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-61728 SOCFortress CoPilot focuses on providing a single pane of glass for all your sec... |
critical | 9.9 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119660 MuseBot before 2.0.0 contains an authentication bypass vulnerability that allows... |
critical | 9.8 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-112905 Vvveb is a powerful and easy to use CMS with page builder to build websites, blo... |
critical | 9.0 | — | — | 2026-10-30 | 2026-11-04 |
| CVE-2026-110799 Vvveb is a powerful and easy to use CMS with page builder to build websites, blo... |
critical | 9.8 | — | — | 2026-10-30 | 2026-10-30 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.