October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
21,928
Critical
3,121
High
7,064
Medium
6,896
Low
608
Severity not reported
4,239
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (722), google (413), ibm (321), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-114123 D365 F&O MCP Server is a Model Context Protocol server for querying Dynamics 365... |
high | 7.5 | — | — | 2026-10-21 | 2026-10-30 |
| CVE-2026-114136 Django REST framework is a toolkit for building Web APIs. |
high | 7.5 | — | — | 2026-10-21 | 2026-10-30 |
| CVE-2026-106763 An issue in @justice8096/sagemath-mcp-server 1.0.1 allows a remote attacker to e... |
high | 7.5 | — | — | 2026-10-23 | 2026-10-30 |
| CVE-2026-100517 Unauthenticated Insecure Direct Object References (IDOR) in Photo Reviews for Wo... |
high | 7.5 | — | — | 2026-10-01 | 2026-10-30 |
| CVE-2026-107044 Insecure permissions in ProjectMAXS MAXS Main v0.5.19 (versionCode 19) allows un... |
high | 7.5 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-107047 Insecure permissions in mendhak GPSLogger versionCode 137 allows unauthorized at... |
high | 7.5 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-107049 An issue in Forkyz versionCode 8500000 allows attackers to arbitrarily change an... |
high | 7.5 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-107052 Insecure permissions in the AIDL interface of ProjectMAXS MAXS Module FileRead v... |
high | 7.5 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-107055 Insecure permissions in the autosave component of AppML neutriNote CE versionCod... |
high | 7.5 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-118763 sigstore-js provides JavaScript libraries for interacting with Sigstore services... |
high | 7.4 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-11587 SQL injection allowing an authenticated user with access to ACL management to re... |
high | 7.2 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-51905 TransformerOptimus SuperAGI v0.0.14 is vulnerable to Incorrect Access Control in... |
high | 8.8 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-86715 Plaintext storage of a password vulnerability in Crypttech Crypto and Informatic... |
high | 7.1 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-61804 myTinyWMS is a free, open-source warehouse management system. |
high | 8.1 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-61854 VoiceSentinel is a real-time voice moderation system for Minecraft servers. |
high | 8.2 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-62264 PDF Reader MCP is a Model Context Protocol server for reading PDF documents. |
high | 7.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-107347 HashiCorp Nomad and Nomad Enterprise are vulnerable to symlink following during... |
high | 8.4 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-119168 HashiCorp Nomad and Nomad Enterprise are vulnerable to symlink following during... |
high | 8.8 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-13303 HashiCorp Boundary and Boundary Enterprise are vulnerable to a server-side reque... |
high | 8.7 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-119286 GraphQL-core is a Python port of the GraphQL.js reference implementation. |
high | 7.5 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-119325 Bricks Theme 2.4 and before for WordPress contains an unauthenticated broken acc... |
high | 7.5 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-119409 OPNsense before 26.7.8 contains a command injection vulnerability that allows au... |
high | 7.2 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119420 Lago through 1.55.0 contains an authentication bypass vulnerability that allows... |
high | 8.8 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-112347 Kirki plugin for WordPress before 6.4.1 contains a broken object-level access co... |
high | 7.6 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2010-20125 DedeCMS before 5.7 contains a file inclusion vulnerability in plus/carbuyaction.... |
high | 7.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119649 Orchard CMS 1.10.3 through 1.11 contains an improper authorization vulnerability... |
high | 7.1 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119662 Songloft 2.9.0 before 2.13.6 contains a hardcoded credentials vulnerability that... |
high | 8.8 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119710 PipesHub 0.3.0 before 0.10.0 contains an event type injection vulnerability that... |
high | 7.1 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119713 Paperclip 2026.403.0 before 2026.416.0 contains a remote code execution vulnerab... |
high | 8.8 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119762 Axigen Mail Server before 10.5.69, 10.6.x before 10.6.40, and 10.7.x before 10.7... |
high | 7.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119619 A vulnerability was found in 37954679 cak-filemanagement-system up to 5e64332464... |
high | 7.3 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119620 A vulnerability was determined in 37954679 cak-filemanagement-system up to 5e643... |
high | 7.3 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-105077 Unauthenticated Cross Site Scripting (XSS) in Ad Inserter <= 2.8.19 versions. |
high | 7.1 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-116405 Unauthenticated Cross Site Scripting (XSS) in VikRentCar <= 1.4.9 versions. |
high | 7.1 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-116847 Unauthenticated Cross Site Scripting (XSS) in Mang Board WP <= 2.4.6 versions. |
high | 7.1 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-116851 Unauthenticated Cross Site Scripting (XSS) in eCommerce Product Catalog <= 3.6.5... |
high | 7.1 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-116861 Unauthenticated Sensitive Data Exposure in Flexible Chat <= 1.1.0 versions. |
high | 7.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-116862 Unauthenticated Broken Access Control in WP REST Cache <= 2026.3.1 versions. |
high | 7.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-118089 Shop manager PHP Object Injection in Product Feed Manager <= 7.14.1 versions. |
high | 7.2 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-118090 Subscriber PHP Object Injection in MasterStudy LMS <= 3.7.55 versions. |
high | 8.8 | — | — | 2026-10-30 | 2026-10-30 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.