October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
21,928
Critical
3,121
High
7,064
Medium
6,896
Low
608
Severity not reported
4,239
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (722), google (413), ibm (321), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-110732 The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPre... |
high | 7.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-110305 The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to Sensi... |
high | 7.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-107039 Insecure permissions in the ActivityMain component of M66B/Marcel Bokhorst NetGu... |
high | 7.5 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-105894 The Ak Framework plugin for WordPress, included in the Newsy - Viral News & Maga... |
high | 8.8 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-104744 The Independent Analytics Pro plugin for WordPress is vulnerable to Stored Cross... |
high | 7.2 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2024-9341 A flaw was found in Go. |
high | 8.2 | — | Containers / common | 2024-10-01 | 2026-10-30 |
| CVE-2024-12397 A flaw was found in Quarkus-HTTP, which incorrectly parses cookies with
certain... |
high | 7.4 | — | — | 2024-12-12 | 2026-10-30 |
| CVE-2013-0261 A flaw was found in PackStack. |
high | 8.8 | — | Openstack / essex | 2013-03-08 | 2026-10-30 |
| CVE-2026-119549 Jellyfin through 12.4 contains a server-side request forgery vulnerability that... |
high | 7.1 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119418 CakePHP through 5.4.3 contains an sql injection vulnerability that allows attack... |
high | 8.1 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-107630 The Email Templates Customizer and Designer for WordPress and WooCommerce plugin... |
high | 7.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-9535 A out-of-bounds read vulnerability exists in the vtkChacoReader InputGraph2 func... |
high | 8.2 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-9536 A heap-based buffer overflow vulnerability exists in the vtkWindBladeReader Find... |
high | 7.5 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-90867 Improper access control in the Web Admin console of Progress Software WS_FTP Ser... |
high | 8.1 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-90869 A remote attacker who knows a valid account's enrolled SSH public key can termin... |
high | 7.5 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-8822 A memory corruption vulnerability exists in the vtkDEMReader ReadProfiles functi... |
high | 7.5 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-8824 A memory corruption vulnerability exists in the vtkBMPReader ExecuteDataWithInfo... |
high | 7.5 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-86398 Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS... |
high | 8.8 | — | — | 2026-10-28 | 2026-10-30 |
| CVE-2026-86399 Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS... |
high | 7.2 | — | — | 2026-10-28 | 2026-10-30 |
| CVE-2026-86396 Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS... |
high | 8.8 | — | — | 2026-10-28 | 2026-10-30 |
| CVE-2026-86394 Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS... |
high | 7.2 | — | — | 2026-10-28 | 2026-10-30 |
| CVE-2026-74755 An integer underflow in the mcpack2pb component of Apache bRPC (version < 1.18.0... |
high | 7.5 | — | — | 2026-10-21 | 2026-10-30 |
| CVE-2026-65824 OpenReception's appointment booking software provides an end-to-end encrypted ap... |
high | 7.4 | — | — | 2026-10-23 | 2026-10-30 |
| CVE-2026-65566 Cross-Site Request Forgery (CSRF) vulnerability in Meow Apps AI Engine ai-engine... |
high | 8.8 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-41114 Uncontrolled Resource Consumption vulnerability in Apache IoTDB JDBC driver. |
high | 7.5 | — | — | 2026-10-21 | 2026-10-30 |
| CVE-2026-41216 An invalid pointer dereference vulnerability exists in the vtkPNGReader::Execute... |
high | 7.5 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-42057 An invalid pointer dereference vulnerability exists in the vtkPNGReader::vtkPNGR... |
high | 7.5 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-15816 A flaw was found in dracut. |
high | 7.5 | — | — | 2026-08-07 | 2026-10-30 |
| CVE-2026-116638 The Windows Recovery Environment (WinRE) in Windows 10 and 11 may allow an attac... |
high | 7.5 | — | — | 2026-10-26 | 2026-10-30 |
| CVE-2026-118759 Kubeflow Pipelines enables users to build and deploy portable, scalable machine... |
high | 7.5 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-115805 Improper handling of local filesystem paths in Rapid7 Insight Agent on Linux and... |
high | 7.8 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-115708 Improper Link Resolution Before File Access ('Link Following') (CWE-59) in Elast... |
high | 7.2 | — | Elastic / elastic cloud enterprise | 2026-10-29 | 2026-10-30 |
| CVE-2026-115709 Improper Link Resolution Before File Access ('Link Following') (CWE-59) in Elast... |
high | 8.2 | — | Elastic / elastic cloud enterprise | 2026-10-29 | 2026-10-30 |
| CVE-2026-112921 Robots::Validate versions from 0.4.3 before 0.4.10 for Perl report clients as im... |
high | 7.3 | — | — | 2026-10-21 | 2026-10-30 |
| CVE-2026-110196 IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote attacker with a low-p... |
high | 8.8 | — | Langflow / langflow | 2026-10-29 | 2026-10-30 |
| CVE-2026-107326 IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacke... |
high | 8.8 | — | Langflow / langflow | 2026-10-29 | 2026-10-30 |
| CVE-2026-107327 IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacke... |
high | 8.8 | — | Langflow / langflow | 2026-10-29 | 2026-10-30 |
| CVE-2026-107329 IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacke... |
high | 8.8 | — | Langflow / langflow | 2026-10-29 | 2026-10-30 |
| CVE-2026-106781 An issue in WCH CH340/CH341 USB-to-Serial Windows Driver setup package CH341SER.... |
high | 7.8 | — | — | 2026-10-26 | 2026-10-30 |
| CVE-2026-106972 Uncontrolled recursion in MessagePack\BufferUnpacker::unpack() in rybakit/msgpac... |
high | 7.5 | — | — | 2026-10-28 | 2026-10-30 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.