October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,481
Critical
1,397
High
6,114
Medium
6,454
Low
659
Severity not reported
2,857
In CISA KEV
21
Most affected vendors (by CPE data where available): microsoft (1359), google (759), oracle (403), apple (305), ibm (149), adobe (138), apache (73), imagemagick (72), broadcom (61), freerdp (60)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-101326 The The Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures... |
medium | 5.4 | — | — | 2026-10-31 | 2026-11-05 |
| CVE-2026-100155 The The Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures... |
medium | 6.5 | — | — | 2026-10-31 | 2026-11-02 |
| CVE-2026-63402 i18next is an internationalization framework for JavaScript. |
medium | 5.9 | — | — | 2026-10-30 | 2026-11-05 |
| CVE-2026-63410 secp256k1-native is a native C secp256k1 implementation for Ruby. |
medium | 5.9 | — | — | 2026-10-30 | 2026-11-02 |
| CVE-2026-61725 sevenz-rust2 is a Rust-native 7z compressor and `decompress`or. |
medium | 6.1 | — | — | 2026-10-30 | 2026-11-02 |
| CVE-2026-63121 Kubewarden policies is a collection of WebAssembly policies for securing and gov... |
medium | 6.3 | — | — | 2026-10-30 | 2026-11-05 |
| CVE-2026-63115 ActivityPub is a multi-tenant ActivityPub server for Ghost, built with Fedify. |
medium | 5.3 | — | — | 2026-10-30 | 2026-11-02 |
| CVE-2026-62277 LubeLogger is a self-hosted, open-source, web-based vehicle maintenance and fuel... |
medium | 6.5 | — | — | 2026-10-30 | 2026-11-02 |
| CVE-2026-55146 LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web app... |
medium | 4.3 | — | — | 2026-10-30 | 2026-11-02 |
| CVE-2026-55147 LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web app... |
medium | 6.3 | — | — | 2026-10-30 | 2026-11-02 |
| CVE-2026-62991 Shopper is a Headless e-commerce Admin Panel. |
medium | 6.5 | — | — | 2026-10-30 | 2026-11-02 |
| CVE-2026-62860 Picsou is a self-hosted personal finance dashboard. |
medium | 5.3 | — | — | 2026-10-30 | 2026-11-02 |
| CVE-2026-59993 Picotls is a TLS protocol library that allows users select different crypto back... |
medium | 6.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-62250 LibreDWG is a free C library to read and write DWG files. |
medium | 5.5 | — | — | 2026-10-30 | 2026-11-02 |
| CVE-2026-62254 LibreDWG is a free C library to read and write DWG files. |
medium | 5.5 | — | — | 2026-10-30 | 2026-11-02 |
| CVE-2026-62300 Filecoin Pin is an IPFS Pinning Service API implementation that pins to Filecoin... |
medium | 6.5 | — | — | 2026-10-30 | 2026-11-02 |
| CVE-2026-119342 Stirling-PDF is a locally hosted web application that facilitates various operat... |
medium | 5.3 | — | — | 2026-10-30 | 2026-11-05 |
| CVE-2026-119343 Stirling-PDF is a locally hosted web application that facilitates various operat... |
medium | 6.8 | — | — | 2026-10-30 | 2026-11-02 |
| CVE-2026-119340 Tesseract is an open source OCR engine. |
medium | 5.5 | — | — | 2026-10-30 | 2026-11-05 |
| CVE-2026-119339 Tesseract is an open source OCR engine. |
medium | 5.5 | — | — | 2026-10-30 | 2026-11-02 |
| CVE-2026-55098 Arc is an open, SQL-native time-series database for telemetry. |
medium | 6.5 | — | — | 2026-10-30 | 2026-11-02 |
| CVE-2026-55493 HotCRP is conference review software. |
medium | 6.5 | — | — | 2026-10-30 | 2026-11-05 |
| CVE-2026-119730 Maxthon Browser for Android before 7.5.8.103 contains an address bar spoofing vu... |
medium | 4.3 | — | — | 2026-10-30 | 2026-11-05 |
| CVE-2026-119328 Immich is a high-performance self-hosted photo and video management solution. |
medium | 6.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119329 Immich is a high-performance self-hosted photo and video management solution. |
medium | 4.3 | — | — | 2026-10-30 | 2026-11-02 |
| CVE-2026-116250 In server mode pgAdmin 4 validates a path a user gives for a file in their stora... |
medium | 6.5 | — | — | 2026-10-30 | 2026-11-02 |
| CVE-2026-116251 pgAdmin 4 did not invalidate a user's existing sessions when their password chan... |
medium | 5.4 | — | Pgadmin / pgadmin 4 | 2026-10-30 | 2026-11-04 |
| CVE-2026-116252 pgAdmin 4's materialized view refresh passed the target database's name to psql'... |
medium | 6.5 | — | Pgadmin / pgadmin 4 | 2026-10-30 | 2026-11-04 |
| CVE-2026-116248 In pgAdmin 4 server mode only administrators are meant to share a server with al... |
medium | 6.8 | — | — | 2026-10-30 | 2026-11-02 |
| CVE-2026-116240 In server mode pgAdmin 4 validates a path into the user's storage directory with... |
medium | 6.5 | — | Pgadmin / pgadmin 4 | 2026-10-30 | 2026-11-04 |
| CVE-2026-7003 WIT SynApps Runtime through 1.4.11 contains a hardcoded credentials vulnerabilit... |
medium | 5.3 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-7004 WIT SynApps Runtime through 1.4.11 contains a pre-authentication reflected cross... |
medium | 6.1 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-7005 WIT SynApps Runtime through 1.4.11 contains a browser-mediated cross-origin requ... |
medium | 6.1 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-62303 Pistache is a high-performance REST toolkit written in C++. |
medium | 5.9 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-62121 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP... |
medium | 6.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-62122 Missing Authorization vulnerability in Arraytics Booktics booktics allows Exploi... |
medium | 5.3 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-62019 Missing Authorization vulnerability in Liquid Web / StellarWP BookIt bookit allo... |
medium | 4.3 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-62023 Missing Authorization vulnerability in Unlimited Elements Unlimited Elements For... |
medium | 4.3 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-62047 Missing Authorization vulnerability in Liquid Web / StellarWP Event Tickets even... |
medium | 4.3 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-62056 Missing Authorization vulnerability in WP ManageNinja LLC Fluent CRM fluent-crm... |
medium | 5.3 | — | — | 2026-10-30 | 2026-10-30 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.