October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,481
Critical
1,397
High
6,114
Medium
6,454
Low
659
Severity not reported
2,857
In CISA KEV
21
Most affected vendors (by CPE data where available): microsoft (1359), google (759), oracle (403), apple (305), ibm (149), adobe (138), apache (73), imagemagick (72), broadcom (61), freerdp (60)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-62057 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vu... |
medium | 5.3 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-54854 Contributor Privilege Escalation in Profile Builder <= 4.0.5 versions. |
medium | 6.3 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-52710 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vu... |
medium | 5.3 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-54850 Subscriber Broken Access Control in Booking and Rental Manager <= 2.8.2 versions... |
medium | 6.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-39739 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-27061 Subscriber Cross Site Scripting (XSS) in User Registration <= 5.3.0 versions. |
medium | 6.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119842 A flaw was found in GStreamer's gst-plugins-base MicroDVD subtitle parser. |
medium | 6.5 | — | — | 2026-10-30 | 2026-11-03 |
| CVE-2026-120007 NodeBB 1.18.0 through 4.16.5 contains an authorization bypass vulnerability that... |
medium | 6.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-120046 Nezha 2.0.0 before 2.4.0 contains a NULL pointer dereference vulnerability in Se... |
medium | 5.3 | — | — | 2026-10-30 | 2026-11-05 |
| CVE-2026-119727 A flaw was found in GStreamer's gst-plugins-bad H.265 video parser. |
medium | 6.5 | — | — | 2026-10-30 | 2026-11-04 |
| CVE-2026-119728 A flaw was found in the H.264 video parser in gst-plugins-bad. |
medium | 6.5 | — | — | 2026-10-30 | 2026-11-04 |
| CVE-2026-119729 A flaw was found in GStreamer. |
medium | 6.5 | — | — | 2026-10-30 | 2026-11-03 |
| CVE-2026-119117 Insertion of sensitive information into a log file in Amazon Kinesis Producer Li... |
medium | 6.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-116853 Unauthenticated Broken Access Control in GiveWP <= 4.19.0.1 versions. |
medium | 6.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-116854 Subscriber Cross Site Scripting (XSS) in WP Customer Area <= 8.4.0 versions. |
medium | 6.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-116410 Unauthenticated Arbitrary Content Deletion in Masteriyo - LMS <= 3.4.3 versions. |
medium | 6.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-115947 Unauthenticated Sensitive Data Exposure in HUSKY <= 1.4.6 versions. |
medium | 6.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-114711 Subscriber Cross Site Scripting (XSS) in MultiVendorX <= 5.0.20 versions. |
medium | 6.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-115604 Subscriber Arbitrary File Deletion in SureDash <= 1.12.3 versions. |
medium | 5.0 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-107868 Unauthenticated Bypass Vulnerability in YITH WooCommerce Product Add-Ons <= 4.34... |
medium | 5.3 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-104674 Missing Authorization vulnerability in Arraytics Booktics booktics allows Exploi... |
medium | 4.3 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-9239 The Meow Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripti... |
medium | 6.4 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-69446 Incorrect authorization in Microsoft Edge (Chromium-based) allows an authorized... |
medium | 4.4 | — | Microsoft / edge chromium | 2026-10-30 | 2026-11-03 |
| CVE-2026-13747 The Meow Gallery plugin for WordPress is vulnerable to authorization bypass in a... |
medium | 6.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119763 changelog.com before commit 7b35e829 contains a missing authorization vulnerabil... |
medium | 5.3 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119764 Mythic 3.2.16 through 3.4.0.61 contains a stored cross-site scripting vulnerabil... |
medium | 6.8 | — | — | 2026-10-30 | 2026-11-05 |
| CVE-2026-119761 Axigen Mail Server WebMail before 10.6.39 and 10.7.1 contains a stored cross-sit... |
medium | 6.1 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119086 Missing queue-set type validation in the queue-set selection system call in Free... |
medium | 6.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119113 The GeoDirectory – WP Business Directory Plugin and Classified Listings Director... |
medium | 6.4 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119176 The CP Multi View Events Calendar plugin for WordPress is vulnerable to Stored C... |
medium | 6.4 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-118635 The The GeoDirectory – WP Business Directory Plugin and Classified Listings Dire... |
medium | 6.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-115820 The Majestic Support – The Leading-Edge Help Desk & Customer Support Plugin plug... |
medium | 6.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-115869 The Themify Builder plugin for WordPress is vulnerable to Stored Cross-Site Scri... |
medium | 6.4 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-116552 The Like Button Rating ♥ LikeBtn plugin for WordPress is vulnerable to Stored Cr... |
medium | 4.7 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-110533 The FV Flowplayer Video Player plugin for WordPress is vulnerable to Stored Cros... |
medium | 6.4 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-109592 The OpenStation: Desktop Windows, Dock & Virtual Desktops for WP Admin plugin fo... |
medium | 4.3 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-109984 The FV Flowplayer Video Player plugin for WordPress is vulnerable to Stored Cros... |
medium | 5.4 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-110001 The FV Flowplayer Video Player plugin for WordPress is vulnerable to Stored Cros... |
medium | 5.4 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-104739 The JS Help Desk – AI-Powered Support & Ticketing System plugin for WordPress is... |
medium | 4.9 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-102905 The The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerabl... |
medium | 6.5 | — | — | 2026-10-30 | 2026-10-30 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.