October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,481
Critical
1,401
High
6,156
Medium
6,455
Low
659
Severity not reported
2,810
In CISA KEV
21
Most affected vendors (by CPE data where available): microsoft (1359), google (759), oracle (403), apple (305), ibm (149), adobe (138), apache (73), imagemagick (72), broadcom (61), freerdp (60)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-62121 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP... |
medium | 6.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-62122 Missing Authorization vulnerability in Arraytics Booktics booktics allows Exploi... |
medium | 5.3 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-62019 Missing Authorization vulnerability in Liquid Web / StellarWP BookIt bookit allo... |
medium | 4.3 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-62023 Missing Authorization vulnerability in Unlimited Elements Unlimited Elements For... |
medium | 4.3 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-62047 Missing Authorization vulnerability in Liquid Web / StellarWP Event Tickets even... |
medium | 4.3 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-62056 Missing Authorization vulnerability in WP ManageNinja LLC Fluent CRM fluent-crm... |
medium | 5.3 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-62057 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vu... |
medium | 5.3 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-54854 Contributor Privilege Escalation in Profile Builder <= 4.0.5 versions. |
medium | 6.3 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-52710 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vu... |
medium | 5.3 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-54850 Subscriber Broken Access Control in Booking and Rental Manager <= 2.8.2 versions... |
medium | 6.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-39739 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-27061 Subscriber Cross Site Scripting (XSS) in User Registration <= 5.3.0 versions. |
medium | 6.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119842 A flaw was found in GStreamer's gst-plugins-base MicroDVD subtitle parser. |
medium | 6.5 | — | — | 2026-10-30 | 2026-11-05 |
| CVE-2026-120007 NodeBB 1.18.0 through 4.16.5 contains an authorization bypass vulnerability that... |
medium | 6.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-120046 Nezha 2.0.0 before 2.4.0 contains a NULL pointer dereference vulnerability in Se... |
medium | 5.3 | — | — | 2026-10-30 | 2026-11-05 |
| CVE-2026-119727 A flaw was found in GStreamer's gst-plugins-bad H.265 video parser. |
medium | 6.5 | — | — | 2026-10-30 | 2026-11-05 |
| CVE-2026-119728 A flaw was found in the H.264 video parser in gst-plugins-bad. |
medium | 6.5 | — | — | 2026-10-30 | 2026-11-05 |
| CVE-2026-119729 A flaw was found in GStreamer. |
medium | 6.5 | — | — | 2026-10-30 | 2026-11-05 |
| CVE-2026-119117 Insertion of sensitive information into a log file in Amazon Kinesis Producer Li... |
medium | 6.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-116853 Unauthenticated Broken Access Control in GiveWP <= 4.19.0.1 versions. |
medium | 6.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-116854 Subscriber Cross Site Scripting (XSS) in WP Customer Area <= 8.4.0 versions. |
medium | 6.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-116410 Unauthenticated Arbitrary Content Deletion in Masteriyo - LMS <= 3.4.3 versions. |
medium | 6.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-115947 Unauthenticated Sensitive Data Exposure in HUSKY <= 1.4.6 versions. |
medium | 6.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-114711 Subscriber Cross Site Scripting (XSS) in MultiVendorX <= 5.0.20 versions. |
medium | 6.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-115604 Subscriber Arbitrary File Deletion in SureDash <= 1.12.3 versions. |
medium | 5.0 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-107868 Unauthenticated Bypass Vulnerability in YITH WooCommerce Product Add-Ons <= 4.34... |
medium | 5.3 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-104674 Missing Authorization vulnerability in Arraytics Booktics booktics allows Exploi... |
medium | 4.3 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-9239 The Meow Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripti... |
medium | 6.4 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-69446 Incorrect authorization in Microsoft Edge (Chromium-based) allows an authorized... |
medium | 4.4 | — | Microsoft / edge chromium | 2026-10-30 | 2026-11-03 |
| CVE-2026-13747 The Meow Gallery plugin for WordPress is vulnerable to authorization bypass in a... |
medium | 6.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119763 changelog.com before commit 7b35e829 contains a missing authorization vulnerabil... |
medium | 5.3 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119764 Mythic 3.2.16 through 3.4.0.61 contains a stored cross-site scripting vulnerabil... |
medium | 6.8 | — | — | 2026-10-30 | 2026-11-05 |
| CVE-2026-119761 Axigen Mail Server WebMail before 10.6.39 and 10.7.1 contains a stored cross-sit... |
medium | 6.1 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119086 Missing queue-set type validation in the queue-set selection system call in Free... |
medium | 6.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119113 The GeoDirectory – WP Business Directory Plugin and Classified Listings Director... |
medium | 6.4 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119176 The CP Multi View Events Calendar plugin for WordPress is vulnerable to Stored C... |
medium | 6.4 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-118635 The The GeoDirectory – WP Business Directory Plugin and Classified Listings Dire... |
medium | 6.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-115820 The Majestic Support – The Leading-Edge Help Desk & Customer Support Plugin plug... |
medium | 6.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-115869 The Themify Builder plugin for WordPress is vulnerable to Stored Cross-Site Scri... |
medium | 6.4 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-116552 The Like Button Rating ♥ LikeBtn plugin for WordPress is vulnerable to Stored Cr... |
medium | 4.7 | — | — | 2026-10-30 | 2026-10-30 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.