October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,481
Critical
1,401
High
6,156
Medium
6,455
Low
659
Severity not reported
2,810
In CISA KEV
21
Most affected vendors (by CPE data where available): microsoft (1359), google (759), oracle (403), apple (305), ibm (149), adobe (138), apache (73), imagemagick (72), broadcom (61), freerdp (60)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-110533 The FV Flowplayer Video Player plugin for WordPress is vulnerable to Stored Cros... |
medium | 6.4 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-109592 The OpenStation: Desktop Windows, Dock & Virtual Desktops for WP Admin plugin fo... |
medium | 4.3 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-109984 The FV Flowplayer Video Player plugin for WordPress is vulnerable to Stored Cros... |
medium | 5.4 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-110001 The FV Flowplayer Video Player plugin for WordPress is vulnerable to Stored Cros... |
medium | 5.4 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-104739 The JS Help Desk – AI-Powered Support & Ticketing System plugin for WordPress is... |
medium | 4.9 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-102905 The The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerabl... |
medium | 6.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-102918 The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scri... |
medium | 6.4 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-62055 Missing Authorization vulnerability in Liquid Web / StellarWP Event Tickets even... |
medium | 4.3 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-50000 SecureDrop is an open-source whistleblower submission system that media organiza... |
medium | 5.0 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-55551 ZAC is an open-source, workflow-based Common Ground component for Dutch municipa... |
medium | 6.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-37468 Cross Site Scripting vulnerability in BeeHome MyBeeHome before 2025-11-01 allows... |
medium | 6.1 | — | — | 2026-10-30 | 2026-11-02 |
| CVE-2026-119466 Cross-Site Request Forgery (CSRF) vulnerability in WPExperts APIExperts Square f... |
medium | 5.4 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119298 croc is a tool that allows any two computers to simply and securely transfer fil... |
medium | 4.2 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119299 gopacket provides packet processing capabilities for Go. |
medium | 5.9 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119300 Wekan is open source kanban built with Meteor. |
medium | 6.5 | — | — | 2026-10-30 | 2026-11-04 |
| CVE-2026-119365 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119367 Missing Authorization vulnerability in Liquid Web / StellarWP The Events Calenda... |
medium | 5.4 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119148 Incomplete string validation in AWS aws-nitro-enclaves-sdk-c before 0.4.6 may al... |
medium | 6.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-104623 A security vulnerability exists in the authorization handling for the local (man... |
medium | 6.3 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-62141 Missing Authorization vulnerability in WP ManageNinja LLC Fluent CRM fluent-crm... |
medium | 5.4 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119720 Blender before 4.5.15 and 5.x before 5.2.3 contains a heap out-of-bounds read vu... |
medium | 5.5 | — | Blender / blender | 2026-10-30 | 2026-11-03 |
| CVE-2026-119721 Blender before 4.5.15 and 5.x before 5.2.3 contains an out-of-bounds read vulner... |
medium | 6.1 | — | Blender / blender | 2026-10-30 | 2026-11-03 |
| CVE-2026-119711 PipesHub before 0.10.0 contains a rate limit bypass vulnerability in getClientIp... |
medium | 5.3 | — | — | 2026-10-30 | 2026-11-04 |
| CVE-2026-119712 PipesHub before 0.10.0 contains a server-side request forgery vulnerability in I... |
medium | 6.4 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119714 My Calendar WordPress plugin 3.8.8 before 3.8.11 contains a shortcode injection... |
medium | 6.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119715 NocoDB before 2026.08.0 contains a clickjacking vulnerability that allows any or... |
medium | 4.3 | — | — | 2026-10-30 | 2026-11-04 |
| CVE-2026-119708 abp-next-admin 10.4.0 through 10.7.0 contains a cross-tenant authorization bypas... |
medium | 6.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119709 Grimoire before 1.0.0 contains an unauthenticated server-side request forgery vu... |
medium | 5.8 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119703 xiaozhi-esp32-server through 0.9.8 contains an authentication bypass vulnerabili... |
medium | 4.8 | — | — | 2026-10-30 | 2026-11-04 |
| CVE-2026-119704 Bastille through 1.4.4 contains a symlink following vulnerability in the cp.sh,... |
medium | 6.8 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119705 SerpBear before 3.1.1 contains a missing authentication vulnerability in pages/a... |
medium | 5.3 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119699 WPGraphQL Smart Cache before 2.3.3 contains an uncontrolled resource consumption... |
medium | 5.3 | — | — | 2026-10-30 | 2026-11-04 |
| CVE-2026-119700 WPGraphQL before 2.24.2 contains an information disclosure vulnerability that al... |
medium | 5.3 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119701 WPGraphQL before 2.24.1 contains a missing rate limiting vulnerability that allo... |
medium | 5.3 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119702 WPGraphQL before 2.24.1 contains a missing authorization vulnerability in the cr... |
medium | 6.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119479 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vu... |
medium | 5.3 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119291 Zuke is a code-first, strongly typed build automation system for Deno. |
medium | 5.5 | — | — | 2026-10-30 | 2026-11-04 |
| CVE-2026-119369 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-116407 Missing Authorization vulnerability in Webba Plugins Webba Booking webba-booking... |
medium | 5.4 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-104063 Scribus before 1.6.7 and 1.7.x before 1.7.4 contains an out-of-bounds read vulne... |
medium | 6.1 | — | — | 2026-10-30 | 2026-11-02 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.