October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,481
Critical
1,401
High
6,157
Medium
6,455
Low
659
Severity not reported
2,809
In CISA KEV
21
Most affected vendors (by CPE data where available): microsoft (1359), google (759), oracle (403), apple (310), ibm (149), adobe (138), apache (73), imagemagick (72), broadcom (61), freerdp (60)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-119121 Crawl4AI from 0.9.0 before 0.9.5 contains a JavaScript injection vulnerability i... |
medium | 4.3 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-119122 Crawl4AI before 0.9.5 contains a blind server-side request forgery vulnerability... |
medium | 5.3 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-118084 Subscriber Insecure Direct Object References (IDOR) in Hotel Booking <= 3.8 vers... |
medium | 6.5 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-116848 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-113576 Adobe Digital Editions is affected by an Improper Limitation of a Pathname to a... |
medium | 6.3 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-110192 IBM Langflow OSS 1.0.0 through 1.12.8 could allow a remote authenticated attacke... |
medium | 6.5 | — | Langflow / langflow | 2026-10-29 | 2026-11-04 |
| CVE-2026-110200 IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacke... |
medium | 6.5 | — | Langflow / langflow | 2026-10-29 | 2026-11-03 |
| CVE-2026-110244 IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacke... |
medium | 6.5 | — | Langflow / langflow | 2026-10-29 | 2026-10-30 |
| CVE-2026-109891 Missing Authorization vulnerability in weDevs Happy Addons for Elementor happy-e... |
medium | 6.4 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-110190 IBM Langflow OSS 1.0.0 through 1.12.4 could allow an authenticated user to trave... |
medium | 6.5 | — | Langflow / langflow | 2026-10-29 | 2026-10-30 |
| CVE-2026-107033 Insecure permissions in the MirakelInternalContentProvider component of Mirakel... |
medium | 6.5 | — | — | 2026-10-29 | 2026-11-03 |
| CVE-2026-107035 Insecure permissions in the object/Page.java component of MBasov OMN Outline not... |
medium | 6.5 | — | — | 2026-10-29 | 2026-11-03 |
| CVE-2026-107036 Insecure permissions in Mission Control / AIMSICD versionCode 2026080501 allows... |
medium | 5.1 | — | — | 2026-10-29 | 2026-11-02 |
| CVE-2026-104331 IBM Langflow OSS 1.0.0 through 1.12.3 is vulnerable to server-side request forge... |
medium | 5.4 | — | Langflow / langflow | 2026-10-29 | 2026-11-04 |
| CVE-2026-104308 IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacke... |
medium | 4.3 | — | Langflow / langflow | 2026-10-29 | 2026-11-04 |
| CVE-2026-104309 IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacke... |
medium | 6.5 | — | Langflow / langflow | 2026-10-29 | 2026-10-30 |
| CVE-2026-104310 IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacke... |
medium | 4.3 | — | Langflow / langflow | 2026-10-29 | 2026-11-02 |
| CVE-2026-104312 IBM Langflow OSS 1.0.0 through 1.12.3 could allow an authenticated attacker to p... |
medium | 6.8 | — | Langflow / langflow | 2026-10-29 | 2026-11-03 |
| CVE-2026-104314 IBM Langflow OSS 1.0.0 through 1.12.3 could allow an authenticated attacker with... |
medium | 6.5 | — | Langflow / langflow | 2026-10-29 | 2026-10-30 |
| CVE-2026-104315 IBM Langflow OSS 1.0.0 through 1.12.3 is vulnerable to server-side request forge... |
medium | 4.3 | — | Langflow / langflow | 2026-10-29 | 2026-11-04 |
| CVE-2026-104316 IBM Langflow OSS 1.0.0 through 1.12.3 could allow an authenticated attacker to c... |
medium | 6.5 | — | Langflow / langflow | 2026-10-29 | 2026-10-30 |
| CVE-2025-13050 Broken Function Level Authorization allows execution of poller post-restart comm... |
medium | 5.4 | — | — | 2026-10-29 | 2026-11-04 |
| CVE-2026-97073 Missing Authorization vulnerability in myCred myCred mycred allows Exploiting In... |
medium | 5.3 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-80067 MasterStudy LMS plugin for WordPress before 3.7.50 contains a path traversal vul... |
medium | 5.4 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-80069 MasterStudy LMS plugin for WordPress before 3.7.50 contains a missing authorizat... |
medium | 5.4 | — | — | 2026-10-29 | 2026-11-02 |
| CVE-2026-42691 Authorization Bypass Through User-Controlled Key vulnerability in EventPrime Eve... |
medium | 5.4 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-48884 Missing Authorization vulnerability in weDevs WP User Frontend wp-user-frontend... |
medium | 5.3 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-52708 Missing Authorization vulnerability in weDevs WP User Frontend wp-user-frontend... |
medium | 4.3 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-54852 Missing Authorization vulnerability in miniOrange Page Restriction WordPress (WP... |
medium | 5.3 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-54853 Missing Authorization vulnerability in Cozmoslabs Profile Builder profile-builde... |
medium | 5.3 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-54871 Missing Authorization vulnerability in Mamunur Rashid ShopBuilder – Elementor Wo... |
medium | 5.3 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-25448 Missing Authorization vulnerability in weDevs WP ERP erp allows Exploiting Incor... |
medium | 4.3 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-25450 Missing Authorization vulnerability in ThemeGrill User Registration user-registr... |
medium | 5.3 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-27062 Cross-Site Request Forgery (CSRF) vulnerability in WPFunnels Team WPFunnels wpfu... |
medium | 4.3 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-27063 Missing Authorization vulnerability in Kit Kit (formerly ConvertKit) convertkit... |
medium | 5.3 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-39737 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-39742 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-118092 Missing Authorization vulnerability in StylemixThemes MasterStudy LMS masterstud... |
medium | 4.3 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-118095 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-118097 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-29 | 2026-10-29 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.