October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,481
Critical
1,401
High
6,159
Medium
6,457
Low
659
Severity not reported
2,805
In CISA KEV
21
Most affected vendors (by CPE data where available): microsoft (1359), google (759), oracle (403), apple (322), ibm (149), adobe (138), apache (73), imagemagick (72), broadcom (61), freerdp (60)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-118095 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-118097 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-116846 Missing Authorization vulnerability in WP User Manager WP User Manager wp-user-m... |
medium | 5.3 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-116849 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-116850 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-116856 Missing Authorization vulnerability in WP Desk Flexible Quantity – Measurement P... |
medium | 5.3 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-118088 Missing Authorization vulnerability in WPFunnels Team WPFunnels wpfunnels allows... |
medium | 5.3 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-118091 Missing Authorization vulnerability in WPFunnels Team WPFunnels wpfunnels allows... |
medium | 5.3 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-116387 Missing Authorization vulnerability in Brainstorm Force SureForms sureforms allo... |
medium | 5.3 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-116406 Missing Authorization vulnerability in Webba Plugins Webba Booking webba-booking... |
medium | 4.3 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-115711 Insertion of Sensitive Information into Externally-Accessible File or Directory... |
medium | 6.4 | — | Elastic / elastic cloud enterprise | 2026-10-29 | 2026-10-30 |
| CVE-2026-115712 Incorrect Authorization (CWE-863) in Elastic Cloud Enterprise (ECE) can lead to... |
medium | 4.3 | — | Elastic / elastic cloud enterprise | 2026-10-29 | 2026-10-30 |
| CVE-2026-115601 Missing Authorization vulnerability in WP Desk Custom Price for WooCommerce cust... |
medium | 5.3 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-115605 Missing Authorization vulnerability in Brainstorm Force SureDash suredash allows... |
medium | 4.3 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-115610 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-115706 Authorization Bypass Through User-Controlled Key (CWE-639) in Elastic Cloud Ente... |
medium | 6.8 | — | Elastic / elastic cloud enterprise | 2026-10-29 | 2026-10-30 |
| CVE-2026-115707 Insertion of Sensitive Information into Externally-Accessible File or Directory... |
medium | 6.4 | — | Elastic / elastic cloud enterprise | 2026-10-29 | 2026-10-30 |
| CVE-2026-107023 Insecure permissions in the ContentProvider component of mhss1 MyBrain v3.1.0 al... |
medium | 6.5 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-110881 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-114181 Missing Authorization vulnerability in Magepeople inc. |
medium | 5.3 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-114706 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-93009 A flaw was found in dnsmasq. |
medium | 4.3 | — | — | 2026-10-29 | 2026-11-04 |
| CVE-2026-93010 A flaw was found in dnsmasq. |
medium | 4.3 | — | — | 2026-10-29 | 2026-11-03 |
| CVE-2026-48202 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vu... |
medium | 5.3 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-54862 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-42707 Missing Authorization vulnerability in HivePress HivePress Claim Listings hivepr... |
medium | 4.3 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-48195 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-25467 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vu... |
medium | 5.3 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-39782 Missing Authorization vulnerability in Kaliforms Kali Forms kali-forms allows Ex... |
medium | 5.3 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-119051 flat through 6.0.1 contains an uncontrolled resource allocation vulnerability in... |
medium | 5.9 | — | — | 2026-10-29 | 2026-11-03 |
| CVE-2026-119053 lwIP 2.0.0 through 2.2.1 built with the SNMP agent contains an out-of-bounds rea... |
medium | 5.3 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-119054 Multiple Pages Generator by Themeisle before 4.2.5 contains a stored cross-site... |
medium | 5.4 | — | — | 2026-10-29 | 2026-11-04 |
| CVE-2026-118425 A flaw was found in the secure-redirect-uris-enforcer client policy of Keycloak,... |
medium | 6.8 | — | — | 2026-10-29 | 2026-11-02 |
| CVE-2026-119048 JeeSite 5.11.0 through 5.19.1 contains an insecure direct object reference vulne... |
medium | 4.2 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-116402 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vu... |
medium | 5.3 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-116857 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-93008 A flaw was found in dnsmasq. |
medium | 6.8 | — | — | 2026-10-29 | 2026-11-05 |
| CVE-2026-93011 A flaw was found in dnsmasq. |
medium | 5.3 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-93006 A flaw was found in dnsmasq. |
medium | 6.8 | — | — | 2026-10-29 | 2026-11-02 |
| CVE-2026-93007 A flaw was found in dnsmasq. |
medium | 5.3 | — | — | 2026-10-29 | 2026-10-30 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.