October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,481
Critical
1,401
High
6,159
Medium
6,457
Low
659
Severity not reported
2,805
In CISA KEV
21
Most affected vendors (by CPE data where available): microsoft (1359), google (759), oracle (403), apple (322), ibm (149), adobe (138), apache (73), imagemagick (72), broadcom (61), freerdp (60)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-52709 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-56056 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-48196 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-39735 Missing Authorization vulnerability in Crocoblock JetEngine jet-engine allows Ex... |
medium | 6.5 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-39741 Missing Authorization vulnerability in RelyWP Simple Cloudflare Turnstile simple... |
medium | 5.3 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-42703 Missing Authorization vulnerability in Kaliforms Kali Forms kali-forms allows Ex... |
medium | 6.5 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-22386 Missing Authorization vulnerability in Ahmad WP Job Portal wp-job-portal allows... |
medium | 4.3 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-24533 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-118087 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-118093 Missing Authorization vulnerability in WPFunnels Team Product Feed Manager best-... |
medium | 5.3 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-118094 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-92086 The MW WP Form plugin for WordPress is vulnerable to Sensitive Information Expos... |
medium | 5.3 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-97860 YMS-VPN8 and YMS-VPN8-CP provided by Yamaha Corporation register Windows service... |
medium | 6.7 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-27401 Missing Authorization vulnerability in YITH YITH PayPal Express Checkout for Woo... |
medium | 5.3 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-109216 The Meta Box – A Framework for Dynamic Websites plugin for WordPress is vulnerab... |
medium | 4.9 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-109822 Yamaha wireless LAN router NWR100 provided by Yamaha Corporation contains an iss... |
medium | 6.5 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-71569 Server-Side Request Forgery (SSRF) vulnerability in Apache Camel A2A component. |
medium | 4.8 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-118984 OmniRoute 3.8.0 before 3.8.52 contains an unverified password change vulnerabili... |
medium | 5.5 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-118989 WebToffee Product Import Export for WooCommerce 2.5.1 before 2.6.8 contains a se... |
medium | 5.5 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-115962 Authentication Bypass by Spoofing vulnerability in myCred myCred mycred allows I... |
medium | 4.3 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-88941 Kaspersky has fixed a vulnerability in the Network Agent for Windows module of K... |
medium | 5.2 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-91152 The Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Build... |
medium | 6.1 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-91153 The Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Build... |
medium | 5.3 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-111318 The HT Mega Addons for Elementor – Elementor Widgets & Template Builder plugin f... |
medium | 5.4 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-116763 The LiteSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site Scri... |
medium | 5.4 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-118192 The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for Wo... |
medium | 6.5 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-104727 The Sequential Order Numbers for WooCommerce plugin for WordPress is vulnerable... |
medium | 6.4 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-107627 The Greenshift – animation and page builder blocks plugin for WordPress is vulne... |
medium | 5.4 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-107629 The Greenshift – animation and page builder blocks plugin for WordPress is vulne... |
medium | 5.4 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-109215 The LiteSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site Scri... |
medium | 6.4 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-110707 The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video... |
medium | 4.7 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-103875 The Media Library Assistant plugin for WordPress is vulnerable to Reflected Cros... |
medium | 4.7 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-103485 The Extensions for Leaflet Map plugin for WordPress is vulnerable to Stored DOM-... |
medium | 5.4 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-117548 A NULL pointer dereference flaw was found in 389-ds-base. |
medium | 6.5 | — | — | 2026-10-29 | 2026-11-05 |
| CVE-2026-117627 A flaw was found in the JWT Authorization Grant implementation of the keycloak-s... |
medium | 5.4 | — | — | 2026-10-29 | 2026-11-03 |
| CVE-2026-117688 A flaw was found in the client registration component of Keycloak, an open-sourc... |
medium | 5.3 | — | — | 2026-10-29 | 2026-11-02 |
| CVE-2026-117859 A flaw was found in the Pushed Authorization Request PAR implementation of the k... |
medium | 5.4 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-118030 A flaw was found in the HOTP authentication mechanism of the keycloak-services c... |
medium | 4.2 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-78395 The Link Library WordPress plugin before 7.10.0 does not re-check the selected l... |
medium | 5.3 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-78396 The Link Library WordPress plugin before 7.10.0 does not verify that a requested... |
medium | 5.3 | — | — | 2026-10-29 | 2026-10-29 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.