October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,481
Critical
1,401
High
6,159
Medium
6,457
Low
659
Severity not reported
2,805
In CISA KEV
21
Most affected vendors (by CPE data where available): microsoft (1359), google (759), oracle (403), apple (322), ibm (149), adobe (138), apache (73), imagemagick (72), broadcom (61), freerdp (60)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-88928 The PAYCOMET for WooCommerce WordPress plugin before 5.46 does not verify the cr... |
medium | 6.5 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-93293 The Password Protected plugin for WordPress is vulnerable to Stored Cross-Site S... |
medium | 6.4 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-115302 The Contact Form by Supsystic WordPress plugin before 1.11.1 does not restrict a... |
medium | 5.3 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-19610 A flaw was found in the platform-mbean component of JBoss EAP, which provides ma... |
medium | 6.5 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-115259 The Photo Engine (Media Organizer & Lightroom) WordPress plugin before 6.6.0 doe... |
medium | 4.9 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-115282 The Recipe Card Blocks Lite WordPress plugin before 3.6.4 does not perform an au... |
medium | 5.3 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-115299 The Contact Form by Supsystic WordPress plugin before 1.11.1 does not verify a C... |
medium | 5.4 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-115300 The Contact Form by Supsystic WordPress plugin before 1.11.1 does not validate a... |
medium | 4.3 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-110030 The Hide Price Until Login WordPress plugin before 1.1.2 does not restrict a gue... |
medium | 5.3 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-110504 The Enable SVG, WebP, and ICO Upload WordPress plugin before 1.1.6 does not sani... |
medium | 6.8 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-110505 The Enable SVG, WebP, and ICO Upload WordPress plugin before 1.1.6 does not prev... |
medium | 6.8 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-110983 The WP Photo Album Plus WordPress plugin before 9.3.04.004 does not verify the o... |
medium | 4.3 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-114270 The GeoDirectory WordPress plugin before 2.8.197 does not honour post password p... |
medium | 5.3 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-108763 The Wallet System for WooCommerce WordPress plugin before 2.8.2 does not restric... |
medium | 4.3 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-40063 A information disclosure vulnerability exists in the /nodered/fuxa/scripts funct... |
medium | 5.3 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-42949 A authorization bypass vulnerability exists in the /api/runscript functionality... |
medium | 5.6 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-113409 The Ortto plugin for WordPress before 1.0.25 did not escape stored settings on i... |
medium | 4.8 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-114173 The Ortto plugin for WordPress before 1.0.25 did not filter the WooCommerce prod... |
medium | 5.3 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-113957 An attacker who controls the registry, a mirror, or the network path to it may b... |
medium | 5.6 | — | — | 2026-10-29 | 2026-11-04 |
| CVE-2026-118590 A security vulnerability has been detected in nipy nibabel up to 5.4.2. |
medium | 5.3 | — | — | 2026-10-29 | 2026-11-04 |
| CVE-2026-118586 A security flaw has been discovered in dfm feedfinder2 up to 0.0.4. |
medium | 5.3 | — | — | 2026-10-29 | 2026-11-03 |
| CVE-2026-118589 A weakness has been identified in nschloe meshio up to 5.3.5. |
medium | 5.3 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-86983 A remote attacker may be able to terminate a process that passes attacker-contro... |
medium | 5.9 | — | — | 2026-10-28 | 2026-11-04 |
| CVE-2026-75520 Domoticz is a free, open source home automation system for Linux, Windows, macOS... |
medium | 5.4 | — | — | 2026-10-28 | 2026-11-03 |
| CVE-2026-82411 Open Object provides an API and admin interface to manage objects and object typ... |
medium | 6.5 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-118577 A vulnerability was identified in maotoumao MusicFreeDesktop 0.0.6/0.0.7/0.0.8. |
medium | 6.3 | — | — | 2026-10-28 | 2026-11-03 |
| CVE-2026-118578 A security flaw has been discovered in maotoumao MusicFreeDesktop 0.0.6/0.0.7/0.... |
medium | 4.3 | — | — | 2026-10-28 | 2026-11-03 |
| CVE-2026-61573 AVideo is a video-sharing Platform. |
medium | 6.1 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-61575 AVideo is a video-sharing Platform. |
medium | 4.7 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-118754 Dolibarr ERP CRM before 24.0.2 contains a missing authorization vulnerability in... |
medium | 5.3 | — | — | 2026-10-28 | 2026-11-03 |
| CVE-2026-118756 gopass before 1.17.0 contains a path traversal vulnerability in the filesystem s... |
medium | 5.5 | — | — | 2026-10-28 | 2026-11-05 |
| CVE-2026-118757 PiWeb Disable payment method / Partial payment for WooCommerce before 1.1.10.9 c... |
medium | 6.5 | — | — | 2026-10-28 | 2026-11-03 |
| CVE-2026-118693 CherryTree through 1.7.2 contains a path traversal vulnerability in CtStorageXml... |
medium | 4.7 | — | — | 2026-10-28 | 2026-11-03 |
| CVE-2026-116641 The DB Tools rely on the TLS implementation in Golang’s standard library, which... |
medium | 6.8 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-118537 A vulnerability was found in a2ui up to 0.10.4. |
medium | 4.3 | — | — | 2026-10-28 | 2026-11-03 |
| CVE-2026-118538 A vulnerability was determined in a2ui-project a2ui up to 0.12.0. |
medium | 5.5 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-118667 LangGraph Python SDK is used to connect to running LangGraph API servers, manage... |
medium | 4.3 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-118661 Happy DOM is a JavaScript implementation of a web browser without its graphical... |
medium | 6.5 | — | — | 2026-10-28 | 2026-11-03 |
| CVE-2026-118663 @hono/node-server allows running the Hono application on Node.js. |
medium | 5.3 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-118656 Echo is a Go web framework. |
medium | 6.1 | — | — | 2026-10-28 | 2026-10-29 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.