October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,481
Critical
1,401
High
6,159
Medium
6,457
Low
659
Severity not reported
2,805
In CISA KEV
21
Most affected vendors (by CPE data where available): microsoft (1359), google (759), oracle (403), apple (325), ibm (149), adobe (138), apache (73), imagemagick (72), broadcom (61), freerdp (60)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-103331 The UniPAY Payment Gateway For WooCommerce WordPress plugin through 2.3 does not... |
medium | 5.3 | — | — | 2026-10-28 | 2026-11-05 |
| CVE-2026-103372 The Payconiq WordPress plugin through 1.0.4 does not check that a visitor is all... |
medium | 5.3 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-118275 A vulnerability was found in a2ui-project a2ui up to 0.10.6. |
medium | 5.3 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-111727 The Appointment Booking Calendar plugin for WordPress is vulnerable to Stored Cr... |
medium | 6.4 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-118376 WeKnora before 0.8.2 contains a server-side request forgery vulnerability in isR... |
medium | 5.3 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-118384 GNU mtools through 4.0.49 has an out-of-bounds write in parse_vses in vfat.c. |
medium | 6.1 | — | — | 2026-10-28 | 2026-11-02 |
| CVE-2026-118274 A vulnerability has been found in a2ui-project a2ui up to 0.10.6. |
medium | 4.3 | — | — | 2026-10-28 | 2026-11-03 |
| CVE-2026-118374 LibreSSL ocspcheck through 4.4.0 contains a memory exhaustion vulnerability that... |
medium | 5.9 | — | — | 2026-10-28 | 2026-11-02 |
| CVE-2026-117606 NexoPOS through 6.3.0 contains a missing authorization vulnerability that allows... |
medium | 5.4 | — | — | 2026-10-28 | 2026-11-04 |
| CVE-2026-117608 Assimp through 6.0.5 contains an integer overflow vulnerability in MD2Importer::... |
medium | 6.1 | — | — | 2026-10-28 | 2026-11-03 |
| CVE-2026-118273 A flaw has been found in a2ui-project a2ui up to 0.10.6. |
medium | 4.3 | — | — | 2026-10-28 | 2026-11-02 |
| CVE-2026-115624 GROWI contains a missing authorization check vulnerability in its collaborative... |
medium | 5.3 | — | — | 2026-10-28 | 2026-11-04 |
| CVE-2026-117605 nopCommerce before 5.00.0 contains a missing authorization vulnerability in the... |
medium | 4.3 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-107745 The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPre... |
medium | 4.2 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-109209 The All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Sel... |
medium | 6.4 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-109848 GROWI contains an authorization bypass vulnerability in its tag update API and t... |
medium | 4.2 | — | — | 2026-10-28 | 2026-11-04 |
| CVE-2026-109974 The All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Sel... |
medium | 6.4 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-105272 GROWI contains an authorization bypass vulnerability in its page viewing and com... |
medium | 4.2 | — | — | 2026-10-28 | 2026-11-04 |
| CVE-2026-107625 The Ultimate Member – User Profile, Registration, Login, Member Directory, Conte... |
medium | 6.4 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2013-20008 Linksys WAG200G through 1.01.06 contains a weak password change mechanism that a... |
medium | 6.8 | — | — | 2026-10-28 | 2026-11-02 |
| CVE-2013-20009 Linksys WAG200G through 1.01.06 contains a stored cross-site scripting vulnerabi... |
medium | 4.8 | — | — | 2026-10-28 | 2026-11-03 |
| CVE-2014-125136 C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, and Cart Engin... |
medium | 5.9 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2014-125137 C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, and Cart Engin... |
medium | 6.5 | — | — | 2026-10-28 | 2026-11-05 |
| CVE-2026-118271 A security vulnerability has been detected in a2ui-project a2ui up to 0.10.6. |
medium | 4.3 | — | — | 2026-10-28 | 2026-11-03 |
| CVE-2026-118272 A vulnerability was detected in a2ui-project a2ui up to 0.10.6. |
medium | 4.3 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-118129 A vulnerability was found in jeremyckahn Chitchatter up to f82538633813c854a81a8... |
medium | 6.3 | — | — | 2026-10-28 | 2026-11-02 |
| CVE-2026-58496 Thor Vector Graphics (ThorVG) is a production-ready vector graphics engine. |
medium | 4.3 | — | — | 2026-10-27 | 2026-11-02 |
| CVE-2026-50571 WebSub is a W3C recommendation produced by the Social Web Working Group. |
medium | 5.7 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-118318 Improper access control in V8 in Google Chrome prior to 156.0.8078.73 allowed a... |
medium | 4.3 | — | Google / chrome | 2026-10-27 | 2026-11-03 |
| CVE-2026-118319 Memory corruption in Skia in Google Chrome prior to 156.0.8078.73 allowed a remo... |
medium | 4.3 | — | Google / chrome | 2026-10-27 | 2026-11-03 |
| CVE-2026-118322 Memory corruption in ANGLE in Google Chrome prior to 156.0.8078.73 allowed a rem... |
medium | 4.3 | — | Google / chrome | 2026-10-27 | 2026-11-03 |
| CVE-2026-118128 A vulnerability has been found in a2aproject a2a-js up to 1.1.0. |
medium | 6.5 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-97045 In childTextNodesAreLiteral, walking up the tree previously stopped at the neare... |
medium | 6.1 | — | — | 2026-10-27 | 2026-11-04 |
| CVE-2026-116773 russh is a Rust SSH client and server library that includes an SSH agent protoco... |
medium | 4.3 | — | — | 2026-10-27 | 2026-10-30 |
| CVE-2026-116774 russh is a Rust SSH client and server library that includes an SSH agent protoco... |
medium | 4.3 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-116689 follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically f... |
medium | 5.9 | — | — | 2026-10-27 | 2026-10-30 |
| CVE-2026-116691 MLflow is an open source AI engineering platform for agents, large language mode... |
medium | 6.5 | — | — | 2026-10-27 | 2026-11-03 |
| CVE-2026-116684 The Model Context Protocol Python SDK is the official Python SDK for Model Conte... |
medium | 6.8 | — | — | 2026-10-27 | 2026-11-02 |
| CVE-2026-116685 The Model Context Protocol Python SDK is the official Python SDK for Model Conte... |
medium | 5.9 | — | — | 2026-10-27 | 2026-10-30 |
| CVE-2026-116686 The Model Context Protocol Python SDK is the official Python SDK for Model Conte... |
medium | 6.5 | — | — | 2026-10-27 | 2026-10-28 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.