October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,481
Critical
1,412
High
6,177
Medium
6,472
Low
662
Severity not reported
2,758
In CISA KEV
21
Most affected vendors (by CPE data where available): microsoft (1359), google (759), oracle (422), apple (336), ibm (149), adobe (138), apache (73), imagemagick (72), broadcom (61), freerdp (60)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-116195 Rclone before 1.75.2 contains a path traversal vulnerability in the local backen... |
medium | 6.1 | — | Rclone / rclone | 2026-10-25 | 2026-10-27 |
| CVE-2026-116182 phpMyFAQ before 4.1.10 contains a server-side request forgery vulnerability in t... |
medium | 5.0 | — | — | 2026-10-25 | 2026-10-29 |
| CVE-2026-116185 OpenRemote core before 1.31.0 contains an authorization bypass vulnerability tha... |
medium | 5.0 | — | — | 2026-10-25 | 2026-10-29 |
| CVE-2026-116187 Rclone from v1.68.0 before v1.75.2 contains an authorization bypass vulnerabilit... |
medium | 5.0 | — | Rclone / rclone | 2026-10-25 | 2026-10-28 |
| CVE-2026-116188 rclone serve s3 versions 1.75.0 before 1.75.2 contain an integer overflow vulner... |
medium | 5.3 | — | Rclone / rclone | 2026-10-25 | 2026-11-04 |
| CVE-2026-116175 vLLM from 0.19.0 before 0.24.0 contains a decompression bomb vulnerability becau... |
medium | 6.5 | — | Vllm / vllm | 2026-10-25 | 2026-10-28 |
| CVE-2026-116181 vLLM from 0.20.1 before 0.29.0 contains an improper input validation vulnerabili... |
medium | 6.5 | — | Vllm / vllm | 2026-10-25 | 2026-10-29 |
| CVE-2026-116169 SiYuan from 2.10.0 before 3.8.7 contains a stored cross-site scripting vulnerabi... |
medium | 5.4 | — | — | 2026-10-25 | 2026-10-29 |
| CVE-2026-116170 SiYuan before v3.8.7 contains an sql injection vulnerability that allows admin-t... |
medium | 4.9 | — | — | 2026-10-25 | 2026-10-29 |
| CVE-2026-116171 SiYuan 3.5.4 before 3.8.7 on Windows contains a sensitive-path denylist bypass i... |
medium | 4.4 | — | — | 2026-10-25 | 2026-10-28 |
| CVE-2026-116166 SiYuan 3.6.0 before 3.8.7 accepts and persists the networkServeTLS setting but n... |
medium | 6.8 | — | — | 2026-10-25 | 2026-10-29 |
| CVE-2026-116167 SiYuan from 2.9.0 before 3.8.7 contains a cross-site scripting vulnerability in... |
medium | 6.8 | — | — | 2026-10-25 | 2026-10-26 |
| CVE-2026-116168 SiYuan before 3.8.7 contains a path traversal vulnerability in the MCP asset too... |
medium | 6.2 | — | — | 2026-10-25 | 2026-11-04 |
| CVE-2026-116158 ImageMagick before 7.1.2-33 contains a memory leak vulnerability in the magick c... |
medium | 5.5 | — | Imagemagick / imagemagick | 2026-10-25 | 2026-11-03 |
| CVE-2026-116152 ImageMagick before 7.1.2-33 contains a memory leak vulnerability in the MAT deco... |
medium | 5.3 | — | Imagemagick / imagemagick | 2026-10-25 | 2026-11-05 |
| CVE-2026-116154 ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a memory leak in i... |
medium | 5.3 | — | Imagemagick / imagemagick | 2026-10-25 | 2026-11-03 |
| CVE-2026-116155 ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a memory leak in t... |
medium | 5.3 | — | Imagemagick / imagemagick | 2026-10-25 | 2026-11-03 |
| CVE-2026-116139 WWBN AVideo 26.0 through 29.3.0 contains a stored cross-site scripting vulnerabi... |
medium | 5.4 | — | — | 2026-10-25 | 2026-10-26 |
| CVE-2026-116141 ImageMagick before 7.1.2-33 contains a policy bypass vulnerability in the UHDR d... |
medium | 5.3 | — | Imagemagick / imagemagick | 2026-10-25 | 2026-11-03 |
| CVE-2026-116053 A weakness has been identified in dbcli mycli up to 2.29.4/2.30.1. |
medium | 5.3 | — | — | 2026-10-25 | 2026-10-26 |
| CVE-2026-116052 A security flaw has been discovered in LinkStackOrg LinkStack up to 4.8.8. |
medium | 4.3 | — | — | 2026-10-25 | 2026-10-29 |
| CVE-2026-116136 ProjectSend 2.0.0 through 2.7.1 contains an incomplete authorization vulnerabili... |
medium | 5.9 | — | — | 2026-10-25 | 2026-10-29 |
| CVE-2026-116069 NiubiGEO before 0.3.2 contains an unauthenticated server-side request forgery vu... |
medium | 6.5 | — | — | 2026-10-25 | 2026-11-04 |
| CVE-2026-116070 Docker-Proxy through 5.1.9 contains a missing authentication vulnerability in th... |
medium | 6.5 | — | — | 2026-10-25 | 2026-10-29 |
| CVE-2026-116071 rotki before 1.44.2 contains a weak key derivation vulnerability that allows att... |
medium | 5.9 | — | — | 2026-10-25 | 2026-10-29 |
| CVE-2026-116072 Infinity for Reddit through 8.3.4 contains a login cross-site request forgery vu... |
medium | 5.4 | — | — | 2026-10-25 | 2026-10-26 |
| CVE-2026-116073 Leon before commit 50df142 contains a path traversal vulnerability in getModelFi... |
medium | 6.5 | — | — | 2026-10-25 | 2026-11-05 |
| CVE-2026-116066 Firecrawl before 2.11.586 contains a server-side request forgery vulnerability i... |
medium | 6.8 | — | — | 2026-10-25 | 2026-10-29 |
| CVE-2026-116047 A vulnerability has been found in Privoce Vocechat up to 0.9.121. |
medium | 4.3 | — | — | 2026-10-25 | 2026-10-29 |
| CVE-2026-116046 A flaw has been found in eventcatalog sdk up to 2.29.0. |
medium | 5.3 | — | — | 2026-10-25 | 2026-10-26 |
| CVE-2026-116045 A vulnerability was detected in 1999AZZAR designer-mcp up to 2.1.0. |
medium | 4.3 | — | — | 2026-10-25 | 2026-10-29 |
| CVE-2026-94295 The Chikkili- Google Pay India for Woocommerce WordPress plugin through 1.0.6 do... |
medium | 5.3 | — | — | 2026-10-25 | 2026-10-26 |
| CVE-2026-116044 A security vulnerability has been detected in prasathmani TinyFileManager up to... |
medium | 6.3 | — | — | 2026-10-25 | 2026-10-29 |
| CVE-2026-110285 The WP Stripe Checkout WordPress plugin before 1.2.2.62 does not verify the Stri... |
medium | 5.3 | — | — | 2026-10-25 | 2026-10-26 |
| CVE-2026-111976 The GiveWP WordPress plugin before 4.19.0.1 does not perform any status or capab... |
medium | 5.3 | — | — | 2026-10-25 | 2026-10-26 |
| CVE-2026-111978 The GiveWP WordPress plugin before 4.19.0.1 does not properly validate a user-su... |
medium | 6.0 | — | — | 2026-10-25 | 2026-10-26 |
| CVE-2026-111979 The GiveWP WordPress plugin before 4.19.0.1 does not properly sanitise and escap... |
medium | 6.8 | — | — | 2026-10-25 | 2026-10-26 |
| CVE-2026-111980 The GiveWP WordPress plugin before 4.19.0.1 does not correctly determine which p... |
medium | 5.5 | — | — | 2026-10-25 | 2026-10-26 |
| CVE-2026-114740 The WPVR WordPress plugin before 9.1.3 does not correctly check user capabilitie... |
medium | 4.9 | — | — | 2026-10-25 | 2026-10-26 |
| CVE-2026-115997 A flaw has been found in pig-mesh pig up to 4.1.0. |
medium | 6.3 | — | — | 2026-10-25 | 2026-10-29 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.