October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,481
Critical
1,390
High
6,087
Medium
6,446
Low
659
Severity not reported
2,899
In CISA KEV
21
Most affected vendors (by CPE data where available): microsoft (1359), google (759), oracle (376), apple (282), ibm (149), adobe (138), apache (73), imagemagick (72), broadcom (61), freerdp (60)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-62010 Unauthenticated PHP Object Injection in Avventure <= 1.1.12 versions. |
critical | 9.8 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-62011 Unauthenticated PHP Object Injection in Bonbon <= 1.11 versions. |
critical | 9.8 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-62012 Unauthenticated PHP Object Injection in Coinpress <= 1.0.15 versions. |
critical | 9.8 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-61997 Unauthenticated PHP Object Injection in Legal Stone <= 1.2.11 versions. |
critical | 9.8 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-61998 Unauthenticated PHP Object Injection in Le Truffe <= 1.1.7 versions. |
critical | 9.8 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-62001 Unauthenticated PHP Object Injection in Marcell <= 1.2.14 versions. |
critical | 9.8 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-62002 Unauthenticated PHP Object Injection in Meals & Wheels <= 1.1.13 versions. |
critical | 9.8 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-62003 Unauthenticated PHP Object Injection in Mission <= 1.22 versions. |
critical | 9.8 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-61991 Unauthenticated Remote Code Execution (RCE) in AjaxLoadMore Cache <= 3.1.1 versi... |
critical | 10.0 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-61992 Unauthenticated PHP Object Injection in GEO my WordPress <= 4.5.5.3 versions. |
critical | 9.8 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-54859 Unauthenticated PHP Object Injection in Preservation <= 1.15 versions. |
critical | 9.8 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-54860 Unauthenticated PHP Object Injection in Ozisti <= 1.1.10 versions. |
critical | 9.8 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-54856 Unauthenticated PHP Object Injection in RexCoin <= 1.2.6 versions. |
critical | 9.8 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-54857 Unauthenticated PHP Object Injection in Quirky <= 1.23 versions. |
critical | 9.8 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-54858 Unauthenticated PHP Object Injection in Printy <= 1.13.0 versions. |
critical | 9.8 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-119145 Frappe before 15.121.0 and 16.x before 16.34.0 contains a path traversal vulnera... |
critical | 9.9 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-18894 IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote attacker to trigger p... |
critical | 9.8 | — | Langflow / langflow | 2026-10-29 | 2026-10-30 |
| CVE-2026-110186 IBM Langflow OSS 1.0.0 through 1.12.8 could allow a remote attacker to execute a... |
critical | 9.8 | — | Langflow / langflow | 2026-10-29 | 2026-10-30 |
| CVE-2026-107034 Insecure permissions in LeafPad / Leaf Note v1.21 (versionCode 21) allows unauth... |
critical | 9.1 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-107038 Insecure permissions in Yet Another UPnP Controller versionCode 50200 allows una... |
critical | 9.1 | — | — | 2026-10-29 | 2026-11-03 |
| CVE-2026-107040 Insecure permissions in MBasov OMN-Go versionCode 26080824 allows unauthorized a... |
critical | 9.1 | — | — | 2026-10-29 | 2026-11-04 |
| CVE-2026-107027 Insecure permissions in lz233 Tarnhelm v1.8.2 (versionCode 20250630) allows unau... |
critical | 9.1 | — | — | 2026-10-29 | 2026-11-03 |
| CVE-2026-107028 Insecure permissions in wbpxre150 Shopping List v11.0 (versionCode 11) allows un... |
critical | 9.1 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-107029 Insecure permissions in rubenalfon Pile v1.1.3 allows unauthorized attackers to... |
critical | 9.1 | — | — | 2026-10-29 | 2026-11-03 |
| CVE-2026-107032 Insecure permissions in Bulk Share : Location Sender v2.1.0 (versionCode 5) allo... |
critical | 9.1 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-104339 IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote attacker to execute a... |
critical | 9.8 | — | Langflow / langflow | 2026-10-29 | 2026-10-30 |
| CVE-2026-104317 IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote attacker who could re... |
critical | 9.8 | — | Langflow / langflow | 2026-10-29 | 2026-10-30 |
| CVE-2026-107014 Insecure permissions in Bander Notepad (bander.notepad) versionCode 12 allow una... |
critical | 9.1 | — | — | 2026-10-29 | 2026-11-02 |
| CVE-2026-107015 Insecure permissions in Simple Contacts Pro versionCode 107 allow unauthorized a... |
critical | 9.1 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-107017 Insecure permissions in the ShortcutDispatchActivity component of canvoki versio... |
critical | 9.1 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-107021 Insecure permissions in the CardProvider content provider component of helloworl... |
critical | 9.1 | — | — | 2026-10-29 | 2026-11-03 |
| CVE-2026-79589 The WIFI4 N300 router (Model: T1 Pro) v1.0.0 by U-speed contains an insecure acc... |
critical | 9.8 | — | — | 2026-10-29 | 2026-11-03 |
| CVE-2026-97854 Yamaha wireless LAN router NWR100 provided by Yamaha Corporation contains an OS... |
critical | 9.8 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-115964 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
critical | 9.3 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-115245 The Chat AI with Dispatcher WordPress plugin before 2.4 does not properly valida... |
critical | 9.8 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-113616 The LogixFast Auth WordPress plugin before 1.0.4 does not deliver its password-r... |
critical | 9.8 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-113617 The Automated Import Products to Cart WordPress plugin before 1.0.4 does not san... |
critical | 9.9 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-103693 The Frontend Dashboard WordPress plugin before 3.0.5, ProfileGrid WordPress plug... |
critical | 9.0 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-42922 A authorization bypass vulnerability exists in the /nodered functionality of FUX... |
critical | 9.8 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-109516 The Bot for Telegram on WooCommerce plugin for WordPress is vulnerable to Authen... |
critical | 9.8 | — | — | 2026-10-29 | 2026-10-29 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.