October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,481
Critical
1,412
High
6,177
Medium
6,472
Low
662
Severity not reported
2,758
In CISA KEV
21
Most affected vendors (by CPE data where available): microsoft (1359), google (759), oracle (422), apple (336), ibm (149), adobe (138), apache (73), imagemagick (72), broadcom (61), freerdp (60)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-116548 The VikRentCar Car Rental Management System plugin for WordPress is vulnerable t... |
high | 7.2 | — | — | 2026-10-31 | 2026-11-02 |
| CVE-2026-111254 The W3 Total Cache plugin for WordPress is vulnerable to Stored Cross-Site Scrip... |
high | 7.2 | — | — | 2026-10-31 | 2026-11-02 |
| CVE-2026-107750 The PDF Invoices & Packing Slips for WooCommerce plugin for WordPress is vulnera... |
high | 7.2 | — | — | 2026-10-31 | 2026-11-02 |
| CVE-2026-107653 The SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downlo... |
high | 7.2 | — | — | 2026-10-31 | 2026-11-02 |
| CVE-2026-118638 The Mapster WP Maps WordPress plugin before 2.0.6 does not perform any authoriza... |
high | 7.5 | — | — | 2026-10-31 | 2026-11-02 |
| CVE-2026-119977 WordPress Core is vulnerable to Remote Code Execution in versions 4.7 through 7.... |
high | 8.1 | Listed | Wordpress / wordpress | 2026-10-31 | 2026-11-04 |
| CVE-2026-118043 The Bulk Media Register WordPress plugin before 2.01 does not properly validate... |
high | 7.2 | — | — | 2026-10-31 | 2026-11-02 |
| CVE-2026-118185 The Security Optimizer WordPress plugin before 1.6.9 does not limit the number o... |
high | 7.5 | — | — | 2026-10-31 | 2026-11-02 |
| CVE-2026-116520 The PPWP – Password Protect Pages plugin for WordPress is vulnerable to Stored C... |
high | 7.2 | — | — | 2026-10-31 | 2026-11-02 |
| CVE-2026-109234 The Meow Lightbox plugin for WordPress is vulnerable to Stored Cross-Site Script... |
high | 7.2 | — | — | 2026-10-31 | 2026-11-02 |
| CVE-2026-109997 The Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & A... |
high | 7.2 | — | — | 2026-10-31 | 2026-11-02 |
| CVE-2026-116755 Improper Neutralization of Special Elements used in a Command ('Command Injectio... |
high | 7.4 | — | — | 2026-10-31 | 2026-11-02 |
| CVE-2026-63378 TAKO AI Agent for Okta is a local-first AI agent that helps Okta administrators... |
high | 8.8 | — | — | 2026-10-30 | 2026-11-02 |
| CVE-2026-63338 IXP Manager is a full-stack web application for managing Internet Exchange Point... |
high | 8.3 | — | — | 2026-10-30 | 2026-11-02 |
| CVE-2026-63339 IXP Manager is a full-stack web application for managing Internet Exchange Point... |
high | 8.8 | — | — | 2026-10-30 | 2026-11-05 |
| CVE-2026-63341 Aedes is an MQTT broker that can run on any stream server. |
high | 7.5 | — | — | 2026-10-30 | 2026-11-05 |
| CVE-2026-63182 LightSAML implements SAML 2.0 data model classes, XML serialization and deserial... |
high | 8.1 | — | — | 2026-10-30 | 2026-11-02 |
| CVE-2026-63184 Refitter is a tool for generating a C# REST API client using the Refit library. |
high | 7.1 | — | — | 2026-10-30 | 2026-11-02 |
| CVE-2026-118938 In Trail of Bits fickling through 0.1.12, a pickle STACK_GLOBAL operand carrying... |
high | 8.8 | — | — | 2026-10-30 | 2026-11-02 |
| CVE-2026-16760 In Trail of Bits fickling through 0.1.12, the _process_import() method in fickle... |
high | 8.8 | — | — | 2026-10-30 | 2026-11-02 |
| CVE-2026-111578 The PDF Invoices & Packing Slips for WooCommerce WordPress plugin from 5.16.2 be... |
high | 7.5 | — | — | 2026-10-30 | 2026-11-02 |
| CVE-2026-62990 Shopper is a Headless e-commerce Admin Panel. |
high | 8.7 | — | — | 2026-10-30 | 2026-11-05 |
| CVE-2026-62966 ESPAsyncWebServer is an asynchronous HTTP and WebSocket server library for ESP32... |
high | 7.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-62967 ZTNET is a ZeroTier web UI for private controllers with multiuser and organizati... |
high | 8.1 | — | — | 2026-10-30 | 2026-11-05 |
| CVE-2026-62989 Shopper is a Headless e-commerce Admin Panel. |
high | 8.1 | — | — | 2026-10-30 | 2026-11-02 |
| CVE-2026-62864 Ring is a Clojure web applications library inspired by Python's WSGI and Ruby's... |
high | 7.5 | — | — | 2026-10-30 | 2026-11-02 |
| CVE-2026-62958 libriscv is a RISC-V sandbox and emulator. |
high | 7.9 | — | — | 2026-10-30 | 2026-11-02 |
| CVE-2026-62297 ag-psd is a JavaScript library for reading and writing Photoshop Document files. |
high | 7.5 | — | — | 2026-10-30 | 2026-11-02 |
| CVE-2026-62847 Metalama is a Roslyn-based open-source patterns and architecture toolkit for C#. |
high | 8.2 | — | — | 2026-10-30 | 2026-11-02 |
| CVE-2026-62848 Metalama is a Roslyn-based open-source patterns and architecture toolkit for C#. |
high | 7.3 | — | — | 2026-10-30 | 2026-11-02 |
| CVE-2026-58412 Filecoin Pin is an IPFS Pinning Service API implementation that pins to Filecoin... |
high | 8.2 | — | — | 2026-10-30 | 2026-11-02 |
| CVE-2026-40573 NovumOS is a custom 32-bit operating system written in Zig and x86 Assembly. |
high | 8.6 | — | — | 2026-10-30 | 2026-11-05 |
| CVE-2026-78402 Stack-based buffer overflow and out-of-bounds
write vulnerability in Thales Sent... |
high | 7.8 | — | — | 2026-10-30 | 2026-11-02 |
| CVE-2026-119335 Pi-hole is a DNS sinkhole that protects devices from unwanted content without in... |
high | 7.8 | — | — | 2026-10-30 | 2026-11-05 |
| CVE-2026-119336 Pi-hole is a DNS sinkhole that protects devices from unwanted content without in... |
high | 7.8 | — | — | 2026-10-30 | 2026-11-02 |
| CVE-2026-119337 RAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine. |
high | 7.1 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119331 Ladybird is a truly independent web browser. |
high | 7.1 | — | — | 2026-10-30 | 2026-11-02 |
| CVE-2026-119332 Ladybird is a truly independent web browser. |
high | 8.8 | — | — | 2026-10-30 | 2026-11-02 |
| CVE-2026-119333 draw.io Desktop is the official Electron build of draw.io. |
high | 7.8 | — | — | 2026-10-30 | 2026-11-02 |
| CVE-2026-116249 In server mode pgAdmin 4 resolves a server's password file, SSL certificate, key... |
high | 8.4 | — | — | 2026-10-30 | 2026-11-02 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.