October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,481
Critical
1,412
High
6,177
Medium
6,472
Low
662
Severity not reported
2,758
In CISA KEV
21
Most affected vendors (by CPE data where available): microsoft (1359), google (759), oracle (422), apple (336), ibm (149), adobe (138), apache (73), imagemagick (72), broadcom (61), freerdp (60)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-116243 pgAdmin 4 runs pg_dump, pg_restore, pg_dumpall and psql from the binary path a u... |
high | 8.8 | — | Pgadmin / pgadmin 4 | 2026-10-30 | 2026-11-04 |
| CVE-2026-116246 To pass a server's password to psql and to the utilities pgAdmin 4 runs as backg... |
high | 7.6 | — | Pgadmin / pgadmin 4 | 2026-10-30 | 2026-11-04 |
| CVE-2026-116239 In server mode pgAdmin 4 keeps an account per authentication source, so the same... |
high | 8.8 | — | Pgadmin / pgadmin 4 | 2026-10-30 | 2026-11-04 |
| CVE-2026-116241 pgAdmin 4's Import/Export Data tool wraps a user's query export in a psql \copy... |
high | 8.8 | — | Pgadmin / pgadmin 4 | 2026-10-30 | 2026-11-04 |
| CVE-2026-116238 In server mode pgAdmin 4 locks an internal account after MAX_LOGIN_ATTEMPTS fail... |
high | 8.1 | — | — | 2026-10-30 | 2026-11-02 |
| CVE-2026-94175 Unauthenticated Cross Site Scripting (XSS) in All In One Login <= 2.4.1 versions... |
high | 7.1 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-78527 Contributor PHP Object Injection in GS Testimonial Slider <= 3.3.10 versions. |
high | 8.8 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-73186 Subscriber PHP Object Injection in Enable Media Replace <= 4.2.2 versions. |
high | 8.8 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-62331 praktor is a multi-agent Claude Code orchestrator with Telegram input and output... |
high | 8.2 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-62264 PDF Reader MCP is a Model Context Protocol server for reading PDF documents. |
high | 7.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-61854 VoiceSentinel is a real-time voice moderation system for Minecraft servers. |
high | 8.2 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-59978 AdminNeo is a full-featured database management tool written in PHP. |
high | 7.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-54855 Unauthenticated Cross Site Scripting (XSS) in Profile Builder <= 4.0.5 versions. |
high | 7.1 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-46560 Open Access Management (OpenAM) is an access management solution. |
high | 7.5 | — | — | 2026-10-30 | 2026-11-05 |
| CVE-2026-48201 Unauthenticated Cross Site Scripting (XSS) in Fast Velocity Minify <= 3.5.7 vers... |
high | 7.1 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-39734 Unauthenticated Path Traversal in WP EasyPay <= 4.5.4 versions. |
high | 7.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-39786 Unauthenticated Cross Site Scripting (XSS) in BA Book Everything <= 1.8.33 versi... |
high | 7.1 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-28160 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-30 | 2026-11-02 |
| CVE-2026-118086 Subscriber Privilege Escalation in WP BASE Booking <= 6.5.2 versions. |
high | 8.8 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-118089 Shop manager PHP Object Injection in Product Feed Manager <= 7.14.1 versions. |
high | 7.2 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-118090 Subscriber PHP Object Injection in MasterStudy LMS <= 3.7.55 versions. |
high | 8.8 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-116861 Unauthenticated Sensitive Data Exposure in Flexible Chat <= 1.1.0 versions. |
high | 7.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-116862 Unauthenticated Broken Access Control in WP REST Cache <= 2026.3.1 versions. |
high | 7.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-116405 Unauthenticated Cross Site Scripting (XSS) in VikRentCar <= 1.4.9 versions. |
high | 7.1 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-116847 Unauthenticated Cross Site Scripting (XSS) in Mang Board WP <= 2.4.6 versions. |
high | 7.1 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-116851 Unauthenticated Cross Site Scripting (XSS) in eCommerce Product Catalog <= 3.6.5... |
high | 7.1 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-116401 Unauthenticated Broken Access Control in HUSKY <= 1.4.6 versions. |
high | 7.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-105077 Unauthenticated Cross Site Scripting (XSS) in Ad Inserter <= 2.8.19 versions. |
high | 7.1 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-96894 The ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce plugin for Wo... |
high | 7.2 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-97638 The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin f... |
high | 7.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-84243 The gettext family of functions in the GNU C Library version 2.0 and later accep... |
high | 7.0 | — | — | 2026-10-30 | 2026-10-31 |
| CVE-2026-76012 The Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery plugin for Wor... |
high | 7.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119777 A flaw was found in GStreamer's gst-plugins-bad H.266/VVC parser. |
high | 8.8 | — | — | 2026-10-30 | 2026-11-04 |
| CVE-2026-119978 Flowise through 3.1.4 contains a sandbox escape vulnerability that allows authen... |
high | 8.5 | — | — | 2026-10-30 | 2026-11-02 |
| CVE-2026-119979 LM Studio before 0.4.22+1 contains a path traversal vulnerability in the model d... |
high | 8.8 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119619 A vulnerability was found in 37954679 cak-filemanagement-system up to 5e64332464... |
high | 7.3 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119620 A vulnerability was determined in 37954679 cak-filemanagement-system up to 5e643... |
high | 7.3 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119760 sniproxy through 0.7.0 contains a NULL pointer dereference vulnerability in reso... |
high | 7.5 | — | — | 2026-10-30 | 2026-11-05 |
| CVE-2026-119762 Axigen Mail Server before 10.5.69, 10.6.x before 10.6.40, and 10.7.x before 10.7... |
high | 7.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-118205 The Essential Addons for Elementor – Popular Elementor Templates & Widgets plugi... |
high | 7.4 | — | — | 2026-10-30 | 2026-10-30 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.