October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,481
Critical
1,412
High
6,177
Medium
6,472
Low
662
Severity not reported
2,758
In CISA KEV
21
Most affected vendors (by CPE data where available): microsoft (1359), google (759), oracle (422), apple (336), ibm (149), adobe (138), apache (73), imagemagick (72), broadcom (61), freerdp (60)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-118696 In JetBrains IntelliJ IDEA, PyCharm, PhpStorm, RubyMine and WebStorm before 2026... |
high | 8.0 | — | — | 2026-10-30 | 2026-10-31 |
| CVE-2026-115346 The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is v... |
high | 8.1 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-110305 The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to Sensi... |
high | 7.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-112365 The easy.jobs – AI powered Job Listing, Job Board, Career Page, Recruitment & Hi... |
high | 7.2 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-107630 The Email Templates Customizer and Designer for WordPress and WooCommerce plugin... |
high | 7.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-105894 The Ak Framework plugin for WordPress, included in the Newsy - Viral News & Maga... |
high | 8.8 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-104744 The Independent Analytics Pro plugin for WordPress is vulnerable to Stored Cross... |
high | 7.2 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2025-8574 The Database Cleaner plugin for WordPress is vulnerable to arbitrary table delet... |
high | 8.7 | — | — | 2026-10-30 | 2026-11-04 |
| CVE-2026-61804 myTinyWMS is a free, open-source warehouse management system. |
high | 8.1 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-65566 Cross-Site Request Forgery (CSRF) vulnerability in Meow Apps AI Engine ai-engine... |
high | 8.8 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119116 A use-after-free and double-free issue in the SetClient command handler of the k... |
high | 7.8 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-115642 In OpenStack keystonemiddleware before 13.0.2, by supplying a custom X-Service-T... |
high | 8.3 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119718 Blender before 4.5.15 and 5.x before 5.2.3 contains a heap buffer overflow vulne... |
high | 7.8 | — | Blender / blender | 2026-10-30 | 2026-11-03 |
| CVE-2026-119719 Blender before 4.5.15 and 5.x before 5.2.3 contains a heap buffer overflow vulne... |
high | 7.8 | — | Blender / blender | 2026-10-30 | 2026-11-04 |
| CVE-2026-119722 Blender before 4.5.15 and 5.x before 5.2.3 contains a heap out-of-bounds access... |
high | 7.8 | — | Blender / blender | 2026-10-30 | 2026-11-03 |
| CVE-2026-119710 PipesHub 0.3.0 before 0.10.0 contains an event type injection vulnerability that... |
high | 7.1 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119713 Paperclip 2026.403.0 before 2026.416.0 contains a remote code execution vulnerab... |
high | 8.8 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119707 SonicJS through 3.0.0 contains a missing authorization vulnerability in the /api... |
high | 7.1 | — | — | 2026-10-30 | 2026-11-04 |
| CVE-2026-119289 Zuke is a code-first, strongly typed build automation system for Deno. |
high | 7.1 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119290 Zuke is a code-first, strongly typed build automation system for Deno. |
high | 7.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119287 Zuke is a code-first, strongly typed build automation system for Deno. |
high | 8.0 | — | — | 2026-10-30 | 2026-11-04 |
| CVE-2026-119288 Zuke is a code-first, strongly typed build automation system for Deno. |
high | 7.0 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-117183 A path traversal vulnerability in the FeaturedImage component of astro-notion-bl... |
high | 7.5 | — | — | 2026-10-30 | 2026-11-02 |
| CVE-2026-117184 An issue in the GraphQL endpoint of traggo server v0.8.3 allows attackers to cau... |
high | 7.5 | — | — | 2026-10-30 | 2026-11-03 |
| CVE-2026-118238 The Tenda W18E web management server is vulnerable to OS command injection via t... |
high | 7.2 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-104064 Scribus before 1.6.7 and 1.7.x before 1.7.4 contains an integer overflow vulnera... |
high | 7.8 | — | — | 2026-10-30 | 2026-11-04 |
| CVE-2026-104065 Scribus before 1.6.7 and 1.7.x before 1.7.4 contains an out-of-bounds write vuln... |
high | 7.8 | — | — | 2026-10-30 | 2026-11-05 |
| CVE-2026-104066 Scribus before 1.6.7 and 1.7.x before 1.7.4 contains a heap buffer overflow vuln... |
high | 7.8 | — | — | 2026-10-30 | 2026-11-02 |
| CVE-2026-104067 Scribus before 1.6.7 and 1.7.x before 1.7.4 contains an out-of-bounds memory acc... |
high | 7.8 | — | — | 2026-10-30 | 2026-11-02 |
| CVE-2026-104615 A security vulnerability was discovered in SUSE Rancher Fleet's cluster registra... |
high | 7.9 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-104061 Scribus before 1.6.7 and 1.7.x before 1.7.4 contains a heap out-of-bounds write... |
high | 7.8 | — | — | 2026-10-30 | 2026-11-05 |
| CVE-2026-104062 Scribus before 1.6.7 and 1.7.x before 1.7.4 contains a heap buffer overflow vuln... |
high | 7.8 | — | — | 2026-10-30 | 2026-11-02 |
| CVE-2026-61739 SOCFortress CoPilot focuses on providing a single pane of glass for all your sec... |
high | 7.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-61708 SOCFortress CoPilot focuses on providing a single pane of glass for all your sec... |
high | 8.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-45144 Chamilo LMS is an open-source learning management system. |
high | 8.9 | — | — | 2026-10-30 | 2026-11-04 |
| CVE-2026-45145 Chamilo LMS is an open-source learning management system. |
high | 7.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119662 Songloft 2.9.0 before 2.13.6 contains a hardcoded credentials vulnerability that... |
high | 8.8 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119654 DataCap through 2025.1.1 contains a missing authorization vulnerability that all... |
high | 8.8 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119655 CoreShop through 1.5.5 contains an unauthenticated sql injection vulnerability i... |
high | 7.5 | — | — | 2026-10-30 | 2026-11-04 |
| CVE-2026-119656 CoreShop by CoreUnion through 1.5.5 contains an unauthenticated sql injection vu... |
high | 7.5 | — | — | 2026-10-30 | 2026-11-05 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.