October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,481
Critical
1,390
High
6,087
Medium
6,446
Low
659
Severity not reported
2,899
In CISA KEV
21
Most affected vendors (by CPE data where available): microsoft (1359), google (759), oracle (376), apple (282), ibm (149), adobe (138), apache (73), imagemagick (72), broadcom (61), freerdp (60)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-119419 CakePHP through 5.4.3 contains an sql injection vulnerability that allows attack... |
high | 8.1 | — | — | 2026-10-30 | 2026-11-04 |
| CVE-2026-119420 Lago through 1.55.0 contains an authentication bypass vulnerability that allows... |
high | 8.8 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119407 Element Web and Element Desktop before 1.12.32 accept guest credentials from URL... |
high | 7.1 | — | — | 2026-10-30 | 2026-11-04 |
| CVE-2026-119408 n8n before 2.42.6, 2.43.x before 2.43.3, and 3.x before 3.0.1 contains a remote... |
high | 8.8 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119409 OPNsense before 26.7.8 contains a command injection vulnerability that allows au... |
high | 7.2 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119373 SQLite before 3.54.0 built with FTS5 contains a heap buffer overflow in fts5Merg... |
high | 7.8 | — | Sqlite / sqlite | 2026-10-30 | 2026-11-03 |
| CVE-2026-119374 SQLite before 3.54.0 built with FTS5 contains a heap buffer overflow in fts5DoSe... |
high | 7.8 | — | Sqlite / sqlite | 2026-10-30 | 2026-11-03 |
| CVE-2026-119379 SQLite before 3.54.0 built with the session extension contains a heap buffer ove... |
high | 7.8 | — | Sqlite / sqlite | 2026-10-30 | 2026-11-03 |
| CVE-2026-111505 Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutra... |
high | 8.8 | — | — | 2026-10-30 | 2026-10-31 |
| CVE-2026-101210 Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutra... |
high | 7.2 | — | — | 2026-10-30 | 2026-10-31 |
| CVE-2026-101213 Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Privil... |
high | 7.8 | — | — | 2026-10-30 | 2026-10-31 |
| CVE-2026-101214 Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutra... |
high | 7.2 | — | — | 2026-10-30 | 2026-10-31 |
| CVE-2026-111504 Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutra... |
high | 7.2 | — | — | 2026-10-30 | 2026-10-31 |
| CVE-2026-65874 This issue affects Apache Fineract versions up to and including 1.15.0. |
high | 8.8 | — | Apache / fineract | 2026-10-30 | 2026-11-02 |
| CVE-2026-59387 The Nginx routing configuration for Cloud Controller blocks unauthenticated acce... |
high | 8.8 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-97645 The Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Script... |
high | 7.2 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-89435 The Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Qu... |
high | 8.8 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-90437 The Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Script... |
high | 7.2 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-116622 The Food Store – Online Food Delivery & Pickup plugin for WordPress is vulnerabl... |
high | 7.2 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-110732 The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPre... |
high | 7.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-117571 The WP Visitor Statistics (Real Time Traffic) WordPress plugin before 8.8 does n... |
high | 8.8 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-114443 The Security Plugin, Firewall & Malware Scanner with Auto Removal WordPress plug... |
high | 7.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-114422 The Enable Media Replace WordPress plugin before 4.2.3 does not restrict the cla... |
high | 7.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-103963 A flaw was found in glib-networking. |
high | 7.5 | — | — | 2026-10-30 | 2026-11-04 |
| CVE-2026-104368 The Export and Import Users and Customers plugin for WordPress is vulnerable to... |
high | 8.8 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-76026 Memory corruption in Autofill in Google Chrome prior to 156.0.8078.79 allowed a... |
high | 8.8 | — | Google / chrome | 2026-10-30 | 2026-11-03 |
| CVE-2026-76028 Use after free in FileSystem in Google Chrome prior to 156.0.8078.79 allowed a r... |
high | 8.8 | — | Google / chrome | 2026-10-30 | 2026-11-03 |
| CVE-2026-76029 Memory corruption in Network in Google Chrome prior to 156.0.8078.79 allowed a r... |
high | 8.8 | — | Google / chrome | 2026-10-30 | 2026-11-03 |
| CVE-2026-76030 Memory corruption in FileSystem in Google Chrome prior to 156.0.8078.79 allowed... |
high | 8.8 | — | Google / chrome | 2026-10-30 | 2026-11-03 |
| CVE-2026-76031 Use after free in Input in Google Chrome prior to 156.0.8078.79 allowed a remote... |
high | 8.8 | — | Google / chrome | 2026-10-30 | 2026-11-03 |
| CVE-2026-119271 Use after free in Skia in Google Chrome prior to 156.0.8078.79 allowed a remote... |
high | 8.8 | — | Google / chrome | 2026-10-30 | 2026-11-03 |
| CVE-2026-76025 Use after free in FileSystem in Google Chrome prior to 156.0.8078.79 allowed a r... |
high | 8.8 | — | Google / chrome | 2026-10-30 | 2026-11-03 |
| CVE-2026-119264 Memory corruption in Dawn in Google Chrome prior to 156.0.8078.79 allowed a remo... |
high | 8.8 | — | Google / chrome | 2026-10-30 | 2026-11-03 |
| CVE-2026-119265 Memory corruption in Quota in Google Chrome prior to 156.0.8078.79 allowed a rem... |
high | 8.8 | — | Google / chrome | 2026-10-30 | 2026-11-03 |
| CVE-2026-119266 Use after free in Quota in Google Chrome prior to 156.0.8078.79 allowed a remote... |
high | 8.8 | — | Google / chrome | 2026-10-30 | 2026-11-03 |
| CVE-2026-119267 Memory corruption in DOM in Google Chrome prior to 156.0.8078.79 allowed a remot... |
high | 8.8 | — | Google / chrome | 2026-10-30 | 2026-11-03 |
| CVE-2026-119268 Integer overflow in Editing in Google Chrome prior to 156.0.8078.79 allowed a re... |
high | 8.8 | — | Google / chrome | 2026-10-30 | 2026-11-03 |
| CVE-2026-119269 Use after free in Blink in Google Chrome prior to 156.0.8078.79 allowed a remote... |
high | 8.8 | — | Google / chrome | 2026-10-30 | 2026-11-03 |
| CVE-2026-119270 Improper input validation in CacheStorage in Google Chrome prior to 156.0.8078.7... |
high | 8.8 | — | Google / chrome | 2026-10-30 | 2026-11-03 |
| CVE-2026-119260 Use after free in Frames in Google Chrome prior to 156.0.8078.79 allowed a remot... |
high | 8.8 | — | Google / chrome | 2026-10-30 | 2026-10-31 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.