October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,481
Critical
1,390
High
6,087
Medium
6,446
Low
659
Severity not reported
2,899
In CISA KEV
21
Most affected vendors (by CPE data where available): microsoft (1359), google (759), oracle (376), apple (282), ibm (149), adobe (138), apache (73), imagemagick (72), broadcom (61), freerdp (60)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-118082 Subscriber Privilege Escalation in Buddyboss Platform <= 3.5.0 versions. |
high | 8.8 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-118083 Unauthenticated Sensitive Data Exposure in WP Crowdfunding <= 2.2.2 versions. |
high | 7.5 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-118085 Unauthenticated Cross Site Scripting (XSS) in GlobalPayments WooCommerce <= 1.23... |
high | 7.1 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-118074 Shop manager PHP Object Injection in Finale Lite <= 2.21.0 versions. |
high | 7.2 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-118075 Contributor PHP Object Injection in WP Media folders <= 1.1.10 versions. |
high | 8.8 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-118076 Contributor PHP Object Injection in Frisbii Pay <= 1.8.19 versions. |
high | 8.8 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-118077 Author PHP Object Injection in Sastra Essential Addons for Elementor <= 1.2.3 ve... |
high | 7.2 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-118078 Shop manager PHP Object Injection in Product Catalog Feed by PixelYourSite <= 3.... |
high | 7.2 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-118079 Shop manager PHP Object Injection in FV Flowplayer Video Player <= 8.3.4 version... |
high | 7.2 | — | — | 2026-10-29 | 2026-11-03 |
| CVE-2026-118080 Contributor PHP Object Injection in Social Snap <= 1.5.4 versions. |
high | 8.8 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-118081 Contributor PHP Object Injection in 10Web Social Photo Feed <= 1.5.6 versions. |
high | 8.8 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-116864 Author PHP Object Injection in WPCargo Track & Trace <= 8.0.5 versions. |
high | 7.2 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-116865 Editor PHP Object Injection in Zippy <= 1.7.0 versions. |
high | 7.2 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-116866 Contributor PHP Object Injection in Extra Fees Plugin for WooCommerce <= 4.4.0 v... |
high | 8.8 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-116867 Contributor PHP Object Injection in Dynamic QR Code – generator <= 1.0.1 version... |
high | 8.8 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-116868 Subscriber PHP Object Injection in BuddyPress Xprofile Custom Field Types <= 1.3... |
high | 8.8 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-116869 Shop manager PHP Object Injection in myPOS Checkout <= 1.4.5 versions. |
high | 7.2 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-118073 Subscriber PHP Object Injection in News Kit Elementor Addons <= 1.5.0 versions. |
high | 8.8 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-114148 Incorrect default permissions in ASP.NET Core allows an authorized attacker to e... |
high | 7.8 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-110309 IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacke... |
high | 8.8 | — | Langflow / langflow | 2026-10-29 | 2026-10-30 |
| CVE-2026-110193 IBM Langflow OSS 1.0.0 through 1.12.8 could allow a remote attacker with a low-p... |
high | 8.8 | — | Langflow / langflow | 2026-10-29 | 2026-10-30 |
| CVE-2026-110196 IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote attacker with a low-p... |
high | 8.8 | — | Langflow / langflow | 2026-10-29 | 2026-10-30 |
| CVE-2026-110245 IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote attacker to obtain se... |
high | 7.5 | — | Langflow / langflow | 2026-10-29 | 2026-11-04 |
| CVE-2026-108494 Unauthenticated Cross Site Scripting (XSS) in Chained Quiz <= 1.4.1 versions. |
high | 7.1 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-107042 Insecure permissions in USP Ultimate Screenshot Painter versionCode 240213.009 a... |
high | 7.5 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-107326 IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacke... |
high | 8.8 | — | Langflow / langflow | 2026-10-29 | 2026-10-30 |
| CVE-2026-107327 IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacke... |
high | 8.8 | — | Langflow / langflow | 2026-10-29 | 2026-10-30 |
| CVE-2026-107328 IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacke... |
high | 8.8 | — | Langflow / langflow | 2026-10-29 | 2026-10-30 |
| CVE-2026-107329 IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacke... |
high | 8.8 | — | Langflow / langflow | 2026-10-29 | 2026-10-30 |
| CVE-2026-107037 Insecure permissions in the NotificationHelper component of NoNonsense Notes ver... |
high | 7.5 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-107039 Insecure permissions in the ActivityMain component of M66B/Marcel Bokhorst NetGu... |
high | 7.5 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-107041 Insecure permissions in the FeatureActionActivity component of Oasis Feng Island... |
high | 7.5 | — | — | 2026-10-29 | 2026-11-02 |
| CVE-2026-107025 Insecure permissions in WikiAndPad alpha/beta v0.2alpha03 (versionCode 200300) a... |
high | 7.5 | — | — | 2026-10-29 | 2026-11-02 |
| CVE-2026-107026 Insecure permissions in Share to Clipboard v1.14.1 (versionCode 32) allows unaut... |
high | 7.5 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-107030 Insecure permissions in craftxbox YubiClip XOR fork v1.0.1 (versionCode 10003) a... |
high | 7.5 | — | — | 2026-10-29 | 2026-11-02 |
| CVE-2026-104324 IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacke... |
high | 8.8 | — | Langflow / langflow | 2026-10-29 | 2026-10-30 |
| CVE-2026-104328 IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacke... |
high | 8.8 | — | Langflow / langflow | 2026-10-29 | 2026-10-30 |
| CVE-2026-103092 IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacke... |
high | 8.8 | — | Langflow / langflow | 2026-10-29 | 2026-10-30 |
| CVE-2026-102590 IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacke... |
high | 7.7 | — | Langflow / langflow | 2026-10-29 | 2026-11-03 |
| CVE-2026-101288 IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacke... |
high | 8.8 | — | Langflow / langflow | 2026-10-29 | 2026-10-30 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.