October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,481
Critical
1,390
High
6,087
Medium
6,446
Low
659
Severity not reported
2,899
In CISA KEV
21
Most affected vendors (by CPE data where available): microsoft (1359), google (759), oracle (376), apple (282), ibm (149), adobe (138), apache (73), imagemagick (72), broadcom (61), freerdp (60)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-115709 Improper Link Resolution Before File Access ('Link Following') (CWE-59) in Elast... |
high | 8.2 | — | Elastic / elastic cloud enterprise | 2026-10-29 | 2026-10-30 |
| CVE-2026-115713 Improper Link Resolution Before File Access ('Link Following') (CWE-59) in Elast... |
high | 7.5 | — | Elastic / elastic cloud enterprise | 2026-10-29 | 2026-10-30 |
| CVE-2026-115708 Improper Link Resolution Before File Access ('Link Following') (CWE-59) in Elast... |
high | 7.2 | — | Elastic / elastic cloud enterprise | 2026-10-29 | 2026-10-30 |
| CVE-2026-107024 Insecure permissions in Share 2 Archive Today versionCode 61 allows unauthorized... |
high | 7.5 | — | — | 2026-10-29 | 2026-11-03 |
| CVE-2026-107016 Insecure permissions in Fossify v1.3.0 allows unauthorized attackers to access a... |
high | 7.5 | — | — | 2026-10-29 | 2026-11-03 |
| CVE-2026-107018 Insecure permissions in Ghost Commander File Manager versionCode 479 allows unau... |
high | 8.1 | — | — | 2026-10-29 | 2026-11-03 |
| CVE-2026-107019 Insecure permissions in the feiertage.ImportActivity component of Arbeitszeiterf... |
high | 8.8 | — | — | 2026-10-29 | 2026-11-02 |
| CVE-2026-107020 An issue in the activity.LoadLinkLaterActivity component of FeedEx / Handy News... |
high | 7.5 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-39736 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
high | 8.5 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-119052 llama.cpp b2877 before b11935 contains an uncaught exception vulnerability in th... |
high | 7.5 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-119049 FreeMail before 5.3.2 contains an authorization bypass vulnerability that allows... |
high | 7.6 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-119050 Agno through 3.1.11 contains an unsafe reflection vulnerability in PandasTools t... |
high | 8.1 | — | — | 2026-10-29 | 2026-11-04 |
| CVE-2026-116399 Cross-Site Request Forgery (CSRF) vulnerability in InstaWP InstaWP Connect insta... |
high | 8.8 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2019-25781 Python-Markdown 3.0 through 3.11.2 contains an algorithmic complexity vulnerabil... |
high | 7.5 | — | — | 2026-10-29 | 2026-11-03 |
| CVE-2026-49142 OpenEMR before 8.5.0 contains an authenticated SQL injection vulnerability in th... |
high | 8.8 | — | — | 2026-10-29 | 2026-11-04 |
| CVE-2026-96767 The NEX-Forms – Ultimate Forms Plugin for WordPress plugin for WordPress is vuln... |
high | 7.2 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-119025 open 7.2.0 before 11.0.0 contains an OS command injection vulnerability that all... |
high | 7.5 | — | — | 2026-10-29 | 2026-11-03 |
| CVE-2026-119027 oapi-codegen 2.5.0 before 2.8.1 contains a code injection vulnerability that all... |
high | 7.5 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-119028 oapi-codegen 2.0.0 before 2.8.1 contains a code injection vulnerability that all... |
high | 8.8 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-115821 The NewsmanApp plugin for WordPress is vulnerable to Stored Cross-Site Scripting... |
high | 7.2 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-110184 The Newsmatic theme for WordPress is vulnerable to blind SQL Injection via the '... |
high | 7.5 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-103665 The installer for Yamaha LAN Monitor for Windows provided by Yamaha Corporation... |
high | 7.8 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-33924 Two OS command injection vulnerabilities were discovered in the update installat... |
high | 7.2 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-33923 A signature verification vulnerability was discovered in the update installation... |
high | 7.2 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-115963 Missing Authorization vulnerability in VideoWhisper.com Broadcast Live Video vid... |
high | 7.1 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-115965 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
high | 8.5 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-115967 Weak Authentication vulnerability in Hamid Alinia Login with phone number login-... |
high | 8.8 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-116409 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-115599 Missing Authorization vulnerability in ThimPress LearnPress learnpress allows Ex... |
high | 7.5 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-115611 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-115592 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-114193 Missing Authorization vulnerability in Eyal Fitoussi GEO my WordPress geo-my-wp... |
high | 7.5 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-112827 Missing Authorization vulnerability in VillaTheme HANDMADE – Dropshipping for Et... |
high | 7.1 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-111417 A broken access control vulnerability exists in the Foxit official website’s HTM... |
high | 7.5 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-111418 A server-side request forgery (SSRF) vulnerability exists in the Foxit official... |
high | 7.5 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-111419 A sensitive information exposure vulnerability exists on the Foxit official webs... |
high | 8.6 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-107743 The Mapster WP Maps plugin for WordPress is vulnerable to Stored Cross-Site Scri... |
high | 7.2 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-86794 The Community Events WordPress plugin before 1.6.0 does not have authorisation o... |
high | 8.8 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-89216 The vTables WordPress plugin before 0.3 does not properly sanitise and escape a... |
high | 8.6 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-115301 The Contact Form by Supsystic WordPress plugin before 1.11.1 does not sandbox th... |
high | 7.2 | — | — | 2026-10-29 | 2026-10-29 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.