October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,481
Critical
1,390
High
6,087
Medium
6,446
Low
659
Severity not reported
2,899
In CISA KEV
21
Most affected vendors (by CPE data where available): microsoft (1359), google (759), oracle (376), apple (282), ibm (149), adobe (138), apache (73), imagemagick (72), broadcom (61), freerdp (60)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2017-20289 Broadstreet Ad Widget plugin for WordPress 2.2.0 before 2.12.0 contains a local... |
high | 7.5 | — | — | 2026-10-22 | 2026-10-23 |
| CVE-2018-25438 Intermesh Group-Office 3.3.0 before 3.5.5 contains an unauthenticated path trave... |
high | 7.5 | — | — | 2026-10-22 | 2026-10-28 |
| CVE-2018-25439 MetInfo CMS 6.0.0 before 6.1.1 contains a path traversal vulnerability in /inclu... |
high | 7.5 | — | — | 2026-10-22 | 2026-10-29 |
| CVE-2019-25778 SeaCMS through 8.7 contains an unauthenticated SQL injection vulnerability that... |
high | 8.2 | — | — | 2026-10-22 | 2026-10-23 |
| CVE-2019-25779 WooThemes Diarise through 1.5.9 contains a file read vulnerability that allows u... |
high | 7.5 | — | — | 2026-10-22 | 2026-11-03 |
| CVE-2017-20287 Javo Spot theme for WordPress before 3.0.0 contains a path traversal vulnerabili... |
high | 7.5 | — | — | 2026-10-22 | 2026-10-28 |
| CVE-2026-112085 webpack-dev-server is a development server that provides live reloading for webp... |
high | 8.2 | — | Webpack.js / webpack-dev-server | 2026-10-22 | 2026-10-29 |
| CVE-2026-112242 Incorrect Privilege Assignment vulnerability in Cozmoslabs Profile Builder profi... |
high | 8.8 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-112312 Missing Authorization vulnerability in ACF Extended ACF Extended acf-extended al... |
high | 7.5 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-112379 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-111830 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-111851 Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection... |
high | 7.6 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-114177 Cross-Site Request Forgery (CSRF) vulnerability in Xpro Xpro Elementor Addons xp... |
high | 8.8 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-97328 The WebP Express WordPress plugin before 0.25.16 does not escape values that its... |
high | 7.5 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-111958 The Royal MCP WordPress plugin before 1.5.7 does not limit a preview-link token... |
high | 7.5 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-109927 The HIPAA Forms WordPress plugin before 3.3.2 does not perform a capability chec... |
high | 7.2 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-109987 The PixelYourSite WordPress plugin before 11.4.3, PixelYourSite Pro WordPress pl... |
high | 7.2 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-114221 NT OneAPP developed by NewType Infortech has a Credential Disclosure vulnerabili... |
high | 7.4 | — | — | 2026-10-22 | 2026-10-30 |
| CVE-2026-114219 NT OneAPP developed by NewType Infortech has a Hard-coded Credentials vulnerabil... |
high | 7.4 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-114730 Roundcube Webmail 1.6.14 before 1.6.20 and 1.7.0 before 1.7.5 is affected by a s... |
high | 7.2 | — | Roundcube / webmail | 2026-10-22 | 2026-11-04 |
| CVE-2026-114732 Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an imprope... |
high | 8.1 | — | Roundcube / webmail | 2026-10-22 | 2026-11-04 |
| CVE-2026-110353 HAProxy 3.2 before 3.4.6 allows a remote unauthenticated attacker to cause a den... |
high | 7.5 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-110354 HAProxy 3 before 3.4.6 allows a remote unauthenticated attacker to cause a denia... |
high | 7.5 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-96365 Allocation of Resources Without Limits or Throttling vulnerability in Drupal Web... |
high | 7.5 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-114724 Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 contains an object inject... |
high | 8.1 | — | Roundcube / webmail | 2026-10-22 | 2026-10-29 |
| CVE-2026-114727 Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 passes potentially unsafe... |
high | 8.3 | — | Roundcube / webmail | 2026-10-22 | 2026-11-02 |
| CVE-2026-114716 Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail hea... |
high | 8.5 | — | Roundcube / webmail | 2026-10-22 | 2026-10-30 |
| CVE-2026-114720 Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an IMAP co... |
high | 7.1 | — | Roundcube / webmail | 2026-10-22 | 2026-10-30 |
| CVE-2026-114661 OpenRemote 1.2.0 before 1.31.0 contains a missing authorization vulnerability in... |
high | 8.5 | — | — | 2026-10-22 | 2026-10-28 |
| CVE-2026-114662 Obot before 0.26.0 contains an authentication bypass vulnerability in the CLI lo... |
high | 8.1 | — | — | 2026-10-22 | 2026-10-28 |
| CVE-2026-114663 Vyper 0.4.0b1 through 0.5.0b1 miscompiles unfoldable constants and omitted defau... |
high | 8.4 | — | — | 2026-10-22 | 2026-10-23 |
| CVE-2026-114664 Frappe Framework before 16.33.0 contains a blind SQL injection vulnerability in... |
high | 7.1 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-114715 Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an incorre... |
high | 8.1 | — | Roundcube / webmail | 2026-10-22 | 2026-11-02 |
| CVE-2026-114642 Traefik 2.11.0 before 2.11.58 and 3.0.0 before 3.7.14 stores its NTLM/Kerberos b... |
high | 8.7 | — | Traefik / traefik | 2026-10-22 | 2026-10-27 |
| CVE-2026-114658 Grav Login plugin from 3.6.0 before 3.9.13 contains a missing authorization vuln... |
high | 8.8 | — | — | 2026-10-22 | 2026-10-28 |
| CVE-2026-114635 Traefik before v2.11.58 and v3.7.14 contains an authentication bypass vulnerabil... |
high | 8.7 | — | Traefik / traefik | 2026-10-22 | 2026-11-04 |
| CVE-2026-114636 Traefik v3.7.13 before v3.7.14 contains an access-control bypass in the Kubernet... |
high | 8.7 | — | Traefik / traefik | 2026-10-22 | 2026-10-28 |
| CVE-2026-114637 Traefik from v3.2.0 before v3.7.14 contains an authentication bypass vulnerabili... |
high | 8.7 | — | Traefik / traefik | 2026-10-22 | 2026-10-28 |
| CVE-2026-114638 Traefik v3.7.0 before v3.7.14 contains an improper authentication vulnerability... |
high | 8.7 | — | Traefik / traefik | 2026-10-22 | 2026-10-27 |
| CVE-2026-114639 Traefik 2.11.0 before 2.11.58 and 3.0.0 before 3.7.14 contains an authentication... |
high | 8.7 | — | Traefik / traefik | 2026-10-22 | 2026-11-04 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.