October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,481
Critical
1,390
High
6,087
Medium
6,446
Low
659
Severity not reported
2,899
In CISA KEV
21
Most affected vendors (by CPE data where available): microsoft (1359), google (759), oracle (376), apple (282), ibm (149), adobe (138), apache (73), imagemagick (72), broadcom (61), freerdp (60)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-114243 A security flaw has been discovered in dhikshitha29 Insurance-Management-System... |
high | 7.3 | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2026-80463 Unbounded memory accumulation in the stream message reassembly path of Apache bR... |
high | 7.5 | — | — | 2026-10-21 | 2026-10-30 |
| CVE-2026-81755 Uncontrolled resource consumption in the streaming RPC component of Apache bRPC... |
high | 7.5 | — | — | 2026-10-21 | 2026-10-30 |
| CVE-2026-78048 A reachable-assertion flaw in the HPACK header-compression decoder of the HTTP/2... |
high | 7.5 | — | — | 2026-10-21 | 2026-10-30 |
| CVE-2026-78058 Uncontrolled resource consumption in the HTTP/2 (h2) receive path of Apache bRPC... |
high | 7.5 | — | — | 2026-10-21 | 2026-10-30 |
| CVE-2026-78066 Resource exhaustion in Apache bRPC (version < 1.18.0) on all platforms: multiple... |
high | 7.5 | — | — | 2026-10-21 | 2026-10-30 |
| CVE-2026-79704 An out-of-bounds read vulnerability exists in the streaming RPC client of Apache... |
high | 7.5 | — | — | 2026-10-21 | 2026-10-30 |
| CVE-2026-61902 Apache bRPC versions before 1.18.0 do not consistently enforce the configured ma... |
high | 7.5 | — | — | 2026-10-21 | 2026-10-30 |
| CVE-2026-61916 Out-of-bounds reads in URL parsing and case-insensitive header lookup in Apache... |
high | 7.5 | — | — | 2026-10-21 | 2026-10-30 |
| CVE-2026-74755 An integer underflow in the mcpack2pb component of Apache bRPC (version < 1.18.0... |
high | 7.5 | — | — | 2026-10-21 | 2026-10-30 |
| CVE-2026-74757 Uncontrolled resource allocation in the mcpack2pb component in Apache bRPC (vers... |
high | 7.5 | — | — | 2026-10-21 | 2026-10-26 |
| CVE-2026-74758 A heap use-after-free in the RTMP protocol component of Apache bRPC (versions <... |
high | 7.5 | — | — | 2026-10-21 | 2026-10-30 |
| CVE-2026-54425 Uncontrolled recursion in the HTTP/2 HPACK decoder in Apache bRPC before 1.18.0... |
high | 7.5 | — | — | 2026-10-21 | 2026-10-30 |
| CVE-2026-54426 Uncontrolled recursion in the Redis reply parser in Apache bRPC < 1.18.0 allows... |
high | 7.5 | — | — | 2026-10-21 | 2026-10-30 |
| CVE-2026-54427 Uncontrolled recursion in the AMF parser in Apache bRPC < 1.18.0 allows a remote... |
high | 7.5 | — | — | 2026-10-21 | 2026-10-30 |
| CVE-2026-56386 Integer underflow and out-of-bounds read in the HTTP/2 server DATA frame parser... |
high | 7.5 | — | — | 2026-10-21 | 2026-10-26 |
| CVE-2026-56387 The RTMP AMF parser in Apache bRPC accepts AMF string lengths and array counts d... |
high | 7.5 | — | — | 2026-10-21 | 2026-10-30 |
| CVE-2026-58064 The Redis protocol implementation in Apache bRPC allowed inline command parsing... |
high | 7.5 | — | — | 2026-10-21 | 2026-10-30 |
| CVE-2026-59229 The Legacy Pipe receiver protocol (handshake / sendPipeData) uses a
hardcoded SU... |
high | 8.8 | — | — | 2026-10-21 | 2026-10-30 |
| CVE-2026-114242 A vulnerability was identified in dhikshitha29 Insurance-Management-System 91de5... |
high | 7.3 | — | — | 2026-10-21 | 2026-10-27 |
| CVE-2026-41114 Uncontrolled Resource Consumption vulnerability in Apache IoTDB JDBC driver. |
high | 7.5 | — | — | 2026-10-21 | 2026-10-30 |
| CVE-2026-110369 Deserialization of Untrusted Data vulnerability in GS Plugins WordPress Team Mem... |
high | 8.8 | — | — | 2026-10-21 | 2026-10-21 |
| CVE-2026-110370 Deserialization of Untrusted Data vulnerability in GS Plugins GS Pins for Pinter... |
high | 8.8 | — | — | 2026-10-21 | 2026-10-21 |
| CVE-2026-110884 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-21 | 2026-10-21 |
| CVE-2026-85683 The Jane Menu WordPress plugin before 1.5.1 does not have any capability or nonc... |
high | 8.8 | — | — | 2026-10-21 | 2026-10-21 |
| CVE-2026-97206 NLnet Labs Unbound, 1.22.0 up to and including version 1.26.1, contains a DNS-ov... |
high | 7.5 | — | — | 2026-10-21 | 2026-10-29 |
| CVE-2026-110899 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-21 | 2026-10-21 |
| CVE-2026-107435 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-21 | 2026-10-21 |
| CVE-2026-85642 The Formidable Forms WordPress plugin before 7.0 does not verify the identity of... |
high | 7.5 | — | — | 2026-10-21 | 2026-10-21 |
| CVE-2026-88784 The Translate WordPress with Weglot 2.0 WordPress plugin before 6.4.3 does not e... |
high | 7.5 | — | — | 2026-10-21 | 2026-10-21 |
| CVE-2026-92997 The Click n Chat (Chat Widget Integration) WordPress plugin before 1.1.3 does no... |
high | 8.6 | — | — | 2026-10-21 | 2026-10-21 |
| CVE-2026-92998 The Click n Chat (Chat Widget Integration) WordPress plugin before 1.1.3 does no... |
high | 8.6 | — | — | 2026-10-21 | 2026-10-21 |
| CVE-2026-79627 The Advanced File Manager WordPress plugin before 6.0.0 does not correctly deter... |
high | 7.1 | — | — | 2026-10-21 | 2026-10-21 |
| CVE-2026-111574 The Redirection for Contact Form 7 WordPress plugin before 3.2.12 does not sanit... |
high | 7.5 | — | — | 2026-10-21 | 2026-10-21 |
| CVE-2026-111948 The User Profile Builder WordPress plugin before 4.0.1 does not escape the curre... |
high | 7.1 | — | — | 2026-10-21 | 2026-10-21 |
| CVE-2026-111949 The miniOrange 2FA WordPress plugin before 6.3.1 does not prevent a pending pass... |
high | 7.5 | — | — | 2026-10-21 | 2026-10-21 |
| CVE-2026-109147 The WP Booking System WordPress plugin before 2.1.0.3 does not validate and esca... |
high | 7.1 | — | — | 2026-10-21 | 2026-10-21 |
| CVE-2026-110523 The WP User Manager WordPress plugin before 2.9.26 does not keep its paid-regist... |
high | 8.1 | — | — | 2026-10-21 | 2026-10-21 |
| CVE-2026-105262 The Falang multilanguage for WordPress plugin before 1.4.6 does not perform a ca... |
high | 8.0 | — | — | 2026-10-21 | 2026-10-21 |
| CVE-2026-107127 The Uncanny Toolkit for LearnDash WordPress plugin before 3.8.2 does not validat... |
high | 7.5 | — | — | 2026-10-21 | 2026-10-21 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.