October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,481
Critical
1,390
High
6,087
Medium
6,446
Low
659
Severity not reported
2,899
In CISA KEV
21
Most affected vendors (by CPE data where available): microsoft (1359), google (759), oracle (376), apple (282), ibm (149), adobe (138), apache (73), imagemagick (72), broadcom (61), freerdp (60)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2016-20103 Cherry Plugin for WordPress before 1.2.7 contains a path traversal vulnerability... |
high | 7.5 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2016-20104 EyeLock nano NXT 3.05.1193, 3.04.1108, 3.03.944, and 3.01.646 contain a path tra... |
high | 7.5 | — | — | 2026-10-20 | 2026-10-23 |
| CVE-2026-103672 The PEAK-System PCAN parser indexes a length table using attacker-controlled DLC... |
high | 7.1 | — | — | 2026-10-20 | 2026-10-30 |
| CVE-2015-20124 Aspose Importer & Exporter plugin for WordPress before 3.0 contains a path trave... |
high | 7.5 | — | — | 2026-10-20 | 2026-10-22 |
| CVE-2015-20125 Aspose PDF Exporter plugin for WordPress before 2.0 contains a path traversal vu... |
high | 7.5 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2015-20128 FooSun DotNetCMS 1.0 and 2.0 contains an SQL injection vulnerability that allows... |
high | 8.2 | — | — | 2026-10-20 | 2026-10-23 |
| CVE-2016-20100 Memphis Documents Library plugin for WordPress before 3.1.6 contains a path trav... |
high | 7.5 | — | — | 2026-10-20 | 2026-10-23 |
| CVE-2016-20101 Issuu Panel plugin for WordPress before 1.6.6 contains a PHP file inclusion vuln... |
high | 8.1 | — | — | 2026-10-20 | 2026-10-27 |
| CVE-2014-125133 NativeChurch theme for WordPress before 1.6.2 contains a path traversal vulnerab... |
high | 7.5 | — | — | 2026-10-20 | 2026-10-23 |
| CVE-2014-125134 ChurcHope theme for WordPress before 2.2 contains a path traversal vulnerability... |
high | 7.5 | — | — | 2026-10-20 | 2026-10-23 |
| CVE-2015-20123 Aspose Doc Exporter plugin for WordPress before 2.0 contains a path traversal vu... |
high | 7.5 | — | — | 2026-10-20 | 2026-10-27 |
| CVE-2012-20002 TinyMCE Thumbnail Gallery plugin for WordPress before 1.1.0 contains a path trav... |
high | 7.5 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-86409 Setting `CURLOPT_AWS_SIGV4` to NULL but does not disable SigV4 authentication,
c... |
high | 8.1 | — | — | 2026-10-20 | 2026-10-29 |
| CVE-2026-86410 A flaw in the curl command line tool's logic makes it only set SSH host
verifica... |
high | 8.1 | — | — | 2026-10-20 | 2026-10-29 |
| CVE-2026-86412 A remote HTTP server can set a cookie that curl accepts and writes to a
Netscape... |
high | 8.1 | — | — | 2026-10-20 | 2026-10-29 |
| CVE-2026-113725 virtualenv is a tool for creating isolated virtual python environments. |
high | 7.8 | — | — | 2026-10-20 | 2026-10-22 |
| CVE-2026-113722 virtualenv is a tool for creating isolated virtual python environments. |
high | 7.8 | — | — | 2026-10-20 | 2026-10-23 |
| CVE-2026-113808 A Stored Cross-Site Scripting vulnerability exists in the SNS enrollment Portal. |
high | 7.1 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-113810 A Stored Cross-Site Scripting vulnerability exists in the SNS enrollment Portal. |
high | 7.0 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-111767 MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol ser... |
high | 8.6 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-100134 Acrobat for Edge is affected by an out-of-bounds write vulnerability that could... |
high | 8.8 | — | — | 2026-10-20 | 2026-10-21 |
| CVE-2026-113711 ApostropheCMS is an open-source Node.js content management system. |
high | 7.5 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-113666 ApostropheCMS is an open-source Node.js content management system. |
high | 7.1 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-28328 SolarWinds Observability Self-Hosted was found to be affected by a broken author... |
high | 8.8 | — | — | 2026-10-20 | 2026-10-21 |
| CVE-2026-113658 ApostropheCMS is an open-source Node.js content management system. |
high | 7.5 | — | — | 2026-10-20 | 2026-10-23 |
| CVE-2026-113682 Networknt light-4j from 2.1.5 before 2.4.0 contains an authentication bypass vul... |
high | 7.4 | — | — | 2026-10-20 | 2026-10-23 |
| CVE-2026-113679 HarfBuzz 8.0.0 through 14.6.0 contains an out-of-bounds write vulnerability in t... |
high | 7.0 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-113613 FlexGet before 3.20.7 contains a path traversal vulnerability in the decompress... |
high | 8.1 | — | — | 2026-10-20 | 2026-10-21 |
| CVE-2026-113605 Stirling-PDF from 2.13.2 through 3.2.0 contains an incomplete denylist in Databa... |
high | 7.2 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-113606 Stirling-PDF 3.0.0 through 3.2.0 contains an authorization bypass vulnerability... |
high | 7.1 | — | — | 2026-10-20 | 2026-10-23 |
| CVE-2026-112836 Cross-Site Request Forgery (CSRF) vulnerability in e4jvikwp VikRentCar vikrentca... |
high | 8.8 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-111764 A2A Java SDK is the official Java SDK for the Agent2Agent (A2A) Protocol. |
high | 7.5 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-111765 A2A Java SDK is the official Java SDK for the Agent2Agent (A2A) Protocol. |
high | 7.5 | — | — | 2026-10-20 | 2026-10-22 |
| CVE-2025-71436 Raptor RDF Syntax Library from 2.0.15 through 2.0.16 contains a heap-based buffe... |
high | 7.1 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-95168 An issue in nvbn thefuck v.3.32 allows a local attacker to execute arbitrary cod... |
high | 7.8 | — | — | 2026-10-20 | 2026-10-21 |
| CVE-2026-113397 A security vulnerability has been detected in DrayTek Vigor2960 1.5.1.6 Revision... |
high | 7.4 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-112940 filelock is a platform-independent file lock for Python. |
high | 7.1 | — | Tox-dev / filelock | 2026-10-20 | 2026-10-22 |
| CVE-2026-88041 Incomplete cleanup vulnerability in Apache Tomcat allowed an trailer information... |
high | 7.5 | — | — | 2026-10-20 | 2026-10-29 |
| CVE-2026-91041 Mounting an attacker-controlled FAT image with fault tolerance enabled causes an... |
high | 7.8 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-93446 Incomplete cleanup vulnerability in Apache Tomcat could cause TLS 1.3 connection... |
high | 7.5 | — | — | 2026-10-20 | 2026-10-29 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.