October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,481
Critical
1,390
High
6,087
Medium
6,446
Low
659
Severity not reported
2,899
In CISA KEV
21
Most affected vendors (by CPE data where available): microsoft (1359), google (759), oracle (376), apple (282), ibm (149), adobe (138), apache (73), imagemagick (72), broadcom (61), freerdp (60)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-111923 Fleet before 4.89.0 contains an unbounded recursion vulnerability in Apple MDM e... |
high | 7.5 | — | — | 2026-10-17 | 2026-10-19 |
| CVE-2026-111924 Fleet before 4.83.0 contains a denial of service vulnerability that allows unaut... |
high | 7.5 | — | — | 2026-10-17 | 2026-10-19 |
| CVE-2026-111927 Coder before 2.29.20, 2.33.0 before 2.33.12, 2.34.0 before 2.34.8, and 2.35.0 be... |
high | 7.7 | — | — | 2026-10-17 | 2026-11-04 |
| CVE-2026-111908 phpMyFAQ 4.0.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains a broken... |
high | 8.3 | — | — | 2026-10-17 | 2026-10-19 |
| CVE-2026-111909 phpMyFAQ before 4.1.9 contains a missing authorization vulnerability in the dele... |
high | 8.1 | — | — | 2026-10-17 | 2026-10-18 |
| CVE-2026-111907 phpMyFAQ 4.0.0 before 4.1.9 contains a cross-site request forgery vulnerability... |
high | 7.1 | — | — | 2026-10-17 | 2026-10-19 |
| CVE-2026-111897 phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an authorization bypass vulnerab... |
high | 7.1 | — | — | 2026-10-17 | 2026-10-19 |
| CVE-2026-111898 phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an authentication bypass vulnera... |
high | 7.5 | — | — | 2026-10-17 | 2026-10-18 |
| CVE-2026-111901 phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an uncontrolled resource consump... |
high | 7.5 | — | — | 2026-10-17 | 2026-10-19 |
| CVE-2026-111881 FreeRDP from 3.14.1 before 3.32.0 contains an integer underflow in the WinPR BMP... |
high | 7.6 | — | — | 2026-10-17 | 2026-10-19 |
| CVE-2026-111882 phpMyFAQ 3.2.0-alpha before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an... |
high | 8.1 | — | — | 2026-10-17 | 2026-10-18 |
| CVE-2026-111884 phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta does not require the cur... |
high | 8.3 | — | — | 2026-10-17 | 2026-10-18 |
| CVE-2026-111880 FreeRDP versions from 2.0.0 before 3.32.0 contain a heap out-of-bounds write in... |
high | 7.4 | — | — | 2026-10-17 | 2026-10-19 |
| CVE-2026-109701 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-17 | 2026-10-19 |
| CVE-2026-110889 Generation of Error Message Containing Sensitive Information vulnerability in Ga... |
high | 7.5 | — | — | 2026-10-17 | 2026-10-19 |
| CVE-2026-111110 The Payment forms, Buy now buttons, and Invoicing System | GetPaid plugin for Wo... |
high | 7.2 | — | — | 2026-10-17 | 2026-10-19 |
| CVE-2026-100316 The European VAT Compliance Assistant for WooCommerce plugin for WordPress is vu... |
high | 7.2 | — | — | 2026-10-17 | 2026-10-19 |
| CVE-2026-110384 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-17 | 2026-10-19 |
| CVE-2026-92798 The User Registration & Membership plugin for WordPress is vulnerable to Arbitra... |
high | 8.1 | — | — | 2026-10-17 | 2026-10-19 |
| CVE-2026-96660 The User Registration & Membership – Free & Paid Memberships, Subscriptions, Con... |
high | 7.2 | — | — | 2026-10-17 | 2026-10-19 |
| CVE-2026-108123 The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to a... |
high | 7.5 | — | — | 2026-10-17 | 2026-10-19 |
| CVE-2026-103899 The EU VAT Assistant for WooCommerce plugin for WordPress is vulnerable to Store... |
high | 7.2 | — | — | 2026-10-17 | 2026-10-19 |
| CVE-2026-107762 The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordP... |
high | 7.5 | — | — | 2026-10-17 | 2026-10-19 |
| CVE-2026-109208 The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin... |
high | 7.2 | — | — | 2026-10-17 | 2026-10-19 |
| CVE-2026-104734 The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordP... |
high | 7.2 | — | — | 2026-10-17 | 2026-10-19 |
| CVE-2026-111853 An issue was discovered on Tektronix 3 Series MDO devices before 1.21.1. |
high | 8.8 | — | — | 2026-10-17 | 2026-10-19 |
| CVE-2026-111854 An issue was discovered on Tektronix 3 Series MDO devices before 1.21.1. |
high | 8.1 | — | — | 2026-10-17 | 2026-10-19 |
| CVE-2026-111855 An issue was discovered on Tektronix 3 Series MDO devices before 1.21.1. |
high | 7.5 | — | — | 2026-10-17 | 2026-10-21 |
| CVE-2026-110758 Text::CSV_XS versions before 1.65 for Perl read before the start of an all-blank... |
high | 7.5 | — | — | 2026-10-16 | 2026-10-20 |
| CVE-2026-110752 Text::CSV_XS versions before 1.65 for Perl allow memory exhaustion by allocating... |
high | 7.5 | — | — | 2026-10-16 | 2026-10-20 |
| CVE-2026-110755 Text::CSV_XS versions before 1.65 for Perl allow quadratic CPU use by copying th... |
high | 7.5 | — | — | 2026-10-16 | 2026-10-20 |
| CVE-2026-96626 Arcane is an interface for managing Docker containers, images, networks, and vol... |
high | 8.5 | — | — | 2026-10-16 | 2026-10-28 |
| CVE-2026-96627 Arcane is an interface for managing Docker containers, images, networks, and vol... |
high | 8.8 | — | — | 2026-10-16 | 2026-10-19 |
| CVE-2026-68498 StreamReadConstraints.maxNameLength (default 50,000 characters) is intended to b... |
high | 7.5 | — | — | 2026-10-16 | 2026-10-20 |
| CVE-2026-62439 A flaw was found in GIMP. |
high | 7.0 | — | — | 2026-10-16 | 2026-11-04 |
| CVE-2026-49410 OpenHuman is an open-source agent harness available as a desktop application and... |
high | 8.1 | — | — | 2026-10-16 | 2026-10-19 |
| CVE-2026-111044 Sunshine is a self-hosted game stream host for Moonlight. |
high | 7.6 | — | — | 2026-10-16 | 2026-10-28 |
| CVE-2026-108374 ERPNext is a free and open source Enterprise Resource Planning tool. |
high | 7.7 | — | — | 2026-10-16 | 2026-10-19 |
| CVE-2026-68572 Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apac... |
high | 7.5 | — | — | 2026-10-16 | 2026-10-20 |
| CVE-2026-69076 Exposure of Job Discard to an Unauthorized Actor vulnerability in Apache Kylin. |
high | 7.5 | — | — | 2026-10-16 | 2026-10-20 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.