October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
24,538
Critical
3,296
High
7,954
Medium
7,627
Low
740
Severity not reported
4,921
In CISA KEV
191
Most affected vendors (by CPE data where available): microsoft (1424), google (825), linux (722), ibm (323), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (116), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-88100 Use after free in Windows Storage Spaces Controller allows an authorized attacke... |
high | 7.8 | — | Microsoft / windows 11 24h2 | 2026-10-13 | 2026-10-16 |
| CVE-2026-106498 Backstage is an open framework for building developer portals. |
high | 7.7 | — | Linuxfoundation / backstage plugin-catalog-backend | 2026-10-06 | 2026-10-16 |
| CVE-2026-14177 Observable response discrepancy vulnerability in IKAS Technology Inc. |
high | 7.5 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-63618 Exposure of Sensitive Information (system level configuration info) to an Unauth... |
high | 7.5 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-96339 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-97296 Deserialization of Untrusted Data vulnerability in Rocketgenius, Inc Gravity For... |
high | 8.1 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-111396 Missing Authorization vulnerability in Liquid Web / StellarWP Advanced Post Mana... |
high | 7.1 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-111399 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
high | 8.5 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-111413 Cross-Site Request Forgery (CSRF) vulnerability in aThemeArt aThemeArt Theme Hel... |
high | 8.8 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-97781 Improper neutralization of special elements used in a command ('command injectio... |
high | 8.8 | — | Microsoft / 365 apps | 2026-10-13 | 2026-10-16 |
| CVE-2026-97640 The WPConsent – Cookie Banner & Cookie Consent for Privacy Compliance (GDPR / CC... |
high | 7.2 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-95686 The Opti-Behavior – Self-Hosted Heatmaps, Session Recordings, Funnels, A/B Testi... |
high | 7.2 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-95809 The Opti-Behavior – Self-Hosted Heatmaps, Session Recordings, Funnels, A/B Testi... |
high | 7.2 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-96570 The Schema & Structured Data for WP & AMP plugin for WordPress is vulnerable to... |
high | 7.2 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-96768 The GoSMTP Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting... |
high | 7.2 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-93953 The Backuply – Backup, Restore, Migrate and Clone plugin for WordPress is vulner... |
high | 8.0 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-92115 The WP Photo Album Plus plugin for WordPress is vulnerable to authenticated Comm... |
high | 8.8 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-92553 The YaySMTP – WP Mail SMTP with Email Logs, Tracking & Reports plugin for WordPr... |
high | 8.8 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-92766 The Vitepos – Point of Sale (POS) for WooCommerce plugin for WordPress is vulner... |
high | 7.5 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-85659 The PilotPress plugin for WordPress is vulnerable to Privilege Escalation via Ac... |
high | 8.8 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-89051 The WP Ghost (Hide My WP Ghost) – Security & Firewall plugin for WordPress is vu... |
high | 7.2 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-75903 The Vulnity Security plugin for WordPress is vulnerable to authentication bypass... |
high | 8.1 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-87111 The User Registration PRO – Custom Registration Form, Login Form, and User Profi... |
high | 7.2 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-111277 NivoCart through 2.5.1 contains a missing authorization vulnerability in the dow... |
high | 7.5 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-111122 The SiteOrigin CSS plugin for WordPress is vulnerable to Stored DOM-Based Cross-... |
high | 7.2 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-110590 The Klarna for WooCommerce plugin for WordPress is vulnerable to authorization b... |
high | 7.5 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-110701 The CP Multi View Events Calendar plugin for WordPress is vulnerable to Stored C... |
high | 7.2 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-110015 The Salon Booking System WordPress plugin before 10.31.9 does not correctly veri... |
high | 8.8 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-110135 The OTP Login & Register Woocommerce WordPress plugin before 2.7.3 does not adeq... |
high | 7.4 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-109685 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-109693 Incorrect Privilege Assignment vulnerability in WP ManageNinja LLC Fluent CRM fl... |
high | 8.8 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-109990 The Flying Scripts: Delay JavaScript to Improve Site Speed & Performance plugin... |
high | 7.2 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-109998 The Mang Board plugin for WordPress is vulnerable to Stored Cross-Site Scripting... |
high | 7.2 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-109232 The Salon Booking System – Appointment Booking for Salons, Barbershops & Spas pl... |
high | 7.2 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-109447 The User Profile Builder – Beautiful User Registration Forms, User Profiles & Us... |
high | 8.1 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-109513 The NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR... |
high | 7.2 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-109207 The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video... |
high | 7.2 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-109193 The HivePress – Business Directory, Listings & Classified Ads Plugin plugin for... |
high | 7.2 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-109224 The SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downlo... |
high | 7.2 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-107758 The Colibri Page Builder plugin for WordPress is vulnerable to Stored Cross-Site... |
high | 7.2 | — | — | 2026-10-16 | 2026-10-16 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.