October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
24,504
Critical
3,294
High
7,930
Medium
7,623
Low
739
Severity not reported
4,918
In CISA KEV
191
Most affected vendors (by CPE data where available): microsoft (1424), google (825), linux (722), ibm (323), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (116), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-102388 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-105885 Deserialization of Untrusted Data vulnerability in 10Web Slider by 10Web slider-... |
high | 8.8 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-94676 Deserialization of Untrusted Data vulnerability in Tainacan Community Tainacan t... |
high | 7.2 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-103071 Improper Control of Generation of Code ('Code Injection') vulnerability in Villa... |
high | 7.5 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-106608 Incorrect Privilege Assignment vulnerability in Automattic WooCommerce woocommer... |
high | 7.2 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-106609 Missing Authorization vulnerability in Web Impian Bayarcash WooCommerce bayarcas... |
high | 7.5 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-62044 Deserialization of Untrusted Data vulnerability in bPlugins Super Video Player s... |
high | 7.2 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-57806 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-96341 Incorrect Privilege Assignment vulnerability in WPMU DEV Forminator forminator a... |
high | 8.2 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-27350 Server-Side Request Forgery (SSRF) vulnerability in Builderius.io Builderius all... |
high | 7.2 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-39799 Unauthenticated Cross Site Scripting (XSS) in WP File Download <= 6.3.6 versions... |
high | 7.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-39800 Unauthenticated Cross Site Scripting (XSS) in Additional Order Filters for WooCo... |
high | 7.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-39802 Unauthenticated Remote Code Execution (RCE) in Everest Backup <= 2.3.13 versions... |
high | 8.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-40777 Subscriber Broken Access Control in WPSection <= 1.5.1 versions. |
high | 8.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-40801 Subscriber Broken Access Control in Wordable <= 8.2.10 versions. |
high | 8.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-40802 Subscriber Settings Change in Pubjet | پابجت <= 5.4.8 versions. |
high | 7.6 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-40803 Unauthenticated Cross Site Scripting (XSS) in Jotform – AI Chatbot <= 3.8.2 vers... |
high | 7.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-40805 Subscriber Arbitrary File Deletion in PeepSo <= 9.0.5.4 versions. |
high | 7.7 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-42630 Unauthenticated Sensitive Data Exposure in Web Plura Backup & Restore Manager <=... |
high | 7.5 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-42631 Unauthenticated Cross Site Scripting (XSS) in Qode Music <= 2.1.8.2 versions. |
high | 7.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-42632 Unauthenticated Cross Site Scripting (XSS) in Qode Real Estate <= 1.1.7.3 versio... |
high | 7.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-42633 Subscriber SQL Injection in Events Manager <= 7.4.6 versions. |
high | 8.5 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-42697 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-42699 Unauthenticated Cross Site Scripting (XSS) in FV Player 8 <= 8.1.8 versions. |
high | 7.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-42704 Unauthenticated Local File Inclusion in Kids Care <= 3.2.4 versions. |
high | 8.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-42705 Unauthenticated Broken Access Control in Grand News <= 3.4 versions. |
high | 7.5 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-42706 Unauthenticated Broken Access Control in DK <= 3.2.1 versions. |
high | 7.5 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-42709 Unauthenticated Cross Site Scripting (XSS) in Food Menu – Restaurant Menu & Onli... |
high | 7.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-42711 Unauthenticated Cross Site Scripting (XSS) in Slider by 10Web <= 1.2.63 versions... |
high | 7.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-42712 Subscriber SQL Injection in Qode Tours <= 3.1.3.2 versions. |
high | 8.5 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-42715 Unauthenticated Cross Site Scripting (XSS) in Photo Gallery by 10Web <= 1.8.47 v... |
high | 7.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-42717 Administrator SQL Injection in Leyka <= 3.32.3 versions. |
high | 7.6 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-42722 Administrator SQL Injection in Frontend Admin by DynamiApps <= 3.29.13 versions. |
high | 7.6 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-42724 Unauthenticated Local File Inclusion in CleanSkin <= 1.5.0 versions. |
high | 8.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-42777 Unauthenticated Local File Inclusion in Aalto <= 1.8 versions. |
high | 8.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-45440 Administrator SQL Injection in WP Ultimate CSV Importer <= 9.2 versions. |
high | 7.6 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-48193 Unauthenticated Local File Inclusion in Uminex <= 1.0.9 versions. |
high | 8.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-48194 Unauthenticated Local File Inclusion in DukaMarket <= 1.3.0 versions. |
high | 8.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-57742 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-62020 Unauthenticated Local File Inclusion in TouchUp < 1.4 versions. |
high | 8.1 | — | — | 2026-10-10 | 2026-10-13 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.