October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
24,105
Critical
3,260
High
7,834
Medium
7,482
Low
725
Severity not reported
4,804
In CISA KEV
188
Most affected vendors (by CPE data where available): microsoft (1424), google (825), linux (722), ibm (323), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (116), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-100515 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-103334 Insertion of Sensitive Information Into Sent Data vulnerability in Etoile Web De... |
high | 7.5 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-103349 Deserialization of Untrusted Data vulnerability in Rymera Web Co Product Feed PR... |
high | 7.2 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-97303 Missing Authorization vulnerability in Apps Mav Scratch & Win – Giveaways and Co... |
high | 7.6 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-100506 Deserialization of Untrusted Data vulnerability in WP Spell Check WP Spell Check... |
high | 7.2 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-100511 Deserialization of Untrusted Data vulnerability in Vektor Inc. |
high | 8.8 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-103066 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
high | 8.5 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-103348 Deserialization of Untrusted Data vulnerability in Smackcoders Inc. |
high | 7.2 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-93617 Deserialization of Untrusted Data vulnerability in WP Sunshine Sunshine Photo Ca... |
high | 7.2 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-97257 Deserialization of Untrusted Data vulnerability in PressTigers Simple Event Plan... |
high | 8.8 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-105072 Unauthenticated Broken Access Control in FluentBooking Pro < 2.5.0 versions. |
high | 7.5 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-39760 Unauthenticated Cross Site Scripting (XSS) in Real 3D FlipBook <= 5.5 versions. |
high | 7.1 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-39789 Unauthenticated Broken Access Control in Fluent Affiliate Pro <= 1.6.4 versions. |
high | 7.5 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-41558 Subscriber Bypass Vulnerability in WP Migration Plugin DB & Files – WP Synchro <... |
high | 7.5 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-41563 Unauthenticated Sensitive Data Exposure in Sitemovr <= 1.0.1 versions. |
high | 7.5 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-102387 Unauthenticated Sensitive Data Exposure in Xserver Migrator <= 1.6.6 versions. |
high | 7.5 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-102915 Subscriber Broken Access Control in WPO365 <= 44.1 versions. |
high | 8.5 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-103346 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-104385 Unauthenticated Sensitive Data Exposure in Groundhogg <= 4.8.3 versions. |
high | 7.5 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-104387 Unauthenticated Broken Access Control in PowerPress Podcasting <= 11.17.9 versio... |
high | 7.2 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-104394 Unauthenticated Cross Site Scripting (XSS) in Charitable <= 1.8.12.3 versions. |
high | 7.1 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-104395 Unauthenticated Cross Site Scripting (XSS) in picu <= 3.10.1 versions. |
high | 7.1 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-104405 Unauthenticated Privilege Escalation in GiveWP <= 4.17.0 versions. |
high | 8.1 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-104406 Unauthenticated Broken Access Control in picu <= 3.10.1 versions. |
high | 7.3 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-104670 Unauthenticated Cross Site Scripting (XSS) in LearnPress <= 4.4.9 versions. |
high | 7.1 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-104672 Unauthenticated Cross Site Scripting (XSS) in GiveWP <= 4.17.0 versions. |
high | 7.1 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-104747 Unauthenticated PHP Object Injection in Haaken <= 1.5 versions. |
high | 8.1 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-104757 Editor Privilege Escalation in Import and export users and customers <= 2.5.5 ve... |
high | 7.2 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-104814 Unauthenticated Cross Site Scripting (XSS) in Form Block <= 1.8.1 versions. |
high | 7.1 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-105058 Subscriber Privilege Escalation in WP User Profiles <= 2.7.3 versions. |
high | 8.8 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-105061 Unauthenticated Cross Site Scripting (XSS) in WP Mailster <= 1.9.0.0 versions. |
high | 7.1 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-105070 Unauthenticated Privilege Escalation in Salon booking system <= 10.31.7 versions... |
high | 8.8 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-105071 Unauthenticated Sensitive Data Exposure in SiteVault – Backup, Restore, Migratio... |
high | 7.5 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-105317 Subscriber SQL Injection in Paid Member Subscriptions <= 3.1.1 versions. |
high | 8.5 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-25433 Subscriber Broken Access Control in WP2LEADS <= 3.5.7 versions. |
high | 7.1 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-25434 Subscriber SQL Injection in WP2LEADS <= 3.5.7 versions. |
high | 8.5 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-32569 Unauthenticated Cross Site Scripting (XSS) in WP Media folder <= 6.2.2 versions. |
high | 7.1 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-32570 Unauthenticated Cross Site Scripting (XSS) in Progressify - Progressive Web App... |
high | 7.1 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-32572 Unauthenticated Cross Site Scripting (XSS) in WP User Frontend Pro <= 4.2.13 ver... |
high | 7.1 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-32575 Unauthenticated Cross Site Scripting (XSS) in SUMO Affiliates Pro <= 11.7.0 vers... |
high | 7.1 | — | — | 2026-10-06 | 2026-10-06 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.