October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
23,704
Critical
3,236
High
7,702
Medium
7,359
Low
705
Severity not reported
4,702
In CISA KEV
188
Most affected vendors (by CPE data where available): microsoft (1426), google (825), linux (722), ibm (323), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-10752 The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to autho... |
medium | 4.8 | — | — | 2026-10-27 | 2026-10-29 |
| CVE-2026-110020 The Rich Showcase for Google Reviews plugin for WordPress is vulnerable to autho... |
medium | 6.5 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-110071 The Mang Board plugin for WordPress is vulnerable to Stored Cross-Site Scripting... |
medium | 6.4 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-109974 The All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Sel... |
medium | 6.4 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-109385 The UiChemy – Convert Figma, Prompts and AI Builds to Elementor, Gutenberg and B... |
medium | 6.4 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-109590 The Tour Booking Manager plugin for WordPress is vulnerable to Stored Cross-Site... |
medium | 6.4 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-109975 The Cozy Blocks – Website Builder for WordPress Block Editor | Gutenberg Blocks,... |
medium | 6.4 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-109978 The Cozy Blocks – Website Builder for WordPress Block Editor | Gutenberg Blocks,... |
medium | 6.4 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-109979 The Related Posts for WordPress plugin for WordPress is vulnerable to Sensitive... |
medium | 4.3 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-109988 The Product Addons for Woocommerce – Product Options with Custom Fields plugin f... |
medium | 4.4 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-107745 The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPre... |
medium | 4.2 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-109209 The All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Sel... |
medium | 6.4 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-104743 The Tainacan plugin for WordPress is vulnerable to Directory Traversal in all ve... |
medium | 4.9 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-108366 The easy.jobs – AI powered Job Listing, Job Board, Career Page, Recruitment & Hi... |
medium | 6.4 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-109370 The Document Embedder – let visitors read files without downloading plugin for W... |
medium | 6.4 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-103370 The Awesome Support – WordPress HelpDesk & Support Plugin plugin for WordPress i... |
medium | 6.4 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-104729 The Avada (Fusion) Builder plugin for WordPress is vulnerable to Stored Cross-Si... |
medium | 6.4 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-104740 The If-So Dynamic Content – Elementor & All Page Builders Personalization plugin... |
medium | 6.4 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-101935 The Echo Knowledge Base – Documentation, FAQs, Chat & Smart Search plugin for Wo... |
medium | 6.1 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-103390 An Out-of-Bounds Read vulnerability in the HttpParser component in Juniper Netwo... |
medium | 5.3 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-103400 An Improper Neutralization of Special Elements in Output Used by a Downstream Co... |
medium | 5.5 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-101497 Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware... |
medium | 4.3 | — | Oracle / identity manager | 2026-10-20 | 2026-10-29 |
| CVE-2026-101502 Vulnerability in Oracle Trusted Answer Search (component: PLSQL package). |
medium | 5.0 | — | — | 2026-10-20 | 2026-10-29 |
| CVE-2026-101524 Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle E... |
medium | 5.6 | — | — | 2026-10-20 | 2026-10-29 |
| CVE-2026-101575 Vulnerability in the Helidon product of Oracle Fusion Middleware (component: LRA... |
medium | 6.5 | — | — | 2026-10-20 | 2026-10-29 |
| CVE-2026-101584 Vulnerability in the Helidon product of Oracle Fusion Middleware (component: hel... |
medium | 6.5 | — | — | 2026-10-20 | 2026-10-29 |
| CVE-2026-101471 Vulnerability in the Oracle Product Lifecycle Analytics product of Oracle Supply... |
medium | 6.1 | — | — | 2026-10-20 | 2026-10-29 |
| CVE-2026-101474 Vulnerability in the Oracle Agile Product Lifecycle Management for Process produ... |
medium | 5.9 | — | — | 2026-10-20 | 2026-10-29 |
| CVE-2026-101488 Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleS... |
medium | 6.5 | — | Oracle / peoplesoft enterprise peopletools | 2026-10-20 | 2026-10-29 |
| CVE-2026-101365 Vulnerability in Oracle REST Data Services (component: Database Actions). |
medium | 4.7 | — | — | 2026-10-20 | 2026-10-29 |
| CVE-2026-100175 The Postie plugin for WordPress is vulnerable to Stored Cross-Site Scripting via... |
medium | 5.4 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-93633 A CSS sanitization vulnerability in Zimbra Collaboration Suite (ZCS) allows an a... |
medium | 5.4 | — | Synacor / zimbra collaboration suite | 2026-10-23 | 2026-10-28 |
| CVE-2026-93634 A cross-account authorization vulnerability in Zimbra Collaboration Suite (ZCS)... |
medium | 4.3 | — | Synacor / zimbra collaboration suite | 2026-10-23 | 2026-10-28 |
| CVE-2026-91257 Vulnerability in the iSupport product of Oracle E-Business Suite (component: Ser... |
medium | 6.5 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-91262 Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middlewar... |
medium | 5.4 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-91263 Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleS... |
medium | 4.9 | — | Oracle / peoplesoft enterprise peopletools | 2026-10-20 | 2026-10-28 |
| CVE-2026-91240 Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware... |
medium | 5.9 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-66324 External control of file name or path in Microsoft Edge (Chromium-based) allows... |
medium | 6.5 | — | Microsoft / edge chromium | 2026-08-28 | 2026-10-28 |
| CVE-2026-66798 Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacke... |
medium | 4.3 | — | Microsoft / edge chromium | 2026-08-28 | 2026-10-28 |
| CVE-2026-66323 Improper neutralization of parameter/argument delimiters in Microsoft Edge (Chro... |
medium | 5.4 | — | Microsoft / edge chromium | 2026-08-28 | 2026-10-28 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.