October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
23,281
Critical
3,225
High
7,606
Medium
7,217
Low
653
Severity not reported
4,580
In CISA KEV
188
Most affected vendors (by CPE data where available): microsoft (1426), google (825), linux (722), ibm (323), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-107789 The SmartyParcel WordPress plugin before 1.23.4 does not perform authorisation c... |
medium | 5.3 | — | — | 2026-10-21 | 2026-10-21 |
| CVE-2026-107790 The HireZoot WordPress plugin before 4.1.1 does not sanitise and escape some of... |
medium | 6.8 | — | — | 2026-10-21 | 2026-10-21 |
| CVE-2026-108073 The SureCart WordPress plugin before 4.9.5 does not restrict which related objec... |
medium | 5.3 | — | — | 2026-10-21 | 2026-10-21 |
| CVE-2026-109926 The Productive Commerce WordPress plugin before 1.1.49 does not perform a capabi... |
medium | 4.3 | — | — | 2026-10-21 | 2026-10-21 |
| CVE-2026-110514 The WPZOOM Portfolio Lite WordPress plugin before 1.4.34 does not check that a u... |
medium | 4.9 | — | — | 2026-10-21 | 2026-10-21 |
| CVE-2026-110651 The Swift Performance Lite WordPress plugin before 2.3.7.4 does not properly san... |
medium | 6.8 | — | — | 2026-10-21 | 2026-10-21 |
| CVE-2026-110982 The AI Engine WordPress plugin before 3.8.6 does not check that the caller is al... |
medium | 4.9 | — | — | 2026-10-21 | 2026-10-21 |
| CVE-2026-111596 The Kliken: Ads + Pixel for Meta WordPress plugin before 1.2.3 does not verify t... |
medium | 5.3 | — | — | 2026-10-21 | 2026-10-21 |
| CVE-2026-111947 The Pricing Table WordPress Plugin WordPress plugin before 4.1.3 does not perfor... |
medium | 5.5 | — | — | 2026-10-21 | 2026-10-21 |
| CVE-2026-111955 The WholesaleX WordPress plugin before 3.0.9 does not check that a stored accoun... |
medium | 6.5 | — | — | 2026-10-21 | 2026-10-21 |
| CVE-2026-111956 The WholesaleX WordPress plugin before 3.0.9 does not protect or remove the user... |
medium | 5.9 | — | — | 2026-10-21 | 2026-10-21 |
| CVE-2026-111957 The SUMIT Payment Gateway for WooCommerce WordPress plugin before 4.0.0 does not... |
medium | 5.3 | — | — | 2026-10-21 | 2026-10-21 |
| CVE-2026-15261 The TI WooCommerce Wishlist WordPress plugin before 2.13.0 does not enforce the... |
medium | 5.3 | — | — | 2026-10-21 | 2026-10-21 |
| CVE-2026-81812 The Elementor Website Builder WordPress plugin before 4.3.5 does not sanitize up... |
medium | 6.4 | — | — | 2026-10-21 | 2026-10-21 |
| CVE-2026-81813 The Elementor Website Builder WordPress plugin before 4.3.5 does not sanitize th... |
medium | 6.8 | — | — | 2026-10-21 | 2026-10-21 |
| CVE-2026-86611 The Download Manager WordPress plugin before 3.3.71, Download Manager WordPress... |
medium | 4.3 | — | — | 2026-10-21 | 2026-10-21 |
| CVE-2026-87837 The Wava Payment Plugin WordPress plugin before 0.3.10 does not verify the authe... |
medium | 5.3 | — | — | 2026-10-21 | 2026-10-21 |
| CVE-2026-87838 The Wava Payment Plugin WordPress plugin before 0.3.10 does not perform any auth... |
medium | 6.5 | — | — | 2026-10-21 | 2026-10-21 |
| CVE-2026-92999 The Click n Chat (Chat Widget Integration) WordPress plugin before 1.1.3 does no... |
medium | 5.3 | — | — | 2026-10-21 | 2026-10-21 |
| CVE-2026-101138 The CMP – Coming Soon & Maintenance WordPress plugin before 4.1.21 does not corr... |
medium | 5.3 | — | — | 2026-10-21 | 2026-10-21 |
| CVE-2026-103301 The Payment Gateway for Telcell WordPress plugin before 2.0.5 does not verify th... |
medium | 5.3 | — | — | 2026-10-21 | 2026-10-21 |
| CVE-2026-104641 The Simple Shopping Cart WordPress plugin before 5.3.3 does not verify that a Pa... |
medium | 5.3 | — | — | 2026-10-21 | 2026-10-21 |
| CVE-2026-105256 The LatePoint WordPress plugin before 5.7.5 does not validate the client-supplie... |
medium | 5.3 | — | — | 2026-10-21 | 2026-10-21 |
| CVE-2026-107447 The Contest Gallery WordPress plugin before 34.0.1 does not reliably validate th... |
medium | 5.3 | — | — | 2026-10-21 | 2026-10-21 |
| CVE-2026-14556 The HappyForms WordPress plugin before 1.26.15 does not sanitise or escape a use... |
medium | 5.4 | — | — | 2026-10-21 | 2026-10-21 |
| CVE-2026-106569 ImageMagick is free and open-source software used for editing and manipulating d... |
medium | 5.3 | — | Imagemagick / imagemagick | 2026-10-07 | 2026-10-21 |
| CVE-2026-106570 ImageMagick is free and open-source software used for editing and manipulating d... |
medium | 6.5 | — | Imagemagick / imagemagick | 2026-10-07 | 2026-10-21 |
| CVE-2026-106571 ImageMagick is free and open-source software used for editing and manipulating d... |
medium | 5.5 | — | Imagemagick / imagemagick | 2026-10-07 | 2026-10-21 |
| CVE-2026-106572 ImageMagick is free and open-source software used for editing and manipulating d... |
medium | 5.3 | — | Imagemagick / imagemagick | 2026-10-07 | 2026-10-21 |
| CVE-2026-111835 Missing Authorization vulnerability in bjorntech BjornTech Swish for WooCommerce... |
medium | 6.5 | — | — | 2026-10-21 | 2026-10-21 |
| CVE-2026-111837 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-21 | 2026-10-21 |
| CVE-2026-114251 A vulnerability has been found in itsourcecode Sales-and-Inventory-System up to... |
medium | 6.3 | — | — | 2026-10-21 | 2026-10-21 |
| CVE-2026-114437 In the Golang Chi web framework, the ClientIPFromXFF middleware skips any X-Forw... |
medium | 4.8 | — | — | 2026-10-21 | 2026-10-21 |
| CVE-2026-106574 ImageMagick is free and open-source software used for editing and manipulating d... |
medium | 6.5 | — | Imagemagick / imagemagick | 2026-10-07 | 2026-10-21 |
| CVE-2026-106575 ImageMagick is free and open-source software used for editing and manipulating d... |
medium | 5.3 | — | Imagemagick / imagemagick | 2026-10-07 | 2026-10-21 |
| CVE-2026-112936 filelock is a platform-independent file lock for Python. |
medium | 6.1 | — | Tox-dev / filelock | 2026-10-20 | 2026-10-21 |
| CVE-2026-83774 Exposure of sensitive system information to an unauthorized control sphere in Wi... |
medium | 4.7 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-21 |
| CVE-2026-112937 filelock is a platform-independent file lock for Python. |
medium | 6.1 | — | Tox-dev / filelock | 2026-10-20 | 2026-10-21 |
| CVE-2026-112939 filelock is a platform-independent file lock for Python. |
medium | 4.7 | — | Tox-dev / filelock | 2026-10-20 | 2026-10-21 |
| CVE-2026-113144 Memory corruption in Speech in Google Chrome prior to 156.0.8078.47 allowed a re... |
medium | 6.5 | — | Google / chrome | 2026-10-20 | 2026-10-21 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.