October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
22,620
Critical
3,170
High
7,238
Medium
7,074
Low
640
Severity not reported
4,498
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (722), google (413), ibm (322), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-102402 The Team – Team Members Showcase Plugin plugin for WordPress is vulnerable to St... |
medium | 6.4 | — | — | 2026-10-10 | 2026-10-14 |
| CVE-2026-93347 Wazuh from 4.1.1 before 4.14.8 contains a path traversal vulnerability in the ge... |
medium | 4.9 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-104644 The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.15 does not... |
medium | 6.8 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-104751 The Rank Math SEO WordPress plugin before 1.0.280 does not perform a capability... |
medium | 5.3 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-105261 The Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change St... |
medium | 6.8 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-105969 The CodeAtoZ B2B Suite for WooCommerce WordPress plugin before 1.6.1 does not pr... |
medium | 5.3 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-105975 The CamPay Shortcode Payment Gateway WordPress plugin before 1.7 does not verify... |
medium | 5.3 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-106098 The WP Data Access WordPress plugin before 5.5.77 does not correctly check autho... |
medium | 5.3 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-106099 The WP Data Access WordPress plugin before 5.5.84 does not restrict its database... |
medium | 5.3 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-106166 The NEX-Forms WordPress plugin before 9.3.1 does not perform any authorization,... |
medium | 5.3 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-106646 The Classified Listing WordPress plugin before 6.1.1 does not verify that the re... |
medium | 5.9 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-107158 The LTL Freight Quotes WordPress plugin before 4.2.19 does not perform any autho... |
medium | 5.3 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-107160 The LTL Freight Quotes WordPress plugin before 4.2.19 does not perform any autho... |
medium | 5.3 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-107178 The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.16 does not... |
medium | 6.8 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-107319 The GamiPress WordPress plugin before 8.0.6 does not perform a capability check... |
medium | 4.3 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-107320 The GamiPress WordPress plugin before 8.0.6 does not properly authorize access t... |
medium | 5.3 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-108064 The WP Encryption WordPress plugin before 7.8.8.2 does not perform a capability... |
medium | 6.5 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-108069 The Sunshine Photo Cart WordPress plugin before 3.7.4 does not check whether a v... |
medium | 5.3 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-85000 The EmbedPress WordPress plugin before 4.6.8 does not perform any capability or... |
medium | 5.3 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-85345 The FV Flowplayer Video Player WordPress plugin before 7.5.55.7212 does not prop... |
medium | 4.1 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-86797 The Pricing Table WordPress plugin before 2.1.5 does not validate the scheme of... |
medium | 6.8 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-87843 The Trust Payments Gateway for WooCommerce WordPress plugin before 3.1.0 does no... |
medium | 6.5 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-87968 The Product Feed for Google Shopping, Microsoft Advertising and 40+ Channels for... |
medium | 5.3 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-87974 The Asaas Gateway for WooCommerce WordPress plugin before 2.7.8 does not properl... |
medium | 5.3 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-88927 The rtMedia for WordPress, BuddyPress and bbPress WordPress plugin before 4.7.14... |
medium | 4.3 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-94260 The Sifalo Pay WordPress plugin before 2.5.3 does not verify ownership of, or au... |
medium | 5.3 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-94261 The Sifalo Pay WordPress plugin before 2.5.3 does not verify that a payment tran... |
medium | 5.3 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-94360 The Paymentfor Gateway for WooCommerce WordPress plugin before 1.0.6 does not ve... |
medium | 5.3 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-96900 The Cart Abandonment Recovery for WooCommerce WordPress plugin before 2.1.4 does... |
medium | 5.3 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-96904 The AWP Classifieds WordPress plugin before 4.4.9 does not verify that a request... |
medium | 5.3 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-101301 The WPCode WordPress plugin before 2.4.0 does not correctly verify that a reques... |
medium | 5.3 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-103308 The Visma Pay for WooCommerce WordPress plugin before 1.2.2 does not verify the... |
medium | 6.5 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-82844 The WPForms Lite WordPress plugin before 2.0.2.2 does not verify server-side tha... |
medium | 5.3 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-88998 The Tickera WordPress plugin before 3.6.0.4 does not correctly verify the integr... |
medium | 5.3 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-97315 The Responsive Blocks WordPress plugin before 2.3.0 does not sanitise or escape... |
medium | 5.4 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-106034 A Path Traversal vulnerability in Ivanti Xtraction before version 2026.4 allows... |
medium | 5.0 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-106035 An Information Exposure Through Log Files vulnerability in Ivanti Xtraction Clou... |
medium | 5.5 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-14909 IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.9 is affected... |
medium | 6.5 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-73794 HPE NonStop MODULAR NSJ contains a predictable seed vulnerability in Random Numb... |
medium | 4.6 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-73795 A security vulnerability in HPE NonStop TMF Auditread2 can cause Denial of Servi... |
medium | 6.4 | — | — | 2026-10-14 | 2026-10-14 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.