October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
22,617
Critical
3,170
High
7,236
Medium
7,073
Low
640
Severity not reported
4,498
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (722), google (413), ibm (322), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2023-54409 Frappe before 13.46.1 and 14.x before 14.20.0 contains a cross-site scripting vu... |
medium | 4.8 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-87681 An Access Control Bypass vulnerability exists in the Role-Based Access Control (... |
medium | 6.3 | — | Broadcom / fabric operating system | 2026-10-08 | 2026-10-13 |
| CVE-2026-107294 Pydantic AI is a Python agent framework for building applications and workflows... |
medium | 6.5 | — | Pydantic / pydantic ai | 2026-10-08 | 2026-10-13 |
| CVE-2026-104022 The Academy LMS – AI Course Builder, Quizzes, Certificates & eLearning plugin fo... |
medium | 5.4 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-104915 The Academy LMS – AI Course Builder, Quizzes, Certificates & eLearning plugin fo... |
medium | 6.5 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-93883 The Advanced Classifieds & Directory Pro plugin for WordPress is vulnerable to S... |
medium | 6.4 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-103365 The Bookly – Online Scheduling and Appointment Booking System plugin for WordPre... |
medium | 5.3 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-104898 The Online Scheduling and Appointment Booking System – Bookly plugin for WordPre... |
medium | 6.8 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-96743 The Table Field Add-on for ACF and SCF plugin for WordPress is vulnerable to Sto... |
medium | 6.4 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-102401 The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scr... |
medium | 6.4 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-103424 The Anti-Spam by CleanTalk – Spam Protection Without CAPTCHA plugin for WordPres... |
medium | 5.4 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-103964 The Download Manager plugin for WordPress is vulnerable to Sensitive Information... |
medium | 4.3 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-103998 The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugi... |
medium | 6.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-104724 The FireBox – WooCommerce Popup Builder, Exit Intent Popup, Email Optin & Cart A... |
medium | 5.3 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-104735 The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video... |
medium | 6.4 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-104993 The GeoDirectory – WP Business Directory Plugin and Classified Listings Director... |
medium | 6.4 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-5727 The Hello Plus plugin for WordPress is vulnerable to authorization bypass in all... |
medium | 5.4 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-87869 The Filter Everything — WordPress & WooCommerce Filters plugin for WordPress is... |
medium | 6.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-96648 The Data Tables Generator by Supsystic plugin for WordPress is vulnerable to Sto... |
medium | 6.4 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-97630 The FV Flowplayer Video Player plugin for WordPress is vulnerable to Stored Cros... |
medium | 6.4 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-9696 The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scr... |
medium | 6.4 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-103482 The Simple Newsletter Plugin – Noptin plugin for WordPress is vulnerable to Stor... |
medium | 5.4 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-103520 The HivePress – Business Directory, Listings & Classified Ads Plugin plugin for... |
medium | 6.4 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-103912 The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnera... |
medium | 4.7 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-104023 The Smart Popup by Supsystic plugin for WordPress is vulnerable to generic SQL I... |
medium | 4.9 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-104762 The Kadence Blocks — Page Builder Toolkit for Gutenberg Editor plugin for WordPr... |
medium | 6.4 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-104763 The Post Export Import with Media plugin for WordPress is vulnerable to Director... |
medium | 4.9 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-12054 The Download Manager plugin for WordPress is vulnerable to Reflected Cross-Site... |
medium | 6.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-14379 The GamiPress – Gamification plugin to reward points, achievements, badges & ran... |
medium | 6.4 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-14877 The Data Tables Generator by Supsystic plugin for WordPress is vulnerable to Sto... |
medium | 6.4 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-14882 The Brizy – Page Builder plugin for WordPress is vulnerable to Stored Cross-Site... |
medium | 6.4 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-16776 The MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar plugin for... |
medium | 6.4 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-17025 The Graphene theme for WordPress is vulnerable to Stored Cross-Site Scripting vi... |
medium | 6.4 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-18496 The Booking Calendar plugin for WordPress is vulnerable to Sensitive Information... |
medium | 5.3 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-18558 The Embed Any Document – Embed PDF, Word, PowerPoint and Excel Files plugin for... |
medium | 6.4 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-78068 The Table Field Add-on for ACF and SCF plugin for WordPress is vulnerable to Sto... |
medium | 6.4 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-91862 The Getwid – Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross... |
medium | 6.4 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-94421 The Church Admin plugin for WordPress is vulnerable to Stored Cross-Site Scripti... |
medium | 6.4 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-97643 The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vu... |
medium | 6.4 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-103427 The Simple Membership plugin for WordPress is vulnerable to Stored Cross-Site Sc... |
medium | 6.4 | — | — | 2026-10-10 | 2026-10-13 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.