October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
22,617
Critical
3,170
High
7,236
Medium
7,073
Low
640
Severity not reported
4,498
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (722), google (413), ibm (322), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-103897 The Responsive Lightbox & Gallery plugin for WordPress is vulnerable to Stored C... |
medium | 4.4 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-15178 The Fluent Forms plugin for WordPress is vulnerable to authorization bypass in a... |
medium | 5.4 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-3717 The CV Builder – Professional Resume Builder SaaS plugin for WordPress is vulner... |
medium | 5.3 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-5725 The Favicon Rotator plugin for WordPress is vulnerable to Reflected Cross-Site S... |
medium | 6.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-6243 The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Stored Cr... |
medium | 6.4 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-89100 The Payment Plugins for Stripe WooCommerce plugin for WordPress is vulnerable to... |
medium | 6.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-96574 The User Frontend – Membership, User Registration, User Profile, User Directory... |
medium | 6.4 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-101921 The WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Surv... |
medium | 4.7 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-102291 The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordP... |
medium | 5.4 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-102774 The SureDash – Community, Courses & Member Dashboard plugin for WordPress is vul... |
medium | 6.4 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-103478 The Premium Packages – Sell Digital Products Securely plugin for WordPress is vu... |
medium | 6.4 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-104728 The AutomatorWP – No-Code Workflow Automation, Integration & Webhooks Plugin, no... |
medium | 4.3 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-97340 The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is v... |
medium | 6.4 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-97396 The Email Marketing for WordPress and WooCommerce – Retainful plugin for WordPre... |
medium | 6.4 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-104722 The Listdom: AI-powered Business Directory with Classifieds Ads Listings plugin... |
medium | 4.9 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-4791 The PeproDev Ultimate Profile Solutions plugin for WordPress is vulnerable to St... |
medium | 6.4 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-101324 The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Fo... |
medium | 4.7 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-6723 The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin p... |
medium | 5.3 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-91050 The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress... |
medium | 4.3 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-94375 The Order Export & Order Import for WooCommerce plugin for WordPress is vulnerab... |
medium | 5.3 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-107712 The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to t... |
medium | 6.5 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-97348 The SiteOrigin Widgets Bundle plugin for WordPress is vulnerable to Directory Tr... |
medium | 6.5 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-108523 A vulnerability was determined in Studio-Saelix Sencho up to 0.94.1. |
medium | 4.3 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-108541 A vulnerability has been found in highwarden Super Store Finder up to 3.8. |
medium | 6.3 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-108570 A security flaw has been discovered in Furion .NET Framework up to 4.9.9.95. |
medium | 6.3 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-108574 A flaw has been found in BerriAI LiteLLM up to 1.95.0. |
medium | 4.3 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-109152 A security vulnerability has been detected in jbardin scp.py up to 0.16.1. |
medium | 5.4 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-109189 A vulnerability was detected in fit2cloud MeterSphere up to 3.6.9-lts. |
medium | 6.3 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-109404 A vulnerability was identified in conductor-oss conductor up to 3.33.0-rc10. |
medium | 5.3 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-66435 Insertion of Sensitive Information Into Sent Data vulnerability in Devin Walker... |
medium | 5.9 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-94590 Improper Verification of Source of a Communication Channel vulnerability in Code... |
medium | 6.5 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-103685 Missing Authorization vulnerability in VillaTheme ALD – Dropshipping and Fulfill... |
medium | 4.3 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-107420 Unauthenticated Bypass Vulnerability in Pay With MetaMask For WooCommerce – Cryp... |
medium | 5.3 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-107434 Subscriber Bypass Vulnerability in MicroPayments <= 3.2.9 versions. |
medium | 5.4 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-40808 Subscriber Broken Access Control in Jetpack VideoPress <= 3.6 versions. |
medium | 6.5 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-42419 Unauthenticated Sensitive Data Exposure in Swish Migrate and Backup <= 1.4.0 ver... |
medium | 5.9 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-62035 Subscriber Broken Access Control in AWS S3 for WordPress Plugin – Upcasted <= 3.... |
medium | 6.3 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-62098 Unauthenticated Content Injection in Boutique <= 2.3.3 versions. |
medium | 6.5 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-66480 Exposure of Sensitive System Information to an Unauthorized Control Sphere vulne... |
medium | 5.3 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-66481 Author Arbitrary File Deletion in Presto Player Pro <= 3.0.1 versions. |
medium | 6.8 | — | — | 2026-10-10 | 2026-10-13 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.