October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,479
Critical
1,340
High
5,869
Medium
6,256
Low
648
Severity not reported
3,366
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1307), google (756), oracle (156), ibm (140), adobe (138), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-108865 AmoyLab Unla through 0.10.0 contains an authentication bypass vulnerability that... |
high | 8.2 | — | — | 2026-10-11 | 2026-10-16 |
| CVE-2026-108859 mcp-go through 1.2.1 contains a denial of service vulnerability in StreamableHTT... |
high | 7.5 | — | — | 2026-10-11 | 2026-10-18 |
| CVE-2026-108853 UnicomAI Wanwu before 0.6.3 contains an insecure direct object reference vulnera... |
high | 8.1 | — | — | 2026-10-11 | 2026-10-16 |
| CVE-2026-108758 Easy!Appointments through 1.6.0 contains an authorization bypass vulnerability i... |
high | 8.2 | — | — | 2026-10-11 | 2026-10-16 |
| CVE-2026-108760 LlamaFarm through 0.0.34 contains an insecure default configuration that binds i... |
high | 7.6 | — | — | 2026-10-11 | 2026-10-16 |
| CVE-2026-108746 Vearch 3.5.2 through 3.5.9 contains an incorrect authorization vulnerability in... |
high | 8.8 | — | — | 2026-10-11 | 2026-10-16 |
| CVE-2026-108739 OpenAgents Workspace backend through launcher-v1.0.17 contains an information di... |
high | 7.5 | — | — | 2026-10-11 | 2026-10-16 |
| CVE-2026-108740 GoatCounter through 2.7.0 contains a mass assignment privilege escalation vulner... |
high | 8.3 | — | — | 2026-10-11 | 2026-10-16 |
| CVE-2026-108744 pbi-cli 3.10.1 through 3.12.0 contains an OS command injection vulnerability in... |
high | 7.0 | — | — | 2026-10-11 | 2026-10-18 |
| CVE-2026-108718 Rill 0.77.0 through 0.90.5 contains a missing authorization vulnerability in the... |
high | 8.1 | — | — | 2026-10-11 | 2026-10-18 |
| CVE-2026-108714 MCP Kotlin SDK through 0.15.0 contains an uncontrolled memory allocation vulnera... |
high | 7.5 | — | — | 2026-10-11 | 2026-10-16 |
| CVE-2026-108571 A weakness has been identified in Xinhu Rainrock RockOA up to 2.7.6. |
high | 7.3 | — | — | 2026-10-11 | 2026-10-15 |
| CVE-2026-91829 The Subscribe to Comments WordPress plugin before 2.3.3 does not properly valida... |
high | 7.1 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-96227 The Piotnet Forms WordPress plugin through 1.0.30 does not authenticate or valid... |
high | 8.8 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-89232 The Recordbrowser WordPress plugin through 1.1.7 does not sanitise and escape a... |
high | 8.6 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-89234 The WP-Partner WordPress plugin through 1.2.1 does not sanitise and escape a par... |
high | 8.6 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-89283 The WP Posts Password Batch Manager WordPress plugin through 1.1 does not perfor... |
high | 8.6 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-89285 The Datalist it WordPress plugin through 0.0.3 does not sanitize and escape seve... |
high | 8.6 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-89287 The ASPL Product Quotation WordPress plugin through 1.1.0 does not sanitize and... |
high | 8.6 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-89297 The Loja Automática WordPress plugin through 1.0.0 does not properly sanitize an... |
high | 8.6 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-89299 The WP Verify API WordPress plugin through 1.0.0 does not properly sanitize and... |
high | 8.6 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-89302 The Post Voting System WordPress plugin through 1.0 does not properly sanitize a... |
high | 8.6 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-88826 The SmugMug Embed WordPress plugin through 3.13 does not have authorisation or C... |
high | 8.8 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-88827 The Disable Users WordPress plugin through 1.0.5 does not enforce its account-di... |
high | 8.8 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-88903 The Topcontent WordPress plugin through 1.2.1 does not properly authorise one of... |
high | 8.8 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-88905 The KeyWord Collector WordPress plugin through 1.4 does not have any authorisati... |
high | 8.8 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-88930 The Social Web Suite WordPress plugin through 4.1.12 does not require its shared... |
high | 8.6 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-89195 The Site Setup Wizard WordPress plugin through 1.5.8 does not properly sanitise... |
high | 8.6 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-89213 The Llavero.io WordPress plugin through 0.1.4 does not properly sanitise and esc... |
high | 8.6 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-89214 The WpCues Basic Quiz WordPress plugin through 1.6.5 does not properly sanitise... |
high | 8.6 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-85126 The Crowdfundly WordPress plugin through 2.2.2 does not have capability checks o... |
high | 7.2 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-86798 The HootBoard WordPress plugin through 3.1.4 does not perform any authorisation... |
high | 8.8 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-87760 The Web Vitals Tracking WordPress plugin through 5.4.2 does not validate or esca... |
high | 8.8 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-87761 The Adwised Web Push Notification WordPress plugin through 2.5.7 does not perfor... |
high | 8.0 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-87762 The Adwised Web Push Notification WordPress plugin through 2.5.7 does not have a... |
high | 8.8 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-87764 The BuddyPress Instant Chat WordPress plugin through 1.6 does not check that the... |
high | 8.8 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-84258 The click5 CRM add-on to Ninja Forms WordPress plugin through 1.0.1 does not san... |
high | 8.8 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-84259 The click5 CRM add-on to WPForms WordPress plugin through 1.0.3 does not sanitis... |
high | 8.8 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-84260 The click5 CRM add-on to Gravity Forms WordPress plugin through 1.0.3 does not s... |
high | 8.8 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-84261 The click5 CRM add-on to Contact Form 7 WordPress plugin through 1.0.4 does not... |
high | 8.8 | — | — | 2026-10-11 | 2026-10-13 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.