October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,479
Critical
1,340
High
5,869
Medium
6,256
Low
648
Severity not reported
3,366
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1307), google (756), oracle (156), ibm (140), adobe (138), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-14854 The WooCommerce Bookings WordPress plugin before 3.11.0 does not limit a user-su... |
high | 7.5 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-81420 The Tcard WP WordPress plugin through 1.8.0 does not sanitise and escape a param... |
high | 8.6 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-103694 The Mobile builder WordPress plugin through 1.4.2 does not properly restrict whi... |
high | 8.8 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-103695 The Mobile builder WordPress plugin through 1.4.2 does not sanitise and escape a... |
high | 8.6 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-104680 The Envira Gallery WordPress plugin before 1.16.2 does not verify that a user ho... |
high | 7.2 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-106029 The WeddingCity Lite WordPress plugin through 1.0.4 does not perform any authori... |
high | 7.5 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-103305 The Prenotazioni WordPress plugin through 1.7.5 does not have authorisation and... |
high | 8.8 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-108522 A vulnerability was found in Studio-Saelix Sencho up to 0.94.1. |
high | 8.3 | — | — | 2026-10-11 | 2026-10-14 |
| CVE-2026-108708 Wukong_HRM through commit 186115e contains a missing authorization vulnerability... |
high | 8.8 | — | — | 2026-10-11 | 2026-10-16 |
| CVE-2026-108693 ImageMagick on Windows through 7.1.2-33 and 6.9.13-58 contains an uncontrolled s... |
high | 7.0 | — | — | 2026-10-11 | 2026-10-15 |
| CVE-2026-108695 MultiVendorX WordPress plugin through 5.0.19 contains an incorrect authorization... |
high | 7.1 | — | — | 2026-10-11 | 2026-10-16 |
| CVE-2026-108657 JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the Sy... |
high | 8.1 | — | — | 2026-10-10 | 2026-10-18 |
| CVE-2026-108628 JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the sa... |
high | 8.1 | — | — | 2026-10-10 | 2026-10-14 |
| CVE-2026-108623 JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the Sy... |
high | 7.1 | — | — | 2026-10-10 | 2026-10-14 |
| CVE-2026-78534 Unauthenticated Cross Site Scripting (XSS) in Educavo <= 3.4.2 versions. |
high | 7.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-66566 Unauthenticated Local File Inclusion in Ambient <= 1.7 versions. |
high | 8.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-78530 Subscriber Arbitrary File Deletion in FoodBakery <= 4.6 versions. |
high | 7.7 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-78532 Unauthenticated Cross Site Scripting (XSS) in LMS <= 8.3 versions. |
high | 7.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-65459 Unauthenticated Arbitrary Content Deletion in Forminator <= 1.57.3 versions. |
high | 7.5 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-62117 Subscriber SQL Injection in Barcode Scanner with Inventory & Order Manager <= 1.... |
high | 8.5 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-62118 Unauthenticated Broken Access Control in Barcode Scanner with Inventory & Order... |
high | 7.3 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-62130 Shop manager PHP Object Injection in WooCommerce Multilingual & Multicurrency <=... |
high | 7.2 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-62094 Unauthenticated Local File Inclusion in TechOne <= 3.0.3 versions. |
high | 8.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-62095 Unauthenticated Cross Site Scripting (XSS) in Biolife <= 3.2.3 versions. |
high | 7.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-62096 Unauthenticated Local File Inclusion in Biolife <= 3.2.3 versions. |
high | 8.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-62099 Unauthenticated Local File Inclusion in Boutique <= 2.3.3 versions. |
high | 8.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-62100 Unauthenticated Cross Site Scripting (XSS) in KuteShop <= 4.2.9 versions. |
high | 7.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-62115 Unauthenticated Local File Inclusion in KuteShop <= 4.2.9 versions. |
high | 8.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-62116 Unauthenticated Cross Site Scripting (XSS) in Barcode Scanner with Inventory & O... |
high | 7.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-62082 Unauthenticated Cross Site Scripting (XSS) in Pin WP <= 7.0 versions. |
high | 7.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-62091 Unauthenticated Cross Site Scripting (XSS) in Armania <= 1.4.8 versions. |
high | 7.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-62092 Unauthenticated Local File Inclusion in Armania <= 1.4.8 versions. |
high | 8.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-62093 Unauthenticated Cross Site Scripting (XSS) in TechOne <= 3.0.3 versions. |
high | 7.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-62065 Unauthenticated Local File Inclusion in Cardea <= 2.3 versions. |
high | 8.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-62066 Unauthenticated Local File Inclusion in Volos <= 1.2 versions. |
high | 8.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-62067 Unauthenticated Local File Inclusion in Kaven <= 1.2 versions. |
high | 8.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-62068 Unauthenticated Local File Inclusion in Teoro <= 1.1 versions. |
high | 8.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-62069 Unauthenticated Local File Inclusion in Fabius <= 1.0 versions. |
high | 8.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-62070 Unauthenticated Local File Inclusion in Flipmart <= 2.8 versions. |
high | 8.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-62074 Unauthenticated Local File Inclusion in Ozeum <= 1.3.0 versions. |
high | 8.1 | — | — | 2026-10-10 | 2026-10-13 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.