October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,479
Critical
1,340
High
5,869
Medium
6,256
Low
648
Severity not reported
3,366
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1307), google (756), oracle (156), ibm (140), adobe (138), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-62075 Unauthenticated Local File Inclusion in Backhoe <= 2.0 versions. |
high | 8.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-62038 Unauthenticated Broken Authentication in eRoom <= 1.7.1 versions. |
high | 7.3 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-62043 Unauthenticated Sensitive Data Exposure in Contact Form 7 – Dynamic Text Extensi... |
high | 7.5 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-62064 Unauthenticated Cross Site Scripting (XSS) in Ambed <= 1.0.0 versions. |
high | 7.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-62030 Unauthenticated Server Side Request Forgery (SSRF) in StreamCast <= 2.4.5 versio... |
high | 7.2 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-62033 Subscriber Settings Change in uListing <= 2.2.0 versions. |
high | 7.6 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-62034 Unauthenticated Cross Site Scripting (XSS) in Before After Image Comparison – Im... |
high | 7.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-62037 Unauthenticated Cross Site Scripting (XSS) in Document Embedder <= 2.4.0 version... |
high | 7.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-48194 Unauthenticated Local File Inclusion in DukaMarket <= 1.3.0 versions. |
high | 8.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-57742 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-62020 Unauthenticated Local File Inclusion in TouchUp < 1.4 versions. |
high | 8.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-62021 Subscriber PHP Object Injection in Angio <= 1.1.1 versions. |
high | 8.8 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-62027 Unauthenticated Cross Site Scripting (XSS) in Team Section Block <= 2.0.4 versio... |
high | 7.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-42722 Administrator SQL Injection in Frontend Admin by DynamiApps <= 3.29.13 versions. |
high | 7.6 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-42724 Unauthenticated Local File Inclusion in CleanSkin <= 1.5.0 versions. |
high | 8.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-42777 Unauthenticated Local File Inclusion in Aalto <= 1.8 versions. |
high | 8.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-45440 Administrator SQL Injection in WP Ultimate CSV Importer <= 9.2 versions. |
high | 7.6 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-48193 Unauthenticated Local File Inclusion in Uminex <= 1.0.9 versions. |
high | 8.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-42706 Unauthenticated Broken Access Control in DK <= 3.2.1 versions. |
high | 7.5 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-42709 Unauthenticated Cross Site Scripting (XSS) in Food Menu – Restaurant Menu & Onli... |
high | 7.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-42711 Unauthenticated Cross Site Scripting (XSS) in Slider by 10Web <= 1.2.63 versions... |
high | 7.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-42712 Subscriber SQL Injection in Qode Tours <= 3.1.3.2 versions. |
high | 8.5 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-42715 Unauthenticated Cross Site Scripting (XSS) in Photo Gallery by 10Web <= 1.8.47 v... |
high | 7.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-42717 Administrator SQL Injection in Leyka <= 3.32.3 versions. |
high | 7.6 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-42633 Subscriber SQL Injection in Events Manager <= 7.4.6 versions. |
high | 8.5 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-42693 Unauthenticated Cross Site Scripting (XSS) in Jannah <= 7.6.5 versions. |
high | 7.1 | — | — | 2026-10-10 | 2026-10-29 |
| CVE-2026-42697 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-42699 Unauthenticated Cross Site Scripting (XSS) in FV Player 8 <= 8.1.8 versions. |
high | 7.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-42702 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-42704 Unauthenticated Local File Inclusion in Kids Care <= 3.2.4 versions. |
high | 8.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-42705 Unauthenticated Broken Access Control in Grand News <= 3.4 versions. |
high | 7.5 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-40802 Subscriber Settings Change in Pubjet | پابجت <= 5.4.8 versions. |
high | 7.6 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-40803 Unauthenticated Cross Site Scripting (XSS) in Jotform – AI Chatbot <= 3.8.2 vers... |
high | 7.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-40805 Subscriber Arbitrary File Deletion in PeepSo <= 9.0.5.4 versions. |
high | 7.7 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-42630 Unauthenticated Sensitive Data Exposure in Web Plura Backup & Restore Manager <=... |
high | 7.5 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-42631 Unauthenticated Cross Site Scripting (XSS) in Qode Music <= 2.1.8.2 versions. |
high | 7.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-42632 Unauthenticated Cross Site Scripting (XSS) in Qode Real Estate <= 1.1.7.3 versio... |
high | 7.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-27350 Server-Side Request Forgery (SSRF) vulnerability in Builderius.io Builderius all... |
high | 7.2 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-39799 Unauthenticated Cross Site Scripting (XSS) in WP File Download <= 6.3.6 versions... |
high | 7.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-39800 Unauthenticated Cross Site Scripting (XSS) in Additional Order Filters for WooCo... |
high | 7.1 | — | — | 2026-10-10 | 2026-10-13 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.