October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,479
Critical
1,340
High
5,869
Medium
6,256
Low
648
Severity not reported
3,366
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1307), google (756), oracle (156), ibm (140), adobe (138), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-39802 Unauthenticated Remote Code Execution (RCE) in Everest Backup <= 2.3.13 versions... |
high | 8.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-40777 Subscriber Broken Access Control in WPSection <= 1.5.1 versions. |
high | 8.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-40801 Subscriber Broken Access Control in Wordable <= 8.2.10 versions. |
high | 8.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-96341 Incorrect Privilege Assignment vulnerability in WPMU DEV Forminator forminator a... |
high | 8.2 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-57806 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-94160 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-106608 Incorrect Privilege Assignment vulnerability in Automattic WooCommerce woocommer... |
high | 7.2 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-106609 Missing Authorization vulnerability in Web Impian Bayarcash WooCommerce bayarcas... |
high | 7.5 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-62044 Deserialization of Untrusted Data vulnerability in bPlugins Super Video Player s... |
high | 7.2 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-103071 Improper Control of Generation of Code ('Code Injection') vulnerability in Villa... |
high | 7.5 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-108550 SkillHub before 0.2.22 contains an incorrect authorization vulnerability in Acco... |
high | 8.8 | — | — | 2026-10-10 | 2026-10-16 |
| CVE-2026-108553 OpenRefine through 3.10.1 contains a cross-site request forgery vulnerability in... |
high | 7.5 | — | — | 2026-10-10 | 2026-10-18 |
| CVE-2026-108546 Spotweb through 1.5.8 contains an OS command injection vulnerability in the runc... |
high | 7.5 | — | — | 2026-10-10 | 2026-10-16 |
| CVE-2026-108548 AstronRPA through 1.1.6 contains an authentication bypass vulnerability in the O... |
high | 7.3 | — | — | 2026-10-10 | 2026-10-16 |
| CVE-2026-108549 cc-connect through 1.5.0 contains a missing authentication vulnerability in the... |
high | 8.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-94676 Deserialization of Untrusted Data vulnerability in Tainacan Community Tainacan t... |
high | 7.2 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-97263 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-97264 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-105885 Deserialization of Untrusted Data vulnerability in 10Web Slider by 10Web slider-... |
high | 8.8 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-108161 FusionPBX through 5.6.5 contains an OS command injection vulnerability in call_r... |
high | 7.5 | — | — | 2026-10-10 | 2026-10-16 |
| CVE-2026-102388 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-107794 ExtUtils::Typemaps::STL::List versions before 1.07 for Perl allocate a 32 GiB ar... |
high | 7.5 | — | — | 2026-10-10 | 2026-10-16 |
| CVE-2013-10076 ExtUtils::Typemaps::STL::Vector versions before 1.05 for Perl allocate a 32 GiB... |
high | 7.5 | — | — | 2026-10-10 | 2026-10-16 |
| CVE-2026-103636 Out-of-bounds read in the VarOpt union deserialization of Apache DataSketches C+... |
high | 7.5 | — | — | 2026-10-10 | 2026-10-16 |
| CVE-2026-91136 The Divi Plus plugin for WordPress is vulnerable to Arbitrary File Read in versi... |
high | 7.5 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-107657 The HivePress – Business Directory, Listings & Classified Ads Plugin plugin for... |
high | 7.2 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-96662 The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress... |
high | 7.5 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-96765 The WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) plugin... |
high | 7.2 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-93949 Authentication Bypass Using an Alternate Path or Channel vulnerability in Omegat... |
high | 7.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-93950 Missing Authorization vulnerability in StylemixThemes Motors motors allows Explo... |
high | 7.5 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-93951 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-96278 The WP Photo Album Plus plugin for WordPress is vulnerable to Stored Cross-Site... |
high | 7.2 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-104759 The WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) plugin... |
high | 8.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-106606 Deserialization of Untrusted Data vulnerability in YITH YITH WooCommerce Affilia... |
high | 7.2 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-93746 The WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping... |
high | 7.5 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-100178 The WPAdverts – Classifieds Plugin plugin for WordPress is vulnerable to Stored... |
high | 7.2 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-101920 The Molongui Authorship – Author Boxes, Guest Authors & Co-Authors for WordPress... |
high | 7.2 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-100147 The FunnelKit – Funnel Builder for WooCommerce Checkout plugin for WordPress is... |
high | 7.2 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-94538 The WP File Download plugin for WordPress is vulnerable to authorization bypass... |
high | 8.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-95684 The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to... |
high | 7.2 | — | — | 2026-10-10 | 2026-10-13 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.