October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,479
Critical
1,340
High
5,869
Medium
6,256
Low
648
Severity not reported
3,366
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1307), google (756), oracle (156), ibm (140), adobe (138), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-96558 The Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker plugin for WordPres... |
high | 7.2 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-96572 The WP Meteor Website Speed Optimization Addon plugin for WordPress is vulnerabl... |
high | 7.2 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-96840 The Post Grid Gutenberg Blocks – PostX plugin for WordPress is vulnerable to Sto... |
high | 7.2 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-12626 The Online Scheduling and Appointment Booking System – Bookly plugin for WordPre... |
high | 7.2 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-107742 The 10Web Booster – Website speed optimization, Cache & Page Speed optimizer plu... |
high | 7.2 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-100196 The LazyLoad Plugin – Lazy Load Images, Videos, and Iframes plugin for WordPress... |
high | 7.2 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-100161 The Photo Reviews for WooCommerce plugin for WordPress is vulnerable to Stored D... |
high | 7.2 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-96667 The Real Estate Manager – Property Listing and Agent Management plugin for WordP... |
high | 7.2 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-96682 The Presto Player plugin for WordPress is vulnerable to Stored Cross-Site Script... |
high | 7.2 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-92975 The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress... |
high | 8.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-93775 The Podlove Podcast Publisher plugin for WordPress is vulnerable to Stored Cross... |
high | 7.2 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-94256 The SMS Alert WordPress plugin before 4.0.1 does not verify that the account bei... |
high | 8.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-94257 The SMS Alert WordPress plugin before 4.0.1 does not bind the account whose pass... |
high | 8.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-77183 The FooSales – Point of Sale (POS) for WooCommerce plugin for WordPress is vulne... |
high | 8.8 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-83526 The FV Player 8 plugin for WordPress is vulnerable to Arbitrary File Upload in a... |
high | 8.8 | — | — | 2026-10-10 | 2026-10-28 |
| CVE-2026-87780 The LTL Freight Quotes WordPress plugin before 4.2.19 does not sanitise and esca... |
high | 8.8 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-87781 The LTL Freight Quotes WordPress plugin before 4.2.19 does not sanitise and esca... |
high | 8.6 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-14335 The Easy Digital Downloads – eCommerce Payments and Subscriptions made easy plug... |
high | 7.2 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-104766 The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress... |
high | 8.8 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-104899 The GeoDirectory – WP Business Directory Plugin and Classified Listings Director... |
high | 8.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-104752 The Rank Math SEO WordPress plugin before 1.0.280 does not correctly validate th... |
high | 7.2 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-104723 The LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes plugin for WordP... |
high | 8.8 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-104725 The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress... |
high | 8.8 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-89301 The rtMedia for WordPress, BuddyPress and bbPress plugin for WordPress is vulner... |
high | 7.5 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-104021 The Fastcache by Host.it plugin for WordPress is vulnerable to Code Injection in... |
high | 7.2 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-104797 The Advanced Form Integration — Connect Forms to 300+ Apps plugin for WordPress... |
high | 8.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-92705 Aegisub is a cross-platform advanced subtitle editor. |
high | 7.8 | — | — | 2026-10-09 | 2026-10-16 |
| CVE-2026-57458 Vikunja is an open-source self-hosted task management platform. |
high | 8.1 | — | — | 2026-10-09 | 2026-10-16 |
| CVE-2026-62376 Vikunja is an open-source self-hosted task management platform. |
high | 8.1 | — | — | 2026-10-09 | 2026-10-16 |
| CVE-2026-108259 Tina is a headless content management system. |
high | 8.2 | — | — | 2026-10-09 | 2026-10-16 |
| CVE-2026-108260 Tina is a headless content management system. |
high | 7.6 | — | — | 2026-10-09 | 2026-10-16 |
| CVE-2026-75351 OpENer v2.3/commit 76b95cf, contains an out-of-bounds read in the server-side Et... |
high | 7.5 | — | — | 2026-10-09 | 2026-10-16 |
| CVE-2026-75352 OpENer v2.3/commit 76b95cf, contains an integer underflow in the server-side Eth... |
high | 7.5 | — | — | 2026-10-09 | 2026-10-16 |
| CVE-2026-75353 OpENer v2.3/ commit 76b95cf, contains an out-of-bounds read in the server-side E... |
high | 7.5 | — | — | 2026-10-09 | 2026-10-19 |
| CVE-2026-75350 EIPStackGroup OpENer v2.3 / master commit 76b95cf contains a buffer overflow in... |
high | 7.5 | — | — | 2026-10-09 | 2026-10-16 |
| CVE-2026-107837 RIOT is an open-source microcontroller operating system designed for Internet of... |
high | 8.2 | — | — | 2026-10-09 | 2026-10-16 |
| CVE-2026-107838 RIOT is an open-source microcontroller operating system designed for Internet of... |
high | 7.5 | — | — | 2026-10-09 | 2026-10-16 |
| CVE-2026-107839 ageLANServer provides a cross-platform web server and launcher for offline multi... |
high | 7.5 | — | — | 2026-10-09 | 2026-10-16 |
| CVE-2026-107840 yopass is a service for securely sharing secrets, passwords, and files. |
high | 7.5 | — | — | 2026-10-09 | 2026-10-16 |
| CVE-2026-107823 MariaDB server is a community developed fork of MySQL server. |
high | 7.2 | — | Mariadb / mariadb | 2026-10-09 | 2026-10-14 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.