October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,479
Critical
1,340
High
5,869
Medium
6,256
Low
648
Severity not reported
3,366
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1307), google (756), oracle (156), ibm (140), adobe (138), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-39780 Unauthenticated Cross Site Scripting (XSS) in Youzify <= 1.3.7 versions. |
high | 7.1 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-39781 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-06 | 2026-10-15 |
| CVE-2026-39784 Unauthenticated Cross Site Scripting (XSS) in Hotel Booking <= 3.8 versions. |
high | 7.1 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-39769 Authentication Bypass Using an Alternate Path or Channel vulnerability in Iqonic... |
high | 7.5 | — | — | 2026-10-06 | 2026-10-23 |
| CVE-2026-39771 Subscriber SQL Injection in Buddyboss Platform <= 3.1.0 versions. |
high | 8.5 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-39765 Shop Manager Privilege Escalation in Challan <= 3.7.88 versions. |
high | 7.2 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-39766 Unauthenticated Cross Site Scripting (XSS) in ARForms <= 7.1.2 versions. |
high | 7.1 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-39758 Unauthenticated Cross Site Scripting (XSS) in Midtrans-WooCommerce <= 2.32.3 ver... |
high | 7.1 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-39747 Subscriber SQL Injection in Woffice <= 5.4.35 versions. |
high | 8.5 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-39748 Unauthenticated Cross Site Scripting (XSS) in EduMall <= 4.5.3 versions. |
high | 7.1 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-39750 Unauthenticated Cross Site Scripting (XSS) in StoreGrowth: Smart Sales Booster f... |
high | 7.1 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-39751 Unauthenticated Broken Access Control in PayPlug for WooCommerce (Official) <= 3... |
high | 7.5 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-39752 Contributor Arbitrary File Deletion in Jobs for WordPress <= 2.8.2 versions. |
high | 7.7 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-39728 Unauthenticated Server Side Request Forgery (SSRF) in Instapage Plugin <= 3.7.2... |
high | 7.2 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-39729 Unauthenticated Sensitive Data Exposure in Edwiser Bridge <= 4.3.4 versions. |
high | 7.2 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-39730 Missing Authorization vulnerability in Marcin Wise Chat wise-chat allows Exploit... |
high | 7.1 | — | — | 2026-10-06 | 2026-10-07 |
| CVE-2026-39731 Unauthenticated Cross Site Scripting (XSS) in Database for CF7 <= 1.2.6 versions... |
high | 7.1 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-39745 Unauthenticated Cross Site Scripting (XSS) in Contact Form to DB by BestWebSoft... |
high | 7.1 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-39719 Unauthenticated Server Side Request Forgery (SSRF) in PDF Smart Viewer for Eleme... |
high | 7.2 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-39720 Unauthenticated Cross Site Scripting (XSS) in Mapster WP Maps <= 2.0.4 versions. |
high | 7.1 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-39722 Unauthenticated Cross Site Scripting (XSS) in WPLMS <= 4.972 versions. |
high | 7.1 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-39724 Unauthenticated Cross Site Scripting (XSS) in HTTP Requests Manager <= 1.3.11 ve... |
high | 7.1 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-39726 Unauthenticated Cross Site Scripting (XSS) in Lumise Product Designer <= 2.1.1 v... |
high | 7.1 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-32574 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-06 | 2026-10-13 |
| CVE-2026-32575 Unauthenticated Cross Site Scripting (XSS) in SUMO Affiliates Pro <= 11.7.0 vers... |
high | 7.1 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-32577 Unauthenticated Cross Site Scripting (XSS) in Frontend File Manager <= 23.6 vers... |
high | 7.1 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-32578 Subscriber Broken Access Control in ECPay Ecommerce for WooCommerce <= 1.1.26060... |
high | 7.1 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-32580 Unauthenticated SQL Injection in WooCommerce Lottery <= 2.2.9 versions. |
high | 7.5 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-32581 Subscriber SQL Injection in Mooberry Book Manager 4.16.2 versions. |
high | 7.1 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-32569 Unauthenticated Cross Site Scripting (XSS) in WP Media folder <= 6.2.2 versions. |
high | 7.1 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-32570 Unauthenticated Cross Site Scripting (XSS) in Progressify - Progressive Web App... |
high | 7.1 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-32572 Unauthenticated Cross Site Scripting (XSS) in WP User Frontend Pro <= 4.2.13 ver... |
high | 7.1 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-105317 Subscriber SQL Injection in Paid Member Subscriptions <= 3.1.1 versions. |
high | 8.5 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-25433 Subscriber Broken Access Control in WP2LEADS <= 3.5.7 versions. |
high | 7.1 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-25434 Subscriber SQL Injection in WP2LEADS <= 3.5.7 versions. |
high | 8.5 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-105058 Subscriber Privilege Escalation in WP User Profiles <= 2.7.3 versions. |
high | 8.8 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-105061 Unauthenticated Cross Site Scripting (XSS) in WP Mailster <= 1.9.0.0 versions. |
high | 7.1 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-105070 Unauthenticated Privilege Escalation in Salon booking system <= 10.31.7 versions... |
high | 8.8 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-105071 Unauthenticated Sensitive Data Exposure in SiteVault – Backup, Restore, Migratio... |
high | 7.5 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-104405 Unauthenticated Privilege Escalation in GiveWP <= 4.17.0 versions. |
high | 8.1 | — | — | 2026-10-06 | 2026-10-06 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.