October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,479
Critical
1,340
High
5,869
Medium
6,256
Low
648
Severity not reported
3,366
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1307), google (756), oracle (156), ibm (140), adobe (138), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-105133 Ahsay AhsayCBS Improper Authentication Vulnerability |
high | 7.3 | Listed | Ahsay / AhsayCBS | 2026-10-04 | 2026-10-26 |
| CVE-2026-88779 Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memor... |
high | 7.5 | Listed | Citrix / NetScaler | 2026-10-04 | 2026-10-05 |
| CVE-2026-105126 LaraDashboard before 1.4.8 contains an improper privilege management vulnerabili... |
high | 7.2 | — | — | 2026-10-04 | 2026-10-05 |
| CVE-2026-105123 W (vincent-peugnet/wcms) through 3.18.0 contains a remote code execution vulnera... |
high | 8.8 | — | — | 2026-10-04 | 2026-10-06 |
| CVE-2026-96451 Authorization Bypass Through User-Controlled Key vulnerability in Ultimate Membe... |
high | 8.8 | — | — | 2026-10-03 | 2026-10-06 |
| CVE-2026-103342 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-03 | 2026-10-06 |
| CVE-2026-103065 Improper Validation of Specified Quantity in Input vulnerability in Themeum Kirk... |
high | 8.2 | — | — | 2026-10-03 | 2026-10-06 |
| CVE-2026-105115 OpenAM before 16.1.3 contains an unauthenticated arbitrary class instantiation v... |
high | 8.6 | — | — | 2026-10-03 | 2026-10-06 |
| CVE-2026-94505 The Nelio Content – Editorial Calendar & Social Media Auto-Posting plugin for Wo... |
high | 8.1 | — | — | 2026-10-03 | 2026-10-06 |
| CVE-2026-96267 The WP Visitor Statistics (Real Time Traffic) plugin for WordPress is vulnerable... |
high | 7.5 | — | — | 2026-10-03 | 2026-10-06 |
| CVE-2026-97660 The WPC Product Options for WooCommerce plugin for WordPress is vulnerable to St... |
high | 7.2 | — | — | 2026-10-03 | 2026-10-06 |
| CVE-2026-75028 The WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System plugin... |
high | 7.5 | — | — | 2026-10-03 | 2026-10-06 |
| CVE-2026-93889 The Mail logging – WP Mail Catcher plugin for WordPress is vulnerable to Stored... |
high | 7.2 | — | — | 2026-10-03 | 2026-10-06 |
| CVE-2026-18443 The Smart Manager – Advanced WooCommerce Bulk Edit & Inventory Management plugin... |
high | 8.8 | — | — | 2026-10-03 | 2026-10-06 |
| CVE-2026-97341 The Visitor Traffic Real Time Statistics plugin for WordPress is vulnerable to S... |
high | 7.2 | — | — | 2026-10-03 | 2026-10-06 |
| CVE-2026-96650 The Strong Testimonials plugin for WordPress is vulnerable to Stored Cross-Site... |
high | 7.2 | — | — | 2026-10-03 | 2026-10-06 |
| CVE-2026-97337 The Simple Membership plugin for WordPress is vulnerable to unauthorized modific... |
high | 7.5 | — | — | 2026-10-03 | 2026-10-06 |
| CVE-2026-96564 The SEOPress – AI SEO Plugin & On-site SEO plugin for WordPress is vulnerable to... |
high | 7.2 | — | — | 2026-10-03 | 2026-10-06 |
| CVE-2026-96575 The Transliterator – Multilingual and Multi-script Text Conversion plugin for Wo... |
high | 7.2 | — | — | 2026-10-03 | 2026-10-06 |
| CVE-2026-93430 The GD Rating System plugin for WordPress is vulnerable to Stored Cross-Site Scr... |
high | 7.2 | — | — | 2026-10-03 | 2026-10-06 |
| CVE-2026-88783 The Kubio AI Page Builder WordPress plugin before 2.9.3 does not limit its widen... |
high | 8.8 | — | — | 2026-10-03 | 2026-10-06 |
| CVE-2026-89236 The SaveTo Wishlist Lite WordPress plugin before 1.1.5 does not sanitise and esc... |
high | 8.6 | — | — | 2026-10-03 | 2026-10-06 |
| CVE-2026-91078 The TillKit WordPress plugin before 1.0.5 does not require the hard-coded, publi... |
high | 8.2 | — | — | 2026-10-03 | 2026-10-06 |
| CVE-2026-87091 The Welcart e-Commerce plugin for WordPress is vulnerable to Stored Cross-Site S... |
high | 7.2 | — | — | 2026-10-03 | 2026-10-06 |
| CVE-2026-103913 The GeoDirectory plugin for WordPress is vulnerable to SQL Injection via the sto... |
high | 7.5 | — | — | 2026-10-03 | 2026-10-06 |
| CVE-2026-101928 The Magic Tooltips For Contact Form 7 plugin for WordPress is vulnerable to Stor... |
high | 7.2 | — | — | 2026-10-03 | 2026-10-06 |
| CVE-2026-103514 The WP 2FA WordPress plugin before 4.1.0 does not invalidate a time-based one-ti... |
high | 7.5 | — | — | 2026-10-03 | 2026-10-06 |
| CVE-2026-101923 The Photo Reviews for WooCommerce plugin for WordPress is vulnerable to Arbitrar... |
high | 8.1 | — | — | 2026-10-03 | 2026-10-06 |
| CVE-2026-101159 The WP Ultimate Review WordPress plugin before 2.4.4 does not properly sanitise... |
high | 7.5 | — | — | 2026-10-03 | 2026-10-06 |
| CVE-2026-101160 The WP Ultimate Review WordPress plugin before 2.4.4 does not validate that a su... |
high | 7.5 | — | — | 2026-10-03 | 2026-10-06 |
| CVE-2026-101161 The WP Ultimate Review WordPress plugin before 2.4.4 does not prevent unauthenti... |
high | 7.5 | — | — | 2026-10-03 | 2026-10-06 |
| CVE-2026-92977 The Real Cookie Banner: GDPR & ePrivacy Cookie Consent plugin for WordPress is v... |
high | 7.2 | — | — | 2026-10-03 | 2026-10-06 |
| CVE-2026-97644 The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress... |
high | 8.8 | — | — | 2026-10-03 | 2026-10-06 |
| CVE-2026-92536 The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User... |
high | 8.8 | — | — | 2026-10-03 | 2026-10-06 |
| CVE-2026-93428 The Ultimate Member – User Profile, Registration, Login, Member Directory, Conte... |
high | 7.5 | — | — | 2026-10-03 | 2026-10-06 |
| CVE-2026-96270 The Ultimate Member – User Profile, Registration, Login, Member Directory, Conte... |
high | 7.2 | — | — | 2026-10-03 | 2026-10-06 |
| CVE-2026-104478 Formwork before 2.3.13 contains a path traversal vulnerability in BackupControll... |
high | 7.1 | — | — | 2026-10-03 | 2026-10-05 |
| CVE-2026-104433 Mooncake transfer engine before 0.3.12 contains an out-of-bounds read vulnerabil... |
high | 7.5 | — | — | 2026-10-03 | 2026-10-06 |
| CVE-2026-94591 Armatura One stores database and message-broker credentials in an install config... |
high | 8.4 | — | — | 2026-10-02 | 2026-10-06 |
| CVE-2026-94592 Armatura One's database initialization routine assigns a fixed, vendor-defined p... |
high | 8.4 | — | — | 2026-10-02 | 2026-10-06 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.