October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,479
Critical
1,340
High
5,869
Medium
6,256
Low
648
Severity not reported
3,366
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1307), google (756), oracle (156), ibm (140), adobe (138), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-80275 Comelit Multi-User Gateway for VIP System (model 1456B) firmware versions 2.9.1... |
high | 8.8 | — | — | 2026-10-01 | 2026-10-05 |
| CVE-2026-19253 The Cache Enabler WordPress plugin before 1.8.17 does not validate a URL before... |
high | 8.7 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-101147 The Featured Image from URL (FIFU) WordPress plugin before 6.0.8, Featured Image... |
high | 8.8 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-82826 Hitachi Coding Software Suite contains a vulnerability related to the Cleartext... |
high | 7.5 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-82828 Hitachi Coding Software Suite contains an Incorrect Authorization vulnerability... |
high | 8.8 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-103536 A vulnerability was identified in ZongXR Supermarket 1.0.0.0. |
high | 7.3 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-96561 The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPre... |
high | 7.2 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-92245 The Simply Schedule Appointments plugin for WordPress is vulnerable to Sensitive... |
high | 7.5 | — | — | 2026-10-01 | 2026-10-03 |
| CVE-2026-103530 A vulnerability was detected in decolua 9Router up to 0.5.55. |
high | 7.3 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-120185 A security flaw has been discovered in ken678 YznCMS up to 2.2.0. |
medium | 4.7 | — | — | 2026-10-31 | 2026-10-31 |
| CVE-2026-120210 FFmpeg 5.0 through 9.0.2 contains a path traversal vulnerability in the IMF demu... |
medium | 4.3 | — | — | 2026-10-31 | 2026-10-31 |
| CVE-2026-120202 Highflame ramparts 0.8.1 through 0.8.10 contains a security scan bypass vulnerab... |
medium | 6.5 | — | — | 2026-10-31 | 2026-10-31 |
| CVE-2026-120204 DeepInfer through 0.1.0 contains a path traversal vulnerability in the unauthent... |
medium | 5.6 | — | — | 2026-10-31 | 2026-10-31 |
| CVE-2026-120206 Thelia before 3.2.0 contains a cross-site request forgery vulnerability in the b... |
medium | 5.9 | — | — | 2026-10-31 | 2026-10-31 |
| CVE-2026-120199 LearnHouse before 1.1.1 contains a missing authorization vulnerability in the as... |
medium | 4.3 | — | — | 2026-10-31 | 2026-10-31 |
| CVE-2026-120200 Nexterm through 1.2.2-BETA contains a missing authorization vulnerability that a... |
medium | 5.4 | — | — | 2026-10-31 | 2026-10-31 |
| CVE-2026-15272 The Web 2.0 Directory plugin for WordPress is vulnerable to time-based SQL Injec... |
medium | 6.5 | — | — | 2026-10-31 | 2026-10-31 |
| CVE-2026-118599 A file overwrite vulnerability exists in Epiphany when installing WebExtension p... |
medium | 5.5 | — | — | 2026-10-31 | 2026-10-31 |
| CVE-2026-96554 The BuddyBoss Platform plugin for WordPress is vulnerable to Stored Cross-Site S... |
medium | 6.4 | — | — | 2026-10-31 | 2026-10-31 |
| CVE-2026-107711 The FlexStock – Product Stock Sync with Google Sheets for WooCommerce plugin for... |
medium | 6.4 | — | — | 2026-10-31 | 2026-10-31 |
| CVE-2026-109231 The Germanized for WooCommerce plugin for WordPress is vulnerable to Unauthorize... |
medium | 4.3 | — | — | 2026-10-31 | 2026-10-31 |
| CVE-2026-116752 The GeoDirectory – WP Business Directory Plugin and Classified Listings Director... |
medium | 6.4 | — | — | 2026-10-31 | 2026-10-31 |
| CVE-2026-118598 A logic error in Epiphany's site permission handling can cause camera and microp... |
medium | 6.5 | — | — | 2026-10-31 | 2026-10-31 |
| CVE-2026-104926 The WooCommerce Extra Product Options Pro plugin for WordPress is vulnerable to... |
medium | 6.1 | — | — | 2026-10-31 | 2026-10-31 |
| CVE-2026-100151 The Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & A... |
medium | 6.1 | — | — | 2026-10-31 | 2026-10-31 |
| CVE-2026-119160 The Smart Post – Post Grid, Post Carousel, Post Slider Gutenberg Blocks for Blog... |
medium | 6.4 | — | — | 2026-10-31 | 2026-10-31 |
| CVE-2026-101325 The Newsletters plugin for WordPress is vulnerable to time-based SQL Injection v... |
medium | 5.3 | — | — | 2026-10-31 | 2026-10-31 |
| CVE-2026-103915 The Booking for Appointments and Events Calendar – Amelia plugin for WordPress i... |
medium | 5.3 | — | — | 2026-10-31 | 2026-10-31 |
| CVE-2026-109367 The All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Loca... |
medium | 5.3 | — | — | 2026-10-31 | 2026-10-31 |
| CVE-2026-110023 The WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps pl... |
medium | 5.9 | — | — | 2026-10-31 | 2026-10-31 |
| CVE-2026-111070 The Content Pilot – Autoblogging & Affiliate Marketing Suite plugin for WordPres... |
medium | 5.4 | — | — | 2026-10-31 | 2026-10-31 |
| CVE-2026-111592 The Co-Authors, Multiple Authors and Guest Authors in an Author Box with Publish... |
medium | 6.4 | — | — | 2026-10-31 | 2026-10-31 |
| CVE-2026-116535 The SEOPress – AI SEO Plugin & On-site SEO plugin for WordPress is vulnerable to... |
medium | 6.4 | — | — | 2026-10-31 | 2026-10-31 |
| CVE-2025-9462 The WP2LEADS plugin for WordPress is vulnerable to time-based SQL Injection via... |
medium | 6.5 | — | — | 2026-10-31 | 2026-10-31 |
| CVE-2026-103962 The User Frontend – Membership, User Registration, User Profile, User Directory... |
medium | 6.1 | — | — | 2026-10-31 | 2026-10-31 |
| CVE-2026-103997 The Redux Framework plugin for WordPress is vulnerable to authorization bypass i... |
medium | 6.5 | — | — | 2026-10-31 | 2026-10-31 |
| CVE-2025-11455 The Perfect Images plugin for WordPress is vulnerable to unauthorized modificati... |
medium | 4.3 | — | — | 2026-10-31 | 2026-10-31 |
| CVE-2026-11396 The Product Filter for WooCommerce by WBW plugin for WordPress is vulnerable to... |
medium | 5.3 | — | — | 2026-10-31 | 2026-10-31 |
| CVE-2026-120019 The W3 Total Cache plugin for WordPress is vulnerable to Stored Cross-Site Scrip... |
medium | 5.4 | — | — | 2026-10-31 | 2026-10-31 |
| CVE-2026-88942 The Product Filter for WooCommerce by WBW plugin for WordPress is vulnerable to... |
medium | 6.1 | — | — | 2026-10-31 | 2026-10-31 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.