October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,479
Critical
1,340
High
5,869
Medium
6,256
Low
648
Severity not reported
3,366
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1307), google (756), oracle (156), ibm (140), adobe (138), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-97860 YMS-VPN8 and YMS-VPN8-CP provided by Yamaha Corporation register Windows service... |
medium | 6.7 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-27401 Missing Authorization vulnerability in YITH YITH PayPal Express Checkout for Woo... |
medium | 5.3 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-109216 The Meta Box – A Framework for Dynamic Websites plugin for WordPress is vulnerab... |
medium | 4.9 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-109822 Yamaha wireless LAN router NWR100 provided by Yamaha Corporation contains an iss... |
medium | 6.5 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-71569 Server-Side Request Forgery (SSRF) vulnerability in Apache Camel A2A component. |
medium | 4.8 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-118984 OmniRoute 3.8.0 before 3.8.52 contains an unverified password change vulnerabili... |
medium | 5.5 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-118989 WebToffee Product Import Export for WooCommerce 2.5.1 before 2.6.8 contains a se... |
medium | 5.5 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-115962 Authentication Bypass by Spoofing vulnerability in myCred myCred mycred allows I... |
medium | 4.3 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-88941 Kaspersky has fixed a vulnerability in the Network Agent for Windows module of K... |
medium | 5.2 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-91152 The Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Build... |
medium | 6.1 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-91153 The Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Build... |
medium | 5.3 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-111318 The HT Mega Addons for Elementor – Elementor Widgets & Template Builder plugin f... |
medium | 5.4 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-116763 The LiteSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site Scri... |
medium | 5.4 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-118192 The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for Wo... |
medium | 6.5 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-104727 The Sequential Order Numbers for WooCommerce plugin for WordPress is vulnerable... |
medium | 6.4 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-107627 The Greenshift – animation and page builder blocks plugin for WordPress is vulne... |
medium | 5.4 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-107629 The Greenshift – animation and page builder blocks plugin for WordPress is vulne... |
medium | 5.4 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-109215 The LiteSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site Scri... |
medium | 6.4 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-110707 The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video... |
medium | 4.7 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-103875 The Media Library Assistant plugin for WordPress is vulnerable to Reflected Cros... |
medium | 4.7 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-103485 The Extensions for Leaflet Map plugin for WordPress is vulnerable to Stored DOM-... |
medium | 5.4 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-117548 A NULL pointer dereference flaw was found in 389-ds-base. |
medium | 6.5 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-117627 A flaw was found in the JWT Authorization Grant implementation of the keycloak-s... |
medium | 5.4 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-117688 A flaw was found in the client registration component of Keycloak, an open-sourc... |
medium | 5.3 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-117859 A flaw was found in the Pushed Authorization Request PAR implementation of the k... |
medium | 5.4 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-118030 A flaw was found in the HOTP authentication mechanism of the keycloak-services c... |
medium | 4.2 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-78395 The Link Library WordPress plugin before 7.10.0 does not re-check the selected l... |
medium | 5.3 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-78396 The Link Library WordPress plugin before 7.10.0 does not verify that a requested... |
medium | 5.3 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-88928 The PAYCOMET for WooCommerce WordPress plugin before 5.46 does not verify the cr... |
medium | 6.5 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-93293 The Password Protected plugin for WordPress is vulnerable to Stored Cross-Site S... |
medium | 6.4 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-115302 The Contact Form by Supsystic WordPress plugin before 1.11.1 does not restrict a... |
medium | 5.3 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-19610 A flaw was found in the platform-mbean component of JBoss EAP, which provides ma... |
medium | 6.5 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-115259 The Photo Engine (Media Organizer & Lightroom) WordPress plugin before 6.6.0 doe... |
medium | 4.9 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-115282 The Recipe Card Blocks Lite WordPress plugin before 3.6.4 does not perform an au... |
medium | 5.3 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-115299 The Contact Form by Supsystic WordPress plugin before 1.11.1 does not verify a C... |
medium | 5.4 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-115300 The Contact Form by Supsystic WordPress plugin before 1.11.1 does not validate a... |
medium | 4.3 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-110030 The Hide Price Until Login WordPress plugin before 1.1.2 does not restrict a gue... |
medium | 5.3 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-110504 The Enable SVG, WebP, and ICO Upload WordPress plugin before 1.1.6 does not sani... |
medium | 6.8 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-110505 The Enable SVG, WebP, and ICO Upload WordPress plugin before 1.1.6 does not prev... |
medium | 6.8 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-110983 The WP Photo Album Plus WordPress plugin before 9.3.04.004 does not verify the o... |
medium | 4.3 | — | — | 2026-10-29 | 2026-10-29 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.