October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,479
Critical
1,340
High
5,869
Medium
6,256
Low
648
Severity not reported
3,366
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1307), google (756), oracle (156), ibm (140), adobe (138), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-111027 The Welcart e-Commerce WordPress plugin before 2.12.6 does not properly sanitise... |
medium | 6.8 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-111031 The Welcart e-Commerce WordPress plugin before 2.12.6 does not validate a user-s... |
medium | 4.7 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-111960 The Royal MCP WordPress plugin before 1.5.10 does not perform object-level or po... |
medium | 4.3 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-111967 The MP3 Audio Player WordPress plugin before 5.16 does not escape one of its aud... |
medium | 6.8 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-113485 The Media Library Assistant WordPress plugin before 3.42 does not consistently v... |
medium | 6.5 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-107098 The Royal Addons for Elementor WordPress plugin before 1.7.1070 does not sanitis... |
medium | 6.8 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-107100 The Royal Addons for Elementor WordPress plugin before 1.7.1070 does not verify... |
medium | 5.3 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-109236 The Customer Email Verification for WooCommerce plugin for WordPress is vulnerab... |
medium | 4.8 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-110292 The PayPlug for WooCommerce (Official) WordPress plugin before 3.1.1 does not ve... |
medium | 6.5 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-110506 The Page Builder by SiteOrigin WordPress plugin before 2.38.0 does not sanitize... |
medium | 6.8 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-110509 The Essential Addons for Elementor WordPress plugin before 6.8.7 does not restri... |
medium | 5.3 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-110524 The Copy Anything to Clipboard for WordPress WordPress plugin before 5.5.5 does... |
medium | 6.8 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-110691 The WPOrLogin WordPress plugin before 3.1.0 does not perform a capability check... |
medium | 6.5 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-103382 The Casso Flow WordPress plugin before 4.2.0 does not properly authenticate inco... |
medium | 5.3 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-104694 The Thrive Automator WordPress plugin before 11.2 does not properly sanitize and... |
medium | 6.8 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-105997 The Booking Package WordPress plugin before 1.7.33 does not restrict who can tri... |
medium | 5.3 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-106002 The Court Reservation WordPress plugin before 1.12.4 does not perform any author... |
medium | 5.3 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-106003 The Court Reservation WordPress plugin before 1.12.4 does not perform any author... |
medium | 5.3 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-107097 The Royal Addons for Elementor WordPress plugin before 1.7.1070 does not perform... |
medium | 5.3 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-103331 The UniPAY Payment Gateway For WooCommerce WordPress plugin through 2.3 does not... |
medium | 5.3 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-103372 The Payconiq WordPress plugin through 1.0.4 does not check that a visitor is all... |
medium | 5.3 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-118275 A vulnerability was found in a2ui-project a2ui up to 0.10.6. |
medium | 5.3 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-111727 The Appointment Booking Calendar plugin for WordPress is vulnerable to Stored Cr... |
medium | 6.4 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-118376 WeKnora before 0.8.2 contains a server-side request forgery vulnerability in isR... |
medium | 5.3 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-118384 GNU mtools through 4.0.49 has an out-of-bounds write in parse_vses in vfat.c. |
medium | 6.1 | — | — | 2026-10-28 | 2026-10-31 |
| CVE-2026-118274 A vulnerability has been found in a2ui-project a2ui up to 0.10.6. |
medium | 4.3 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-118370 libexpat through 2.9.0 contains a signed integer overflow vulnerability in store... |
medium | 5.9 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-118374 LibreSSL ocspcheck through 4.4.0 contains a memory exhaustion vulnerability that... |
medium | 5.9 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-117606 NexoPOS through 6.3.0 contains a missing authorization vulnerability that allows... |
medium | 5.4 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-117608 Assimp through 6.0.5 contains an integer overflow vulnerability in MD2Importer::... |
medium | 6.1 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-117610 libexpat through 2.9.0 contains a NULL pointer dereference vulnerability in exte... |
medium | 5.9 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-118273 A flaw has been found in a2ui-project a2ui up to 0.10.6. |
medium | 4.3 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-115624 GROWI contains a missing authorization check vulnerability in its collaborative... |
medium | 5.3 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-117605 nopCommerce before 5.00.0 contains a missing authorization vulnerability in the... |
medium | 4.3 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-107745 The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPre... |
medium | 4.2 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-109209 The All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Sel... |
medium | 6.4 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-109848 GROWI contains an authorization bypass vulnerability in its tag update API and t... |
medium | 4.2 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-109974 The All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Sel... |
medium | 6.4 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-105272 GROWI contains an authorization bypass vulnerability in its page viewing and com... |
medium | 4.2 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-107625 The Ultimate Member – User Profile, Registration, Login, Member Directory, Conte... |
medium | 6.4 | — | — | 2026-10-28 | 2026-10-28 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.