October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,479
Critical
1,340
High
5,869
Medium
6,256
Low
648
Severity not reported
3,366
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1307), google (756), oracle (156), ibm (140), adobe (138), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-18799 Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8... |
medium | 4.3 | — | Mattermost / mattermost server | 2026-10-16 | 2026-10-29 |
| CVE-2026-19076 Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8... |
medium | 4.9 | — | Mattermost / mattermost server | 2026-10-16 | 2026-10-27 |
| CVE-2026-19600 Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10... |
medium | 4.9 | — | Mattermost / mattermost server | 2026-10-16 | 2026-10-27 |
| CVE-2026-19621 Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8... |
medium | 6.5 | — | Mattermost / mattermost server | 2026-10-16 | 2026-10-27 |
| CVE-2026-96870 The SureDash – Community, Courses & Member Dashboard plugin for WordPress is vul... |
medium | 6.4 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-100108 The Social Share Buttons plugin for WordPress is vulnerable to Stored Cross-Site... |
medium | 6.4 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-16251 Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8... |
medium | 6.5 | — | Mattermost / mattermost server | 2026-10-16 | 2026-10-29 |
| CVE-2026-18223 Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8... |
medium | 5.0 | — | Mattermost / mattermost server | 2026-10-16 | 2026-10-29 |
| CVE-2026-18256 Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8... |
medium | 4.3 | — | Mattermost / mattermost server | 2026-10-16 | 2026-10-29 |
| CVE-2026-18560 Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8... |
medium | 4.3 | — | Mattermost / mattermost server | 2026-10-16 | 2026-10-29 |
| CVE-2026-100106 The FiboSearch – Ajax Search for WooCommerce plugin for WordPress is vulnerable... |
medium | 6.4 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-92427 The Coinsnap Bitcoin Crowdfunding WordPress plugin through 1.2.0 does not restri... |
medium | 5.3 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-19798 The Wp Map Block plugin for WordPress is vulnerable to unauthorized modification... |
medium | 4.3 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-19867 Mattermost versions 11.10.x <= 11.10.0, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7... |
medium | 4.3 | — | Mattermost / mattermost server | 2026-10-16 | 2026-10-29 |
| CVE-2026-74923 The Document Gallery WordPress plugin through 5.1.1 does not perform any capabil... |
medium | 5.3 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-91830 The Subscribe to Comments WordPress plugin before 2.3.3 does not sign or validat... |
medium | 6.5 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-91833 The WX Subscribe 微信支付付费订阅 WordPress plugin through 1.2.1 does not saniti... |
medium | 6.8 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-15222 The The User Registration & Membership – Free & Paid Memberships, Subscriptions,... |
medium | 5.4 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-18551 Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8... |
medium | 6.5 | — | Mattermost / mattermost server | 2026-10-16 | 2026-10-29 |
| CVE-2026-18795 Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8... |
medium | 6.4 | — | Mattermost / mattermost server | 2026-10-16 | 2026-10-29 |
| CVE-2026-19541 Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10... |
medium | 6.5 | — | Mattermost / mattermost server | 2026-10-16 | 2026-10-29 |
| CVE-2026-19601 Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10... |
medium | 4.9 | — | Mattermost / mattermost server | 2026-10-16 | 2026-10-29 |
| CVE-2026-19603 Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10... |
medium | 4.3 | — | Mattermost / mattermost server | 2026-10-16 | 2026-10-29 |
| CVE-2026-110252 The WPeMatico RSS Feed Fetcher plugin for WordPress is vulnerable to Stored Cros... |
medium | 5.4 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-110290 The WebberZone Top 10 — Popular Posts plugin for WordPress is vulnerable to Stor... |
medium | 6.4 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-110366 Missing Authorization vulnerability in Gemini Labs Site Reviews site-reviews all... |
medium | 5.3 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-110664 The Premium Packages – Sell Digital Products Securely plugin for WordPress is vu... |
medium | 6.4 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-111069 The GeoDirectory – WP Business Directory Plugin and Classified Listings Director... |
medium | 6.4 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-111178 The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to g... |
medium | 4.9 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-109982 The MB Custom Post Types & Custom Taxonomies WordPress plugin before 2.12.2 does... |
medium | 4.2 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-110012 The Salon Booking System WordPress plugin before 10.31.3 does not restrict sever... |
medium | 4.3 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-110013 The Salon Booking System WordPress plugin before 10.31.9 does not generate its b... |
medium | 4.8 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-110014 The Salon Booking System WordPress plugin before 10.31.9 does not properly check... |
medium | 5.3 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-110179 The affiliate-toolkit WordPress plugin before 3.8.9 does not validate a user-sup... |
medium | 6.8 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-107770 The Photo Engine (Media Organizer & Lightroom) plugin for WordPress is vulnerabl... |
medium | 6.8 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-109382 The WSP MCP AI Agents Connector plugin for WordPress is vulnerable to Sensitive... |
medium | 6.5 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-109388 The HivePress – Business Directory, Listings & Classified Ads Plugin plugin for... |
medium | 6.4 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-104755 The WP Compress – Instant Performance & Speed Optimization plugin for WordPress... |
medium | 4.8 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-105973 The Visual Form Builder WordPress plugin through 3.1 does not perform authorizat... |
medium | 4.3 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-105974 The Visual Form Builder WordPress plugin through 3.1 does not perform an authori... |
medium | 4.3 | — | — | 2026-10-16 | 2026-10-16 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.