October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,479
Critical
1,340
High
5,869
Medium
6,256
Low
648
Severity not reported
3,366
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1307), google (756), oracle (156), ibm (140), adobe (138), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-107646 The HUSKY – Products Filter for WooCommerce Professional plugin for WordPress is... |
medium | 5.3 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-103696 The Mobile builder WordPress plugin through 1.4.2 does not sanitise and escape a... |
medium | 6.8 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-93767 The Tainacan plugin for WordPress is vulnerable to Directory Traversal in all ve... |
medium | 6.5 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-88963 The Tutor LMS – eLearning and online course solution plugin for WordPress is vul... |
medium | 6.1 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-12272 The Lightweight Cookie Notice – Cookie Banner for Cookie Consent plugin for Word... |
medium | 5.3 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-110017 The Quick PayPal Payments: Payment Button & Form plugin for WordPress is vulnera... |
medium | 6.4 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-109414 The Vitepos – Point of Sale (POS) for WooCommerce plugin for WordPress is vulner... |
medium | 6.5 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-104001 The The Slim SEO – AI SEO Plugin, Lightweight, Fast & Automated plugin for WordP... |
medium | 5.4 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-107748 The User Profile Builder – Beautiful User Registration Forms, User Profiles & Us... |
medium | 6.4 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-103480 The Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental plugin for W... |
medium | 6.4 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-100158 The SQL Chart Builder plugin for WordPress is vulnerable to Stored Cross-Site Sc... |
medium | 6.4 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-110721 The NotificationX plugin for WordPress is vulnerable to Missing Authorization le... |
medium | 5.3 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-111106 The Mail Mint plugin for WordPress is vulnerable to SQL Injection via the 'filte... |
medium | 6.5 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-96562 The The Broken Link Checker plugin for WordPress is vulnerable to arbitrary shor... |
medium | 6.5 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-109512 The Mang Board plugin for WordPress is vulnerable to Stored Cross-Site Scripting... |
medium | 6.4 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-110019 The Bulk Page Generator – LPagery plugin for WordPress is vulnerable to authoriz... |
medium | 4.3 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-103481 The Gwolle Guestbook plugin for WordPress is vulnerable to Reflected Cross-Site... |
medium | 6.1 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-103911 The The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plug... |
medium | 6.5 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-109191 The Image Hub – Free Images from Unsplash, Pixabay, Pexels, Openverse & Giphy pl... |
medium | 4.3 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-101335 The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin f... |
medium | 6.5 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-89280 The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your... |
medium | 4.3 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-93535 The Dark Mode – Improve Accessibility with AI Powered Dark Theme plugin for Word... |
medium | 6.4 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-77829 The Cooked – Recipe Management plugin for WordPress is vulnerable to Stored Cros... |
medium | 6.4 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-111449 Wheels 3.0.0 through 4.1.1 can disclose detailed exceptions when allowIPBasedDeb... |
medium | 5.9 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-111450 Wheels through 4.1.1 derives its default production error-email address from the... |
medium | 5.9 | — | — | 2026-10-16 | 2026-10-19 |
| CVE-2026-111443 Wheels 4.0.6 through 4.1.2 lets an unauthenticated client switch a request into... |
medium | 6.5 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-104769 The Debloat – Remove Unused CSS, Optimize JS plugin for WordPress is vulnerable... |
medium | 5.9 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-103518 The FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler plugin for... |
medium | 4.9 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-111386 Nezha from 1.7.0 before 2.3.15 contains an information disclosure vulnerability... |
medium | 4.3 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-111387 Nezha from 2.2.5 before 2.3.15 contains an information disclosure vulnerability... |
medium | 6.5 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-111388 Frappe Framework before 15.120.0 and 16.x before 16.33.0 does not enforce the pe... |
medium | 5.4 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-111383 Nezha from 2.0.13 before 2.3.15 contains a resource exhaustion vulnerability tha... |
medium | 6.5 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-111384 Nezha 1.0.0 before 2.3.15 contains a memory exhaustion vulnerability in the dash... |
medium | 6.5 | — | — | 2026-10-16 | 2026-10-23 |
| CVE-2026-111385 Nezha from 2.1.0 before 2.3.15 contains a host header injection vulnerability in... |
medium | 4.8 | — | — | 2026-10-16 | 2026-10-21 |
| CVE-2026-111374 FreeRDP from 3.30.0 before 3.32.0 contains a resource exhaustion vulnerability i... |
medium | 5.3 | — | Freerdp / freerdp | 2026-10-16 | 2026-10-20 |
| CVE-2026-111376 FreeRDP from 3.30.0 before 3.32.0 contains a heap out-of-bounds read vulnerabili... |
medium | 5.0 | — | Freerdp / freerdp | 2026-10-16 | 2026-10-20 |
| CVE-2026-111377 FreeRDP from 2.0.0 before 3.32.0 contains an unbounded reassembly vulnerability... |
medium | 6.5 | — | Freerdp / freerdp | 2026-10-16 | 2026-10-20 |
| CVE-2026-111212 A security flaw has been discovered in ImprintLab Medical-SAM-Adapter 0.1.0-alph... |
medium | 4.8 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-111237 A weakness has been identified in Ultralytics FastSAM up to b4ed20c2fed75eadc5aa... |
medium | 5.3 | — | — | 2026-10-16 | 2026-10-21 |
| CVE-2026-100159 The Popup Box plugin for WordPress is vulnerable to Arbitrary Shortcode Executio... |
medium | 4.8 | — | — | 2026-10-16 | 2026-10-16 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.