October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,479
Critical
1,340
High
5,869
Medium
6,256
Low
648
Severity not reported
3,366
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1307), google (756), oracle (156), ibm (140), adobe (138), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-101217 Dell Unisphere for PowerMax vApp, version(s) 9.2.4.x, contain(s) an Improper Lim... |
medium | 6.5 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-109968 A flaw was found in the clevis PKCS#11 pin. |
medium | 5.5 | — | — | 2026-10-14 | 2026-10-30 |
| CVE-2026-107417 Missing Authorization vulnerability in Muralidharan Ramasamy Push Notification f... |
medium | 6.5 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-107422 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-107425 Missing Authorization vulnerability in Magepeople inc. |
medium | 6.5 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-107433 Missing Authorization vulnerability in miniOrange WP OAuth Server miniorange-oau... |
medium | 6.5 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-73797 A security vulnerability in HPE NonStop TSQLFIL may cause address space corrupti... |
medium | 5.3 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-97315 The Responsive Blocks WordPress plugin before 2.3.0 does not sanitise or escape... |
medium | 5.4 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-88998 The Tickera WordPress plugin before 3.6.0.4 does not correctly verify the integr... |
medium | 5.3 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-82844 The WPForms Lite WordPress plugin before 2.0.2.2 does not verify server-side tha... |
medium | 5.3 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-73795 A security vulnerability in HPE NonStop TMF Auditread2 can cause Denial of Servi... |
medium | 6.4 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-73796 A security vulnerability in HPE NonStop TSQLEXE may cause application crash via... |
medium | 4.4 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-103308 The Visma Pay for WooCommerce WordPress plugin before 1.2.2 does not verify the... |
medium | 6.5 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-100229 A flaw was found in GStreamer's H.266 codec parser library (libgstcodecparsers). |
medium | 6.5 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-101301 The WPCode WordPress plugin before 2.4.0 does not correctly verify that a reques... |
medium | 5.3 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-73794 HPE NonStop MODULAR NSJ contains a predictable seed vulnerability in Random Numb... |
medium | 4.6 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-109971 A flaw was found in the clevis PKCS#11 pin. |
medium | 4.7 | — | — | 2026-10-14 | 2026-10-30 |
| CVE-2026-109970 A flaw was found in the clevis PKCS#11 pin. |
medium | 4.7 | — | — | 2026-10-14 | 2026-10-30 |
| CVE-2026-109969 A flaw was found in the clevis PKCS#11 pin. |
medium | 4.7 | — | — | 2026-10-14 | 2026-10-30 |
| CVE-2026-100231 A flaw was found in the GStreamer multimedia framework's ASF muxer plugin (asfmu... |
medium | 6.1 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-103671 External control of assumed-Immutable web parameter issue exists in EC-CUBE plug... |
medium | 4.7 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-107757 The Gallery Custom Links plugin for WordPress is vulnerable to Stored Cross-Site... |
medium | 4.9 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-110227 Missing Authorization vulnerability in 10up Restricted Site Access restricted-si... |
medium | 5.3 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-107650 The GeoDirectory – WP Business Directory Plugin and Classified Listings Director... |
medium | 6.4 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-107754 The GeoDirectory – WP Business Directory Plugin and Classified Listings Director... |
medium | 6.4 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-107756 The Meow Lightbox plugin for WordPress is vulnerable to Stored Cross-Site Script... |
medium | 6.4 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-104761 The Mang Board plugin for WordPress is vulnerable to Stored Cross-Site Scripting... |
medium | 6.4 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2025-9373 The PeproDev Branches Map plugin for WordPress is vulnerable to Stored Cross-Sit... |
medium | 6.4 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-103380 The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress... |
medium | 4.3 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-103907 The JNews - Jeg Elementor Kit plugin for WordPress is vulnerable to unauthorized... |
medium | 6.5 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-92409 The Donation Thermometer WordPress plugin before 2.3.0 does not escape a colour... |
medium | 6.8 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-92426 The YITH WooCommerce Popup WordPress plugin before 1.60.0 does not check the cap... |
medium | 4.9 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-94254 The SellKit WordPress plugin before 2.8.0 does not validate a client-supplied pr... |
medium | 5.3 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-94260 The Sifalo Pay WordPress plugin before 2.5.3 does not verify ownership of, or au... |
medium | 5.3 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-94261 The Sifalo Pay WordPress plugin before 2.5.3 does not verify that a payment tran... |
medium | 5.3 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-94360 The Paymentfor Gateway for WooCommerce WordPress plugin before 1.0.6 does not ve... |
medium | 5.3 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-96900 The Cart Abandonment Recovery for WooCommerce WordPress plugin before 2.1.4 does... |
medium | 5.3 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-96904 The AWP Classifieds WordPress plugin before 4.4.9 does not verify that a request... |
medium | 5.3 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-87968 The Product Feed for Google Shopping, Microsoft Advertising and 40+ Channels for... |
medium | 5.3 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-87974 The Asaas Gateway for WooCommerce WordPress plugin before 2.7.8 does not properl... |
medium | 5.3 | — | — | 2026-10-14 | 2026-10-14 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.