October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,479
Critical
1,340
High
5,869
Medium
6,256
Low
648
Severity not reported
3,366
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1307), google (756), oracle (156), ibm (140), adobe (138), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-88927 The rtMedia for WordPress, BuddyPress and bbPress WordPress plugin before 4.7.14... |
medium | 4.3 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-90989 The Tainacan WordPress plugin before 1.4.0 does not restrict its reports REST en... |
medium | 4.3 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-91076 The Robokassa payment gateway for Woocommerce WordPress plugin before 1.9.0 does... |
medium | 5.3 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-85000 The EmbedPress WordPress plugin before 4.6.8 does not perform any capability or... |
medium | 5.3 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-85345 The FV Flowplayer Video Player WordPress plugin before 7.5.55.7212 does not prop... |
medium | 4.1 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-86797 The Pricing Table WordPress plugin before 2.1.5 does not validate the scheme of... |
medium | 6.8 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-87843 The Trust Payments Gateway for WooCommerce WordPress plugin before 3.1.0 does no... |
medium | 6.5 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-108064 The WP Encryption WordPress plugin before 7.8.8.2 does not perform a capability... |
medium | 6.5 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-108069 The Sunshine Photo Cart WordPress plugin before 3.7.4 does not check whether a v... |
medium | 5.3 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-110465 Tronclass developed by WisdomGarden has a Insecure Direct Object Reference vulne... |
medium | 4.3 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-110466 Tronclass developed by WisdomGarden has a Sensitive Data Exposure vulnerability. |
medium | 4.3 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-110467 Tronclass developed by WisdomGarden has a Insecure Direct Object Reference vulne... |
medium | 4.3 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-106166 The NEX-Forms WordPress plugin before 9.3.1 does not perform any authorization,... |
medium | 5.3 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-106469 The Gutenverse Form WordPress plugin before 3.0.11 does not sanitize SVG icon ma... |
medium | 6.8 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-106646 The Classified Listing WordPress plugin before 6.1.1 does not verify that the re... |
medium | 5.9 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-107158 The LTL Freight Quotes WordPress plugin before 4.2.19 does not perform any autho... |
medium | 5.3 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-107160 The LTL Freight Quotes WordPress plugin before 4.2.19 does not perform any autho... |
medium | 5.3 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-107178 The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.16 does not... |
medium | 6.8 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-107319 The GamiPress WordPress plugin before 8.0.6 does not perform a capability check... |
medium | 4.3 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-107320 The GamiPress WordPress plugin before 8.0.6 does not properly authorize access t... |
medium | 5.3 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-104644 The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.15 does not... |
medium | 6.8 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-104751 The Rank Math SEO WordPress plugin before 1.0.280 does not perform a capability... |
medium | 5.3 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-105261 The Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change St... |
medium | 6.8 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-105969 The CodeAtoZ B2B Suite for WooCommerce WordPress plugin before 1.6.1 does not pr... |
medium | 5.3 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-105975 The CamPay Shortcode Payment Gateway WordPress plugin before 1.7 does not verify... |
medium | 5.3 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-106098 The WP Data Access WordPress plugin before 5.5.77 does not correctly check autho... |
medium | 5.3 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-106099 The WP Data Access WordPress plugin before 5.5.84 does not restrict its database... |
medium | 5.3 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-50216 An integer underflow exists in the DNS proxy component of the macOS NetworkExten... |
medium | 5.3 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-50217 A use-after-free vulnerability in the Windows WFP callout driver of Akamai Guard... |
medium | 4.7 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-107153 Multiple smartphones provided by Rakuten Mobile, Inc. |
medium | 6.6 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-46449 The Akamai Guardicore Platform Agent (GPA) before 7.4 for macOS is affected by a... |
medium | 6.7 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-50215 A use-after-free exists in the Windows WFP packet-capture driver shipped with Ak... |
medium | 4.4 | — | — | 2026-10-14 | 2026-10-17 |
| CVE-2026-110451 Nix before 2.35.3 and Lix before 2.95.4 on macOS allow a Seatbelt sandbox escape... |
medium | 4.3 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-110452 The multi-user installer in Nix before 2.35.3 sets the ownership of store conten... |
medium | 4.0 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-110453 Nix before 2.35.3, when unsandboxed on macOS or FreeBSD, incorrectly allows conn... |
medium | 4.3 | — | — | 2026-10-14 | 2026-10-19 |
| CVE-2026-110454 A malicious actor with access to the network could exploit an Improper Access Co... |
medium | 5.3 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-110456 A malicious actor with access to the network and under certain conditions could... |
medium | 5.3 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-101926 The Hyyan WooCommerce Polylang Integration plugin for WordPress is vulnerable to... |
medium | 6.5 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-103369 The Social Share Buttons & Analytics Plugin – GetSocial.io plugin for WordPress... |
medium | 6.4 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-97471 The Avada (Fusion) Builder plugin for WordPress is vulnerable to Sensitive Infor... |
medium | 5.3 | — | — | 2026-10-14 | 2026-10-15 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.