October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,475
Critical
1,339
High
5,868
Medium
6,255
Low
648
Severity not reported
3,365
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1307), google (756), oracle (156), ibm (140), adobe (138), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-108164 Open Source Social Network (OSSN) through 10.1 contains an insecure direct objec... |
medium | 6.5 | — | — | 2026-10-10 | 2026-10-16 |
| CVE-2026-108165 Immich through 3.3.1 contains a missing authorization vulnerability in the partn... |
medium | 4.3 | — | — | 2026-10-10 | 2026-10-18 |
| CVE-2026-108506 ZTE Z80 Ultra's system interfaces do not have robust invocation authentication,... |
medium | 5.5 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-106139 In Progress® Kendo UI for Vue (@progress/kendo-vue-charts) starting with version... |
medium | 5.4 | — | — | 2026-10-10 | 2026-10-15 |
| CVE-2026-106138 In Progress® KendoReact (@progress/kendo-react-charts) starting with version 1.1... |
medium | 5.4 | — | — | 2026-10-10 | 2026-10-15 |
| CVE-2026-4791 The PeproDev Ultimate Profile Solutions plugin for WordPress is vulnerable to St... |
medium | 6.4 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-104722 The Listdom: AI-powered Business Directory with Classifieds Ads Listings plugin... |
medium | 4.9 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-97340 The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is v... |
medium | 6.4 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-97396 The Email Marketing for WordPress and WooCommerce – Retainful plugin for WordPre... |
medium | 6.4 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-96563 The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is... |
medium | 6.4 | — | — | 2026-10-10 | 2026-10-22 |
| CVE-2026-96653 The WP Directory Kit plugin for WordPress is vulnerable to time-based SQL Inject... |
medium | 6.5 | — | — | 2026-10-10 | 2026-10-11 |
| CVE-2026-108504 ZTE Z80 Ultra has an unauthorized information disclosure vulnerability. |
medium | 5.5 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-101921 The WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Surv... |
medium | 4.7 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-102291 The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordP... |
medium | 5.4 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-102774 The SureDash – Community, Courses & Member Dashboard plugin for WordPress is vul... |
medium | 6.4 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-103478 The Premium Packages – Sell Digital Products Securely plugin for WordPress is vu... |
medium | 6.4 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-104728 The AutomatorWP – No-Code Workflow Automation, Integration & Webhooks Plugin, no... |
medium | 4.3 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-96574 The User Frontend – Membership, User Registration, User Profile, User Directory... |
medium | 6.4 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-97348 The SiteOrigin Widgets Bundle plugin for WordPress is vulnerable to Directory Tr... |
medium | 6.5 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-15178 The Fluent Forms plugin for WordPress is vulnerable to authorization bypass in a... |
medium | 5.4 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-3717 The CV Builder – Professional Resume Builder SaaS plugin for WordPress is vulner... |
medium | 5.3 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-5725 The Favicon Rotator plugin for WordPress is vulnerable to Reflected Cross-Site S... |
medium | 6.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-6243 The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Stored Cr... |
medium | 6.4 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-89100 The Payment Plugins for Stripe WooCommerce plugin for WordPress is vulnerable to... |
medium | 6.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-103427 The Simple Membership plugin for WordPress is vulnerable to Stored Cross-Site Sc... |
medium | 6.4 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-103897 The Responsive Lightbox & Gallery plugin for WordPress is vulnerable to Stored C... |
medium | 4.4 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-107712 The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to t... |
medium | 6.5 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-102402 The Team – Team Members Showcase Plugin plugin for WordPress is vulnerable to St... |
medium | 6.4 | — | — | 2026-10-10 | 2026-10-14 |
| CVE-2026-94421 The Church Admin plugin for WordPress is vulnerable to Stored Cross-Site Scripti... |
medium | 6.4 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-97643 The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vu... |
medium | 6.4 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-91862 The Getwid – Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross... |
medium | 6.4 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-94375 The Order Export & Order Import for WooCommerce plugin for WordPress is vulnerab... |
medium | 5.3 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-78068 The Table Field Add-on for ACF and SCF plugin for WordPress is vulnerable to Sto... |
medium | 6.4 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-85571 The Tutor LMS WordPress plugin before 4.1.1 does not verify that the posts named... |
medium | 6.5 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-91050 The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress... |
medium | 4.3 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-16776 The MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar plugin for... |
medium | 6.4 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-17025 The Graphene theme for WordPress is vulnerable to Stored Cross-Site Scripting vi... |
medium | 6.4 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-18496 The Booking Calendar plugin for WordPress is vulnerable to Sensitive Information... |
medium | 5.3 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-18558 The Embed Any Document – Embed PDF, Word, PowerPoint and Excel Files plugin for... |
medium | 6.4 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-107321 The W3 Total Cache WordPress plugin before 2.10.6 does not confine a media-impor... |
medium | 5.4 | — | — | 2026-10-10 | 2026-10-13 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.