October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,475
Critical
1,339
High
5,868
Medium
6,255
Low
648
Severity not reported
3,365
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1307), google (756), oracle (156), ibm (140), adobe (138), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-107323 The Gallery PhotoBlocks WordPress plugin before 1.3.6 does not sanitize and esca... |
medium | 6.8 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-12054 The Download Manager plugin for WordPress is vulnerable to Reflected Cross-Site... |
medium | 6.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-14379 The GamiPress – Gamification plugin to reward points, achievements, badges & ran... |
medium | 6.4 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-14877 The Data Tables Generator by Supsystic plugin for WordPress is vulnerable to Sto... |
medium | 6.4 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-14882 The Brizy – Page Builder plugin for WordPress is vulnerable to Stored Cross-Site... |
medium | 6.4 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-105976 The Portfolio Filter Gallery WordPress plugin before 2.2.1 does not perform prop... |
medium | 4.7 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-105989 The Accept PayPal Payments using Contact Form 7 WordPress plugin before 4.0.7 do... |
medium | 5.3 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-105990 The Accept PayPal Payments using Contact Form 7 WordPress plugin before 4.0.7 do... |
medium | 5.3 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-105995 The Booking Package WordPress plugin before 1.7.30 does not perform authorizatio... |
medium | 5.3 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-107120 The Contest Gallery WordPress plugin before 33.0.1 does not limit the number of... |
medium | 5.3 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-104753 The Rank Math SEO WordPress plugin before 1.0.280 does not properly sanitise and... |
medium | 4.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-104762 The Kadence Blocks — Page Builder Toolkit for Gutenberg Editor plugin for WordPr... |
medium | 6.4 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-104763 The Post Export Import with Media plugin for WordPress is vulnerable to Director... |
medium | 4.9 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-103520 The HivePress – Business Directory, Listings & Classified Ads Plugin plugin for... |
medium | 6.4 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-103912 The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnera... |
medium | 4.7 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-104023 The Smart Popup by Supsystic plugin for WordPress is vulnerable to generic SQL I... |
medium | 4.9 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-103482 The Simple Newsletter Plugin – Noptin plugin for WordPress is vulnerable to Stor... |
medium | 5.4 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-5727 The Hello Plus plugin for WordPress is vulnerable to authorization bypass in all... |
medium | 5.4 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-6723 The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin p... |
medium | 5.3 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-87869 The Filter Everything — WordPress & WooCommerce Filters plugin for WordPress is... |
medium | 6.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-96648 The Data Tables Generator by Supsystic plugin for WordPress is vulnerable to Sto... |
medium | 6.4 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-97630 The FV Flowplayer Video Player plugin for WordPress is vulnerable to Stored Cros... |
medium | 6.4 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-9696 The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scr... |
medium | 6.4 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-103424 The Anti-Spam by CleanTalk – Spam Protection Without CAPTCHA plugin for WordPres... |
medium | 5.4 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-103964 The Download Manager plugin for WordPress is vulnerable to Sensitive Information... |
medium | 4.3 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-103998 The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugi... |
medium | 6.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-104724 The FireBox – WooCommerce Popup Builder, Exit Intent Popup, Email Optin & Cart A... |
medium | 5.3 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-104735 The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video... |
medium | 6.4 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-104993 The GeoDirectory – WP Business Directory Plugin and Classified Listings Director... |
medium | 6.4 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-101324 The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Fo... |
medium | 4.7 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-102401 The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scr... |
medium | 6.4 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-96743 The Table Field Add-on for ACF and SCF plugin for WordPress is vulnerable to Sto... |
medium | 6.4 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-108501 ZTE Z80 Ultra has a system interface permission verification defect. |
medium | 5.7 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-103365 The Bookly – Online Scheduling and Appointment Booking System plugin for WordPre... |
medium | 5.3 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-104898 The Online Scheduling and Appointment Booking System – Bookly plugin for WordPre... |
medium | 6.8 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-93883 The Advanced Classifieds & Directory Pro plugin for WordPress is vulnerable to S... |
medium | 6.4 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-104915 The Academy LMS – AI Course Builder, Quizzes, Certificates & eLearning plugin fo... |
medium | 6.5 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-104022 The Academy LMS – AI Course Builder, Quizzes, Certificates & eLearning plugin fo... |
medium | 5.4 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-107854 Jexactyl is a customisable game management panel and billing system. |
medium | 5.4 | — | — | 2026-10-09 | 2026-10-16 |
| CVE-2026-107856 CiviForm simplifies applications for government benefits programs by reusing app... |
medium | 4.5 | — | — | 2026-10-09 | 2026-10-16 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.