October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,463
Critical
1,337
High
5,864
Medium
6,249
Low
648
Severity not reported
3,365
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1307), google (756), oracle (156), ibm (140), adobe (138), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-86851 The Livees Checkout WordPress plugin through 7.0.2 does not perform any capabili... |
medium | 6.5 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-87846 The Shipping for Nova Poshta WordPress plugin through 1.19.8 does not perform an... |
medium | 5.3 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-89235 The Testimonials by BestWebSoft WordPress plugin through 1.0.8 does not sanitise... |
medium | 6.8 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-62041 Missing Authorization vulnerability in Ashok Dudhat WP Event Manager wp-event-ma... |
medium | 5.4 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-62042 Missing Authorization vulnerability in unFocus Projects Scripts n Styles scripts... |
medium | 5.3 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-39779 Missing Authorization vulnerability in Asgaros Asgaros Forum asgaros-forum allow... |
medium | 4.3 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-62036 Exposure of Sensitive System Information to an Unauthorized Control Sphere vulne... |
medium | 4.3 | — | — | 2026-10-09 | 2026-10-11 |
| CVE-2026-62039 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-09 | 2026-10-11 |
| CVE-2026-62040 Missing Authorization vulnerability in DEV Institute Restrict User Access – Memb... |
medium | 5.3 | — | — | 2026-10-09 | 2026-10-14 |
| CVE-2026-107419 Missing Authorization vulnerability in Cool Plugins AI Translation for Polylang... |
medium | 5.4 | — | — | 2026-10-09 | 2026-10-11 |
| CVE-2026-103329 The Super Payments WordPress plugin before 1.43.1 does not properly verify the a... |
medium | 5.3 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-79650 Apache CXF’s OIDC relying-party component could redirect users to an attacker-co... |
medium | 6.1 | — | Apache / cxf | 2026-10-09 | 2026-10-20 |
| CVE-2026-96518 Missing Authorization vulnerability in properfraction ProfilePress wp-user-avata... |
medium | 5.9 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-96539 Incorrect Privilege Assignment vulnerability in Ultimate Member Ultimate Member... |
medium | 5.6 | — | — | 2026-10-09 | 2026-10-11 |
| CVE-2026-96334 Missing Authorization vulnerability in ThemeGrill User Registration user-registr... |
medium | 5.6 | — | — | 2026-10-09 | 2026-10-11 |
| CVE-2026-96337 Missing Authorization vulnerability in properfraction ProfilePress wp-user-avata... |
medium | 6.5 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-95589 Missing Authorization vulnerability in Magepeople inc. |
medium | 6.5 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-95597 Missing Authorization vulnerability in codemstory 워드프레스 결제 심플페이 pgall... |
medium | 6.5 | — | — | 2026-10-09 | 2026-10-11 |
| CVE-2026-94665 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-94667 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-09 | 2026-10-11 |
| CVE-2026-78340 Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16,... |
medium | 6.7 | — | Dell / policy manager for secure connect gateway | 2026-10-09 | 2026-10-13 |
| CVE-2026-62049 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-78027 Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16,... |
medium | 6.8 | — | Dell / policy manager for secure connect gateway | 2026-10-09 | 2026-10-13 |
| CVE-2026-84224 The Kirki WordPress plugin before 6.3.2 does not validate the host of a URL it i... |
medium | 4.1 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-78021 Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16,... |
medium | 5.3 | — | Dell / policy manager for secure connect gateway | 2026-10-09 | 2026-10-14 |
| CVE-2026-84220 The Kirki WordPress plugin before 6.3.2 does not prevent shortcodes held in comm... |
medium | 4.8 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-107655 A flaw was found in CUPS. |
medium | 4.0 | — | — | 2026-10-09 | 2026-10-12 |
| CVE-2026-78013 Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16,... |
medium | 6.3 | — | Dell / policy manager for secure connect gateway | 2026-10-09 | 2026-10-13 |
| CVE-2026-78015 Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16,... |
medium | 5.3 | — | Dell / policy manager for secure connect gateway | 2026-10-09 | 2026-10-13 |
| CVE-2026-78016 Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16,... |
medium | 4.3 | — | Dell / policy manager for secure connect gateway | 2026-10-09 | 2026-10-14 |
| CVE-2026-97075 Missing Authorization vulnerability in WP Media WP Rocket wp-rocket allows Explo... |
medium | 6.5 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2025-14123 The Redux Framework plugin for WordPress is vulnerable to privilege escalation i... |
medium | 6.8 | — | — | 2026-10-09 | 2026-10-19 |
| CVE-2026-19571 The ITE IT8xxx2 SHI host-command backend (subsys/mgmt/ec_host_cmd/backends/ec_ho... |
medium | 6.7 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-92989 The SendPress Newsletters WordPress plugin through 1.26.1.20 does not check the... |
medium | 4.3 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-92990 The SendPress Newsletters WordPress plugin through 1.26.1.20 protects a logging... |
medium | 5.3 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-86850 The SKU Error Fixer for WooCommerce WordPress plugin through 1.0 does not perfor... |
medium | 6.5 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-87841 The UnitechPay WordPress plugin through 1.0.6.3 does not verify the authenticity... |
medium | 5.3 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-88931 The Social Web Suite WordPress plugin through 4.1.12 does not restrict which of... |
medium | 5.3 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-106097 The Code Snippets WordPress plugin before 3.10.0 does not sanitise and escape a... |
medium | 6.8 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-87109 An authenticated Ops Manager organization member can retrieve another member's p... |
medium | 6.5 | — | Mongodb / ops manager | 2026-10-09 | 2026-10-15 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.