October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,444
Critical
1,335
High
5,831
Medium
6,240
Low
648
Severity not reported
3,390
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1307), google (756), oracle (156), ibm (140), adobe (138), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-86817 The Five Star Business Profile and Schema WordPress plugin before 2.4.0 does not... |
medium | 4.9 | — | — | 2026-10-04 | 2026-10-06 |
| CVE-2026-97332 The User Private Files WordPress plugin before 2.2.0 does not properly protect i... |
medium | 5.3 | — | — | 2026-10-04 | 2026-10-09 |
| CVE-2026-17005 The Horizontal scrolling announcements WordPress plugin through 2.6 does not san... |
medium | 6.8 | — | — | 2026-10-04 | 2026-10-06 |
| CVE-2026-104118 The Razorpay for WooCommerce WordPress plugin before 4.8.8 does not perform owne... |
medium | 5.3 | — | — | 2026-10-04 | 2026-10-06 |
| CVE-2026-105098 A security flaw has been discovered in Omega Solution CoinEx Crypto 2025. |
medium | 4.3 | — | — | 2026-10-04 | 2026-10-06 |
| CVE-2026-105097 A vulnerability was identified in Omega Solution CoinEx Crypto 2025. |
medium | 4.3 | — | — | 2026-10-04 | 2026-10-06 |
| CVE-2026-105131 ezBookkeeping 1.2.0 before 2.0.1 contains a privilege escalation vulnerability t... |
medium | 5.4 | — | — | 2026-10-04 | 2026-10-06 |
| CVE-2026-105096 A vulnerability was determined in Omega Solution CoinEx Crypto 2025. |
medium | 6.3 | — | — | 2026-10-04 | 2026-10-06 |
| CVE-2026-105127 LaraDashboard 1.4.2 before 1.4.8 applies advanced email validation to unauthenti... |
medium | 5.3 | — | — | 2026-10-04 | 2026-10-05 |
| CVE-2026-105128 LaraDashboard before 1.4.8 contains an open redirect vulnerability that allows r... |
medium | 5.4 | — | — | 2026-10-04 | 2026-10-05 |
| CVE-2026-105129 LaraDashboard before 1.4.8 contains an incorrect authorization vulnerability tha... |
medium | 6.5 | — | — | 2026-10-04 | 2026-10-06 |
| CVE-2026-105124 W (vincent-peugnet/wcms) through 3.18.0 contains a stored cross-site scripting v... |
medium | 6.1 | — | — | 2026-10-04 | 2026-10-06 |
| CVE-2026-105122 OpenAM before 16.1.3 contains a server-side request forgery vulnerability that a... |
medium | 5.4 | — | — | 2026-10-03 | 2026-10-06 |
| CVE-2026-105116 OpenAM before 16.1.3 contains a latent cross-site scripting defect that places t... |
medium | 6.1 | — | — | 2026-10-03 | 2026-10-06 |
| CVE-2026-105117 OpenAM before 16.1.3 contains an email content injection vulnerability that allo... |
medium | 6.1 | — | — | 2026-10-03 | 2026-10-06 |
| CVE-2026-105118 OpenAM before 16.1.3 contains an open redirect vulnerability that allows unauthe... |
medium | 4.7 | — | — | 2026-10-03 | 2026-10-06 |
| CVE-2026-105119 OpenAM before 16.1.3 applies its OAuth2 Provider PKCE enforcement only to author... |
medium | 6.8 | — | — | 2026-10-03 | 2026-10-06 |
| CVE-2026-105120 OpenAM before 16.1.3 contains an authorization bypass vulnerability in the sessi... |
medium | 4.9 | — | — | 2026-10-03 | 2026-10-06 |
| CVE-2026-105121 OpenAM before 16.1.3 contains an improper authorization vulnerability that allow... |
medium | 4.9 | — | — | 2026-10-03 | 2026-10-06 |
| CVE-2026-105112 Nezha from 1.8.0 before 2.3.13 contains a lock-order inversion in UpdateGroup an... |
medium | 5.3 | — | — | 2026-10-03 | 2026-10-05 |
| CVE-2026-105113 Nezha Dashboard from 1.8.0 before 2.3.13 contains an improper locking vulnerabil... |
medium | 6.5 | — | — | 2026-10-03 | 2026-10-05 |
| CVE-2026-105114 OpenAM before 16.1.3 contains a reflected cross-site scripting vulnerability tha... |
medium | 6.1 | — | — | 2026-10-03 | 2026-10-06 |
| CVE-2026-104983 A vulnerability has been found in Linux Mint Xreader up to 4.6.9. |
medium | 6.3 | — | — | 2026-10-03 | 2026-10-06 |
| CVE-2026-92767 The Twenty20 Image Before-After plugin for WordPress is vulnerable to Stored Cro... |
medium | 6.4 | — | — | 2026-10-03 | 2026-10-06 |
| CVE-2026-104982 A flaw has been found in Linux Mint Xreader up to 4.6.5. |
medium | 4.3 | — | — | 2026-10-03 | 2026-10-06 |
| CVE-2026-97343 The Burst Statistics – Simple WordPress Analytics (Google Analytics Alternative)... |
medium | 4.3 | — | — | 2026-10-03 | 2026-10-06 |
| CVE-2026-92974 The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress... |
medium | 6.1 | — | — | 2026-10-03 | 2026-10-06 |
| CVE-2026-93896 The WPFront Notification Bar plugin for WordPress is vulnerable to Reflected Cro... |
medium | 6.1 | — | — | 2026-10-03 | 2026-10-06 |
| CVE-2026-103519 The The WP Ultimate Review plugin for WordPress is vulnerable to arbitrary short... |
medium | 5.4 | — | — | 2026-10-03 | 2026-10-06 |
| CVE-2026-104313 The WPC Estimated Delivery Date for WooCommerce plugin for WordPress is vulnerab... |
medium | 6.1 | — | — | 2026-10-03 | 2026-10-06 |
| CVE-2026-11601 The WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System plugin... |
medium | 5.3 | — | — | 2026-10-03 | 2026-10-06 |
| CVE-2026-15795 The Responsive Plus – Elementor Templates & Starter Sites plugin for WordPress i... |
medium | 6.4 | — | — | 2026-10-03 | 2026-10-06 |
| CVE-2026-100157 The The WP Ultimate Review plugin for WordPress is vulnerable to arbitrary short... |
medium | 6.5 | — | — | 2026-10-03 | 2026-10-06 |
| CVE-2026-103421 The WPMobile.App – Android and iOS App Builder plugin for WordPress is vulnerabl... |
medium | 5.4 | — | — | 2026-10-03 | 2026-10-06 |
| CVE-2026-97344 The Wp Social Login and Register Social Counter plugin for WordPress is vulnerab... |
medium | 6.4 | — | — | 2026-10-03 | 2026-10-06 |
| CVE-2026-94238 The Loco Translate WordPress plugin before 2.8.9 does not restrict which file pa... |
medium | 6.8 | — | — | 2026-10-03 | 2026-10-06 |
| CVE-2026-94239 The Loco Translate WordPress plugin before 2.8.9 does not sanitise and escape so... |
medium | 6.8 | — | — | 2026-10-03 | 2026-10-06 |
| CVE-2026-92437 The Mailchimp for WooCommerce WordPress plugin before 6.3 does not require authe... |
medium | 5.3 | — | — | 2026-10-03 | 2026-10-06 |
| CVE-2026-92923 The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not san... |
medium | 6.3 | — | — | 2026-10-03 | 2026-10-06 |
| CVE-2026-91108 The Alt Text AI – Automatically generate image alt text for SEO and accessibilit... |
medium | 4.3 | — | — | 2026-10-03 | 2026-10-06 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.