October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,444
Critical
1,335
High
5,831
Medium
6,240
Low
648
Severity not reported
3,390
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1307), google (756), oracle (156), ibm (140), adobe (138), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-88782 The Kubio AI Page Builder WordPress plugin before 2.9.3 does not validate the UR... |
medium | 6.8 | — | — | 2026-10-03 | 2026-10-06 |
| CVE-2026-85015 The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not san... |
medium | 6.6 | — | — | 2026-10-03 | 2026-10-06 |
| CVE-2026-85568 The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not cor... |
medium | 6.8 | — | — | 2026-10-03 | 2026-10-06 |
| CVE-2026-86832 The MetForm WordPress plugin before 4.3.1 does not properly restrict access to f... |
medium | 5.3 | — | — | 2026-10-03 | 2026-10-06 |
| CVE-2026-11399 The Helpdesk Support Ticket System for WooCommerce plugin for WordPress is vulne... |
medium | 4.3 | — | — | 2026-10-03 | 2026-10-06 |
| CVE-2026-103888 The WPC Smart Quick View for WooCommerce plugin for WordPress is vulnerable to R... |
medium | 6.1 | — | — | 2026-10-03 | 2026-10-06 |
| CVE-2026-103909 The Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Q... |
medium | 6.1 | — | — | 2026-10-03 | 2026-10-06 |
| CVE-2026-103293 The MPG WordPress plugin before 4.2.3 does not validate that the dataset source... |
medium | 6.8 | — | — | 2026-10-03 | 2026-10-06 |
| CVE-2026-101357 The SEOPress – AI SEO Plugin & On-site SEO plugin for WordPress is vulnerable to... |
medium | 4.9 | — | — | 2026-10-03 | 2026-10-06 |
| CVE-2026-101162 The WP Ultimate Review WordPress plugin before 2.4.4 does not escape some of its... |
medium | 6.4 | — | — | 2026-10-03 | 2026-10-06 |
| CVE-2026-100149 The WPZOOM Connect: AI Chat, Click to Chat, Social Icons & Share Buttons plugin... |
medium | 5.3 | — | — | 2026-10-03 | 2026-10-06 |
| CVE-2026-100152 The The All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema,... |
medium | 6.5 | — | — | 2026-10-03 | 2026-10-06 |
| CVE-2026-100148 The Rich Showcase for Google Reviews plugin for WordPress is vulnerable to Store... |
medium | 6.4 | — | — | 2026-10-03 | 2026-10-06 |
| CVE-2025-12828 The Ultra Addons Lite for Elementor plugin for WordPress is vulnerable to Stored... |
medium | 6.4 | — | — | 2026-10-03 | 2026-10-14 |
| CVE-2026-92826 The EWWW Image Optimizer plugin for WordPress is vulnerable to Reflected Cross-S... |
medium | 6.1 | — | — | 2026-10-03 | 2026-10-06 |
| CVE-2026-92538 The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin... |
medium | 6.1 | — | — | 2026-10-03 | 2026-10-06 |
| CVE-2026-92551 The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User... |
medium | 6.1 | — | — | 2026-10-03 | 2026-10-06 |
| CVE-2026-92727 The EmbedPress – PDF Embedder, 3D PDF FlipBook, Google Reviews, YouTube Videos,... |
medium | 6.4 | — | — | 2026-10-03 | 2026-10-06 |
| CVE-2026-94378 The SupportCandy – AI Customer Support Ticket System & Live Chatbot Agent plugin... |
medium | 6.4 | — | — | 2026-10-03 | 2026-10-06 |
| CVE-2026-94539 The SupportCandy – AI Customer Support Ticket System & Live Chatbot Agent plugin... |
medium | 6.5 | — | — | 2026-10-03 | 2026-10-06 |
| CVE-2026-95865 The Beaver Builder Page Builder – Drag and Drop Website Builder plugin for WordP... |
medium | 6.5 | — | — | 2026-10-03 | 2026-10-06 |
| CVE-2026-100180 The Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates f... |
medium | 5.4 | — | — | 2026-10-03 | 2026-10-06 |
| CVE-2026-92243 The Ivory Search – WordPress Search Plugin plugin for WordPress is vulnerable to... |
medium | 6.1 | — | — | 2026-10-03 | 2026-10-06 |
| CVE-2026-105083 ImageMagick before 7.1.2-32 and 6.9.13-57 contains a policy bypass vulnerability... |
medium | 4.2 | — | Imagemagick / imagemagick | 2026-10-03 | 2026-10-14 |
| CVE-2026-104479 Shopclass before 6.2.0 contains a stored cross-site scripting vulnerability that... |
medium | 5.4 | — | — | 2026-10-03 | 2026-10-06 |
| CVE-2026-105029 UVdesk support-center-bundle before 1.1.3.3 contains an insecure direct object r... |
medium | 4.3 | — | — | 2026-10-03 | 2026-10-06 |
| CVE-2026-105030 Kener 4.0.0 before 4.1.6 contains an information disclosure vulnerability that a... |
medium | 5.3 | — | — | 2026-10-03 | 2026-10-06 |
| CVE-2026-104474 OpenLiteSpeed before 1.9.3 contains a local privilege escalation vulnerability i... |
medium | 6.7 | — | — | 2026-10-03 | 2026-10-06 |
| CVE-2026-104475 IDURAR ERP CRM through 4.1.1 contains a stored cross-site scripting vulnerabilit... |
medium | 5.4 | — | — | 2026-10-03 | 2026-10-06 |
| CVE-2026-104476 Backdrop CMS before 1.35.1 contains an information disclosure vulnerability that... |
medium | 5.9 | — | — | 2026-10-03 | 2026-10-06 |
| CVE-2026-104477 Showdown through 2.1.0 contains a cross-site scripting vulnerability in the make... |
medium | 6.1 | — | — | 2026-10-03 | 2026-10-06 |
| CVE-2026-105048 The Playground feature of Zilliz Attu before 3.0.0 allows SSRF (proxying of requ... |
medium | 4.0 | — | — | 2026-10-02 | 2026-10-06 |
| CVE-2026-105049 Zilliz Attu before 3.0.0 has a Playground feature that does not require authenti... |
medium | 5.8 | — | — | 2026-10-02 | 2026-10-06 |
| CVE-2026-94594 Armatura One's message broker logs client connection credentials and the associa... |
medium | 4.0 | — | — | 2026-10-02 | 2026-10-06 |
| CVE-2026-93474 Charging station authentication identifiers are publicly accessible via web-base... |
medium | 6.5 | — | — | 2026-10-02 | 2026-10-06 |
| CVE-2026-105046 Kentico Xperience 13 before 13.0.216 lacks object-level authorization checks for... |
medium | 4.3 | — | — | 2026-10-02 | 2026-10-06 |
| CVE-2026-82045 UTMStack before 11.2.16 contains a JPQL injection vulnerability that allows auth... |
medium | 6.5 | — | — | 2026-10-02 | 2026-10-06 |
| CVE-2026-82043 UTMStack before 11.2.16 contains an account enumeration vulnerability that allow... |
medium | 5.3 | — | — | 2026-10-02 | 2026-10-06 |
| CVE-2026-104874 Multidict is an implementation of a multidict data structure. |
medium | 5.3 | — | — | 2026-10-02 | 2026-10-06 |
| CVE-2026-82040 UTMStack before 11.2.16 contains a server-side request forgery vulnerability in... |
medium | 5.0 | — | — | 2026-10-02 | 2026-10-06 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.