October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,390
Critical
1,328
High
5,808
Medium
6,216
Low
648
Severity not reported
3,390
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1307), google (756), oracle (156), ibm (140), adobe (138), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-110015 The Salon Booking System WordPress plugin before 10.31.9 does not correctly veri... |
high | 8.8 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-110135 The OTP Login & Register Woocommerce WordPress plugin before 2.7.3 does not adeq... |
high | 7.4 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-107768 The TranslatePress – Translate Multilingual sites with AI Translation plugin for... |
high | 7.2 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-109193 The HivePress – Business Directory, Listings & Classified Ads Plugin plugin for... |
high | 7.2 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-104715 A flaw was found in cifs-utils. |
high | 7.8 | — | — | 2026-10-16 | 2026-10-21 |
| CVE-2026-95809 The Opti-Behavior – Self-Hosted Heatmaps, Session Recordings, Funnels, A/B Testi... |
high | 7.2 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-96570 The Schema & Structured Data for WP & AMP plugin for WordPress is vulnerable to... |
high | 7.2 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-89051 The WP Ghost (Hide My WP Ghost) – Security & Firewall plugin for WordPress is vu... |
high | 7.2 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-95686 The Opti-Behavior – Self-Hosted Heatmaps, Session Recordings, Funnels, A/B Testi... |
high | 7.2 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-85659 The PilotPress plugin for WordPress is vulnerable to Privilege Escalation via Ac... |
high | 8.8 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-111122 The SiteOrigin CSS plugin for WordPress is vulnerable to Stored DOM-Based Cross-... |
high | 7.2 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-109447 The User Profile Builder – Beautiful User Registration Forms, User Profiles & Us... |
high | 8.1 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-109513 The NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR... |
high | 7.2 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-107764 The SiteOrigin CSS plugin for WordPress is vulnerable to Stored DOM-Based Cross-... |
high | 7.2 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-109232 The Salon Booking System – Appointment Booking for Salons, Barbershops & Spas pl... |
high | 7.2 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-104932 The Search Regex plugin for WordPress is vulnerable to PHP Object Injection in v... |
high | 8.0 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-104000 The Simply Schedule Appointments plugin for WordPress is vulnerable to Stored Cr... |
high | 7.2 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-103896 The 10Web Booster – Website speed optimization, Cache & Page Speed optimizer plu... |
high | 7.5 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-103999 The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to Stored... |
high | 7.2 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-100186 The User Profile Builder – Beautiful User Registration Forms, User Profiles & Us... |
high | 7.2 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-111114 The Nexter Extension – Security, Performance, Code Snippets & Site Toolkit plugi... |
high | 7.5 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-109221 The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress... |
high | 8.1 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-109400 The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vul... |
high | 7.5 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-109998 The Mang Board plugin for WordPress is vulnerable to Stored Cross-Site Scripting... |
high | 7.2 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-110590 The Klarna for WooCommerce plugin for WordPress is vulnerable to authorization b... |
high | 7.5 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-103525 The FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler plugin for... |
high | 7.5 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-103895 The miniOrange OTP Login, Verification and SMS Notifications plugin for WordPres... |
high | 8.1 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-107659 The Modula Image Gallery – Photo Grid & Video Gallery plugin for WordPress is vu... |
high | 7.5 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-107746 The FunnelKit – Funnel Builder for WooCommerce Checkout plugin for WordPress is... |
high | 7.5 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-97339 The Complianz GDPR/CCPA Cookie Consent Banner plugin for WordPress is vulnerable... |
high | 7.2 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-93953 The Backuply – Backup, Restore, Migrate and Clone plugin for WordPress is vulner... |
high | 8.0 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-111451 Wheels CLI 4.0.0 through 4.1.1 insufficiently validates or escapes caller-suppli... |
high | 7.8 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-111445 Wheels 4.0.0 through 4.1.2 before 4.2.0 replaces incoming scope conditions with... |
high | 8.1 | — | — | 2026-10-16 | 2026-10-19 |
| CVE-2026-111446 Wheels 4.0.0 through 4.1.2 exposes password-less development tools under /wheels... |
high | 8.6 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-111447 Wheels 1.1 through 4.1.2 resolves nestedProperties() records by posted primary k... |
high | 8.1 | — | — | 2026-10-16 | 2026-10-21 |
| CVE-2026-109207 The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video... |
high | 7.2 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-109990 The Flying Scripts: Delay JavaScript to Improve Site Speed & Performance plugin... |
high | 7.2 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-107758 The Colibri Page Builder plugin for WordPress is vulnerable to Stored Cross-Site... |
high | 7.2 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-104745 The Customer Email Verification for WooCommerce plugin for WordPress is vulnerab... |
high | 8.1 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-111389 Frappe HRMS 14.x before 14.38.2, 15.x before 15.64.0, and 16.x before 16.18.0 co... |
high | 7.7 | — | — | 2026-10-16 | 2026-10-18 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.