October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
21,586
Critical
3,105
High
6,983
Medium
6,767
Low
599
Severity not reported
4,132
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (722), google (410), ibm (321), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (113), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-92975 The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress... |
high | 8.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-100161 The Photo Reviews for WooCommerce plugin for WordPress is vulnerable to Stored D... |
high | 7.2 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-100196 The LazyLoad Plugin – Lazy Load Images, Videos, and Iframes plugin for WordPress... |
high | 7.2 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-94538 The WP File Download plugin for WordPress is vulnerable to authorization bypass... |
high | 8.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-100147 The FunnelKit – Funnel Builder for WooCommerce Checkout plugin for WordPress is... |
high | 7.2 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-100178 The WPAdverts – Classifieds Plugin plugin for WordPress is vulnerable to Stored... |
high | 7.2 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-93746 The WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping... |
high | 7.5 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-93951 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-96662 The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress... |
high | 7.5 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-91136 The Divi Plus plugin for WordPress is vulnerable to Arbitrary File Read in versi... |
high | 7.5 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-97263 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-97264 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-94160 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-78532 Unauthenticated Cross Site Scripting (XSS) in LMS <= 8.3 versions. |
high | 7.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-78534 Unauthenticated Cross Site Scripting (XSS) in Educavo <= 3.4.2 versions. |
high | 7.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-106606 Deserialization of Untrusted Data vulnerability in YITH YITH WooCommerce Affilia... |
high | 7.2 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-93949 Authentication Bypass Using an Alternate Path or Channel vulnerability in Omegat... |
high | 7.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-93950 Missing Authorization vulnerability in StylemixThemes Motors motors allows Explo... |
high | 7.5 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-102388 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-105885 Deserialization of Untrusted Data vulnerability in 10Web Slider by 10Web slider-... |
high | 8.8 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-94676 Deserialization of Untrusted Data vulnerability in Tainacan Community Tainacan t... |
high | 7.2 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-103071 Improper Control of Generation of Code ('Code Injection') vulnerability in Villa... |
high | 7.5 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-106608 Incorrect Privilege Assignment vulnerability in Automattic WooCommerce woocommer... |
high | 7.2 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-106609 Missing Authorization vulnerability in Web Impian Bayarcash WooCommerce bayarcas... |
high | 7.5 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-62044 Deserialization of Untrusted Data vulnerability in bPlugins Super Video Player s... |
high | 7.2 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-57806 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-96341 Incorrect Privilege Assignment vulnerability in WPMU DEV Forminator forminator a... |
high | 8.2 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-27350 Server-Side Request Forgery (SSRF) vulnerability in Builderius.io Builderius all... |
high | 7.2 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-39799 Unauthenticated Cross Site Scripting (XSS) in WP File Download <= 6.3.6 versions... |
high | 7.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-39800 Unauthenticated Cross Site Scripting (XSS) in Additional Order Filters for WooCo... |
high | 7.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-39802 Unauthenticated Remote Code Execution (RCE) in Everest Backup <= 2.3.13 versions... |
high | 8.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-40777 Subscriber Broken Access Control in WPSection <= 1.5.1 versions. |
high | 8.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-40801 Subscriber Broken Access Control in Wordable <= 8.2.10 versions. |
high | 8.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-40802 Subscriber Settings Change in Pubjet | پابجت <= 5.4.8 versions. |
high | 7.6 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-40803 Unauthenticated Cross Site Scripting (XSS) in Jotform – AI Chatbot <= 3.8.2 vers... |
high | 7.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-40805 Subscriber Arbitrary File Deletion in PeepSo <= 9.0.5.4 versions. |
high | 7.7 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-42630 Unauthenticated Sensitive Data Exposure in Web Plura Backup & Restore Manager <=... |
high | 7.5 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-42631 Unauthenticated Cross Site Scripting (XSS) in Qode Music <= 2.1.8.2 versions. |
high | 7.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-42632 Unauthenticated Cross Site Scripting (XSS) in Qode Real Estate <= 1.1.7.3 versio... |
high | 7.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-42633 Subscriber SQL Injection in Events Manager <= 7.4.6 versions. |
high | 8.5 | — | — | 2026-10-10 | 2026-10-13 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.