October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
21,928
Critical
3,121
High
7,064
Medium
6,896
Low
608
Severity not reported
4,239
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (722), google (413), ibm (321), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-39734 Unauthenticated Path Traversal in WP EasyPay <= 4.5.4 versions. |
high | 7.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-39786 Unauthenticated Cross Site Scripting (XSS) in BA Book Everything <= 1.8.33 versi... |
high | 7.1 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-54855 Unauthenticated Cross Site Scripting (XSS) in Profile Builder <= 4.0.5 versions. |
high | 7.1 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-73186 Subscriber PHP Object Injection in Enable Media Replace <= 4.2.2 versions. |
high | 8.8 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-94175 Unauthenticated Cross Site Scripting (XSS) in All In One Login <= 2.4.1 versions... |
high | 7.1 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119568 vsftpd through 3.0.5 contains an authentication bypass vulnerability in ssl_data... |
high | 7.4 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-115642 In OpenStack keystonemiddleware before 13.0.2, by supplying a custom X-Service-T... |
high | 8.3 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-97638 The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin f... |
high | 7.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-96894 The ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce plugin for Wo... |
high | 7.2 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-92202 Luxion KeyShot BIP File Parsing Uncontrolled Search Path Element Remote Code Exe... |
high | 7.8 | — | — | 2026-10-21 | 2026-10-30 |
| CVE-2026-89435 The Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Qu... |
high | 8.8 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-90437 The Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Script... |
high | 7.2 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-76012 The Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery plugin for Wor... |
high | 7.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-61989 Unauthenticated Cross Site Scripting (XSS) in Easy Property Listings <= 3.5.25 v... |
high | 7.1 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-61996 Subscriber SQL Injection in MLS On The Fly <= 1.8.1.5 versions. |
high | 8.5 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-54864 Unauthenticated Cross Site Scripting (XSS) in Post Video Players <= 1.165 versio... |
high | 7.1 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-42701 Shop manager PHP Object Injection in YayMail <= 4.4.6 versions. |
high | 7.2 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-27394 Unauthenticated Cross Site Scripting (XSS) in Eventer <= 0.1.1 versions. |
high | 7.1 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-119979 LM Studio before 0.4.22+1 contains a path traversal vulnerability in the model d... |
high | 8.8 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119288 Zuke is a code-first, strongly typed build automation system for Deno. |
high | 7.0 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-118992 CallBackery versions before 0.62.0 for Perl allow OS command execution via sqlit... |
high | 8.4 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-118085 Unauthenticated Cross Site Scripting (XSS) in GlobalPayments WooCommerce <= 1.23... |
high | 7.1 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-118205 The Essential Addons for Elementor – Popular Elementor Templates & Widgets plugi... |
high | 7.4 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-116869 Shop manager PHP Object Injection in myPOS Checkout <= 1.4.5 versions. |
high | 7.2 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-118073 Subscriber PHP Object Injection in News Kit Elementor Addons <= 1.5.0 versions. |
high | 8.8 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-118074 Shop manager PHP Object Injection in Finale Lite <= 2.21.0 versions. |
high | 7.2 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-118077 Author PHP Object Injection in Sastra Essential Addons for Elementor <= 1.2.3 ve... |
high | 7.2 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-118078 Shop manager PHP Object Injection in Product Catalog Feed by PixelYourSite <= 3.... |
high | 7.2 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-118082 Subscriber Privilege Escalation in Buddyboss Platform <= 3.5.0 versions. |
high | 8.8 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-118083 Unauthenticated Sensitive Data Exposure in WP Crowdfunding <= 2.2.2 versions. |
high | 7.5 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-116864 Author PHP Object Injection in WPCargo Track & Trace <= 8.0.5 versions. |
high | 7.2 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-116865 Editor PHP Object Injection in Zippy <= 1.7.0 versions. |
high | 7.2 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-116866 Contributor PHP Object Injection in Extra Fees Plugin for WooCommerce <= 4.4.0 v... |
high | 8.8 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-115887 GraphQL Scalars is a library of custom GraphQL scalars for creating precise type... |
high | 7.5 | — | — | 2026-10-23 | 2026-10-30 |
| CVE-2026-115895 Happy DOM is a JavaScript implementation of a web browser without its graphical... |
high | 8.8 | — | — | 2026-10-23 | 2026-10-30 |
| CVE-2026-115346 The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is v... |
high | 8.1 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-113870 MongoDB Compass improperly escapes certain BSON values when converting a stored... |
high | 8.8 | — | — | 2026-10-21 | 2026-10-30 |
| CVE-2026-114221 NT OneAPP developed by NewType Infortech has a Credential Disclosure vulnerabili... |
high | 7.4 | — | — | 2026-10-22 | 2026-10-30 |
| CVE-2026-113582 UNSUPPORTED WHEN ASSIGNED Improper restriction of XML external entity references... |
high | 7.5 | — | — | 2026-10-22 | 2026-10-30 |
| CVE-2026-112365 The easy.jobs – AI powered Job Listing, Job Board, Career Page, Recruitment & Hi... |
high | 7.2 | — | — | 2026-10-30 | 2026-10-30 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.