October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,481
Critical
1,390
High
6,087
Medium
6,446
Low
659
Severity not reported
2,899
In CISA KEV
21
Most affected vendors (by CPE data where available): microsoft (1359), google (759), oracle (376), apple (282), ibm (149), adobe (138), apache (73), imagemagick (72), broadcom (61), freerdp (60)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-109119 Improper Privilege Management in the user management API endpoint (/api/users/{u... |
high | 8.8 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-96768 The GoSMTP Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting... |
high | 7.2 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-109224 The SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downlo... |
high | 7.2 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-111311 The DoubleScale | All-in-One CRM – Sales, Multi-Channel Marketing, Newsletter, B... |
high | 8.8 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-14177 Observable response discrepancy vulnerability in IKAS Technology Inc. |
high | 7.5 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-92766 The Vitepos – Point of Sale (POS) for WooCommerce plugin for WordPress is vulner... |
high | 7.5 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-75903 The Vulnity Security plugin for WordPress is vulnerable to authentication bypass... |
high | 8.1 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-87111 The User Registration PRO – Custom Registration Form, Login Form, and User Profi... |
high | 7.2 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-16453 Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8... |
high | 7.1 | — | Mattermost / mattermost server | 2026-10-16 | 2026-10-29 |
| CVE-2026-92553 The YaySMTP – WP Mail SMTP with Email Logs, Tracking & Reports plugin for WordPr... |
high | 8.8 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-96339 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-97296 Deserialization of Untrusted Data vulnerability in Rocketgenius, Inc Gravity For... |
high | 8.1 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-97640 The WPConsent – Cookie Banner & Cookie Consent for Privacy Compliance (GDPR / CC... |
high | 7.2 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-92115 The WP Photo Album Plus plugin for WordPress is vulnerable to authenticated Comm... |
high | 8.8 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-110701 The CP Multi View Events Calendar plugin for WordPress is vulnerable to Stored C... |
high | 7.2 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-110015 The Salon Booking System WordPress plugin before 10.31.9 does not correctly veri... |
high | 8.8 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-110135 The OTP Login & Register Woocommerce WordPress plugin before 2.7.3 does not adeq... |
high | 7.4 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-107768 The TranslatePress – Translate Multilingual sites with AI Translation plugin for... |
high | 7.2 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-109193 The HivePress – Business Directory, Listings & Classified Ads Plugin plugin for... |
high | 7.2 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-104715 A flaw was found in cifs-utils. |
high | 7.8 | — | — | 2026-10-16 | 2026-11-04 |
| CVE-2026-95809 The Opti-Behavior – Self-Hosted Heatmaps, Session Recordings, Funnels, A/B Testi... |
high | 7.2 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-96570 The Schema & Structured Data for WP & AMP plugin for WordPress is vulnerable to... |
high | 7.2 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-89051 The WP Ghost (Hide My WP Ghost) – Security & Firewall plugin for WordPress is vu... |
high | 7.2 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-95686 The Opti-Behavior – Self-Hosted Heatmaps, Session Recordings, Funnels, A/B Testi... |
high | 7.2 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-85659 The PilotPress plugin for WordPress is vulnerable to Privilege Escalation via Ac... |
high | 8.8 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-111122 The SiteOrigin CSS plugin for WordPress is vulnerable to Stored DOM-Based Cross-... |
high | 7.2 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-109447 The User Profile Builder – Beautiful User Registration Forms, User Profiles & Us... |
high | 8.1 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-109513 The NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR... |
high | 7.2 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-107764 The SiteOrigin CSS plugin for WordPress is vulnerable to Stored DOM-Based Cross-... |
high | 7.2 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-109232 The Salon Booking System – Appointment Booking for Salons, Barbershops & Spas pl... |
high | 7.2 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-104932 The Search Regex plugin for WordPress is vulnerable to PHP Object Injection in v... |
high | 8.0 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-104000 The Simply Schedule Appointments plugin for WordPress is vulnerable to Stored Cr... |
high | 7.2 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-103896 The 10Web Booster – Website speed optimization, Cache & Page Speed optimizer plu... |
high | 7.5 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-103999 The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to Stored... |
high | 7.2 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-100186 The User Profile Builder – Beautiful User Registration Forms, User Profiles & Us... |
high | 7.2 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-111114 The Nexter Extension – Security, Performance, Code Snippets & Site Toolkit plugi... |
high | 7.5 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-109221 The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress... |
high | 8.1 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-109400 The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vul... |
high | 7.5 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-109998 The Mang Board plugin for WordPress is vulnerable to Stored Cross-Site Scripting... |
high | 7.2 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-110590 The Klarna for WooCommerce plugin for WordPress is vulnerable to authorization b... |
high | 7.5 | — | — | 2026-10-16 | 2026-10-16 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.