October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,481
Critical
1,390
High
6,087
Medium
6,446
Low
659
Severity not reported
2,899
In CISA KEV
21
Most affected vendors (by CPE data where available): microsoft (1359), google (759), oracle (376), apple (282), ibm (149), adobe (138), apache (73), imagemagick (72), broadcom (61), freerdp (60)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-105106 Koha is vulnerable to OS command injection in the Task Scheduler deletion path. |
high | 8.8 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-105107 Koha is vulnerable to SQL injection in the Most-circulated items report. |
high | 7.6 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-100163 The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress... |
high | 7.4 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-103366 The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress... |
high | 7.5 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-103367 The ShopMagic – email automation for WordPress plugin for WordPress is vulnerabl... |
high | 8.1 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-89288 The Fast Courier WordPress plugin before 5.2.4 does not sanitize and escape a va... |
high | 8.6 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-86787 The affiliate-toolkit WordPress plugin before 3.9.1 does not prevent a low-privi... |
high | 7.2 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-86799 The Forms WordPress plugin before 3.0.2 does not sanitise submitted form values... |
high | 8.8 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-107126 The WP Booking System WordPress plugin before 2.1.0.1 does not sanitise and esca... |
high | 8.8 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-107508 The Ultimate Multisite WordPress plugin before 2.17.2 does not validate a user-s... |
high | 8.6 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-103307 The Walletdoc Payment Gateway for WooCommerce WordPress plugin before 1.8.5 does... |
high | 8.6 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-110459 A malicious actor with access to the network could exploit an Improper Access Co... |
high | 8.6 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-50218 Akamai GPA (Guardicore Platform Agent) client on all platforms before 7.4 improp... |
high | 8.5 | — | — | 2026-10-14 | 2026-10-19 |
| CVE-2026-110455 A malicious actor with access to the network and under certain conditions could... |
high | 8.1 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-106931 EG Secure Solutions SiteGuard Server Edition OS Command Injection Vulnerability |
high | 7.8 | Listed | EG Secure Solutions / SiteGuard Server Edition | 2026-10-14 | 2026-10-21 |
| CVE-2026-105429 Improper neutralization of special elements in the NetBird client SSH configurat... |
high | 8.0 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-110450 Nix before 2.35.3 and Lix before 2.95.4 allow privilege escalation via a repair... |
high | 8.0 | — | — | 2026-10-14 | 2026-10-19 |
| CVE-2026-101924 The NewStatPress plugin for WordPress is vulnerable to Stored Cross-Site Scripti... |
high | 7.2 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-97398 The FV Flowplayer Video Player plugin for WordPress is vulnerable to Stored Cros... |
high | 7.2 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-96661 The Gmedia Photo Gallery plugin for WordPress is vulnerable to time-based SQL In... |
high | 7.5 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-95808 The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugi... |
high | 7.5 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-95816 The Smart Forms – when you need more than just a contact form plugin for WordPre... |
high | 7.2 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-94377 The Verified Reviews (Avis Vérifiés) plugin for WordPress is vulnerable to Store... |
high | 7.2 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-93885 The Cryptocurrency Donation Box – Bitcoin & Crypto Donations plugin for WordPres... |
high | 7.2 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-83592 The Contact Form DB for Enfold plugin for WordPress is vulnerable to Stored Cros... |
high | 7.2 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-77114 The Document Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scr... |
high | 7.2 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-78193 The JTL-Connector for WooCommerce plugin for WordPress is vulnerable to time-bas... |
high | 7.5 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-110449 Nix before 2.35.3 and Lix before 2.95.4 have an integer overflow and resultant o... |
high | 7.5 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-100153 The NewStatPress plugin for WordPress is vulnerable to Stored Cross-Site Scripti... |
high | 7.2 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-14765 Epic Games Unreal Engine versions up to and including 5.8.0 ship with an insecur... |
high | 7.7 | — | — | 2026-10-14 | 2026-10-18 |
| CVE-2026-110444 TeamPlus Messenger developed by Teamplus Technology has a Code Injection vulnera... |
high | 8.8 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-110445 TeamPlus Messenger developed by Teamplus Technology has a Code Injection vulnera... |
high | 8.8 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-103422 The AnyComment plugin for WordPress is vulnerable to Stored Cross-Site Scripting... |
high | 7.2 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-102251 The Abandoned Cart Pro for WooCommerce plugin for WordPress is vulnerable to gen... |
high | 7.5 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-82715 Insecure Temporary File vulnerability in Hitachi Disk Array Driver for AIX and H... |
high | 7.9 | — | — | 2026-10-14 | 2026-10-18 |
| CVE-2026-17092 The Directorist: AI-Powered Business Directory, Listings & Classified Ads plugin... |
high | 8.1 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-104749 The Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email... |
high | 7.5 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-104767 The Membership & User Roles for WooCommerce (Automatic Role Changer) plugin for... |
high | 7.5 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-104995 The BP Profile Search plugin for WordPress is vulnerable to Local File Inclusion... |
high | 8.1 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-103423 The Booking Package plugin for WordPress is vulnerable to authorization bypass i... |
high | 7.5 | — | — | 2026-10-14 | 2026-10-14 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.