October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,481
Critical
1,390
High
6,087
Medium
6,446
Low
659
Severity not reported
2,899
In CISA KEV
21
Most affected vendors (by CPE data where available): microsoft (1359), google (759), oracle (403), apple (286), ibm (149), adobe (138), apache (73), imagemagick (72), broadcom (61), freerdp (60)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-91829 The Subscribe to Comments WordPress plugin before 2.3.3 does not properly valida... |
high | 7.1 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-96227 The Piotnet Forms WordPress plugin through 1.0.30 does not authenticate or valid... |
high | 8.8 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-89232 The Recordbrowser WordPress plugin through 1.1.7 does not sanitise and escape a... |
high | 8.6 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-89234 The WP-Partner WordPress plugin through 1.2.1 does not sanitise and escape a par... |
high | 8.6 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-89283 The WP Posts Password Batch Manager WordPress plugin through 1.1 does not perfor... |
high | 8.6 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-89285 The Datalist it WordPress plugin through 0.0.3 does not sanitize and escape seve... |
high | 8.6 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-89287 The ASPL Product Quotation WordPress plugin through 1.1.0 does not sanitize and... |
high | 8.6 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-89297 The Loja Automática WordPress plugin through 1.0.0 does not properly sanitize an... |
high | 8.6 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-89299 The WP Verify API WordPress plugin through 1.0.0 does not properly sanitize and... |
high | 8.6 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-89302 The Post Voting System WordPress plugin through 1.0 does not properly sanitize a... |
high | 8.6 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-88826 The SmugMug Embed WordPress plugin through 3.13 does not have authorisation or C... |
high | 8.8 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-88827 The Disable Users WordPress plugin through 1.0.5 does not enforce its account-di... |
high | 8.8 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-88903 The Topcontent WordPress plugin through 1.2.1 does not properly authorise one of... |
high | 8.8 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-88905 The KeyWord Collector WordPress plugin through 1.4 does not have any authorisati... |
high | 8.8 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-88930 The Social Web Suite WordPress plugin through 4.1.12 does not require its shared... |
high | 8.6 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-89195 The Site Setup Wizard WordPress plugin through 1.5.8 does not properly sanitise... |
high | 8.6 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-89213 The Llavero.io WordPress plugin through 0.1.4 does not properly sanitise and esc... |
high | 8.6 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-89214 The WpCues Basic Quiz WordPress plugin through 1.6.5 does not properly sanitise... |
high | 8.6 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-85126 The Crowdfundly WordPress plugin through 2.2.2 does not have capability checks o... |
high | 7.2 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-86798 The HootBoard WordPress plugin through 3.1.4 does not perform any authorisation... |
high | 8.8 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-87760 The Web Vitals Tracking WordPress plugin through 5.4.2 does not validate or esca... |
high | 8.8 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-87761 The Adwised Web Push Notification WordPress plugin through 2.5.7 does not perfor... |
high | 8.0 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-87762 The Adwised Web Push Notification WordPress plugin through 2.5.7 does not have a... |
high | 8.8 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-87764 The BuddyPress Instant Chat WordPress plugin through 1.6 does not check that the... |
high | 8.8 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-84258 The click5 CRM add-on to Ninja Forms WordPress plugin through 1.0.1 does not san... |
high | 8.8 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-84259 The click5 CRM add-on to WPForms WordPress plugin through 1.0.3 does not sanitis... |
high | 8.8 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-84260 The click5 CRM add-on to Gravity Forms WordPress plugin through 1.0.3 does not s... |
high | 8.8 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-84261 The click5 CRM add-on to Contact Form 7 WordPress plugin through 1.0.4 does not... |
high | 8.8 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-14854 The WooCommerce Bookings WordPress plugin before 3.11.0 does not limit a user-su... |
high | 7.5 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-81420 The Tcard WP WordPress plugin through 1.8.0 does not sanitise and escape a param... |
high | 8.6 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-103694 The Mobile builder WordPress plugin through 1.4.2 does not properly restrict whi... |
high | 8.8 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-103695 The Mobile builder WordPress plugin through 1.4.2 does not sanitise and escape a... |
high | 8.6 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-104680 The Envira Gallery WordPress plugin before 1.16.2 does not verify that a user ho... |
high | 7.2 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-106029 The WeddingCity Lite WordPress plugin through 1.0.4 does not perform any authori... |
high | 7.5 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-103305 The Prenotazioni WordPress plugin through 1.7.5 does not have authorisation and... |
high | 8.8 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-108522 A vulnerability was found in Studio-Saelix Sencho up to 0.94.1. |
high | 8.3 | — | — | 2026-10-11 | 2026-10-14 |
| CVE-2026-108708 Wukong_HRM through commit 186115e contains a missing authorization vulnerability... |
high | 8.8 | — | — | 2026-10-11 | 2026-10-16 |
| CVE-2026-108693 ImageMagick on Windows through 7.1.2-33 and 6.9.13-58 contains an uncontrolled s... |
high | 7.8 | — | Imagemagick / imagemagick | 2026-10-11 | 2026-11-03 |
| CVE-2026-108695 MultiVendorX WordPress plugin through 5.0.19 contains an incorrect authorization... |
high | 7.1 | — | — | 2026-10-11 | 2026-10-16 |
| CVE-2026-108657 JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the Sy... |
high | 8.1 | — | — | 2026-10-10 | 2026-10-18 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.