October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,481
Critical
1,390
High
6,087
Medium
6,446
Low
659
Severity not reported
2,899
In CISA KEV
21
Most affected vendors (by CPE data where available): microsoft (1359), google (759), oracle (403), apple (293), ibm (149), adobe (138), apache (73), imagemagick (72), broadcom (61), freerdp (60)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-108546 Spotweb through 1.5.8 contains an OS command injection vulnerability in the runc... |
high | 7.5 | — | — | 2026-10-10 | 2026-10-16 |
| CVE-2026-108548 AstronRPA through 1.1.6 contains an authentication bypass vulnerability in the O... |
high | 7.3 | — | — | 2026-10-10 | 2026-10-16 |
| CVE-2026-108549 cc-connect through 1.5.0 contains a missing authentication vulnerability in the... |
high | 8.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-94676 Deserialization of Untrusted Data vulnerability in Tainacan Community Tainacan t... |
high | 7.2 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-97263 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-97264 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-105885 Deserialization of Untrusted Data vulnerability in 10Web Slider by 10Web slider-... |
high | 8.8 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-108161 FusionPBX through 5.6.5 contains an OS command injection vulnerability in call_r... |
high | 7.5 | — | — | 2026-10-10 | 2026-10-16 |
| CVE-2026-102388 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-107794 ExtUtils::Typemaps::STL::List versions before 1.07 for Perl allocate a 32 GiB ar... |
high | 7.5 | — | — | 2026-10-10 | 2026-10-16 |
| CVE-2013-10076 ExtUtils::Typemaps::STL::Vector versions before 1.05 for Perl allocate a 32 GiB... |
high | 7.5 | — | — | 2026-10-10 | 2026-10-16 |
| CVE-2026-103636 Out-of-bounds read in the VarOpt union deserialization of Apache DataSketches C+... |
high | 7.5 | — | — | 2026-10-10 | 2026-10-16 |
| CVE-2026-91136 The Divi Plus plugin for WordPress is vulnerable to Arbitrary File Read in versi... |
high | 7.5 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-107657 The HivePress – Business Directory, Listings & Classified Ads Plugin plugin for... |
high | 7.2 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-96662 The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress... |
high | 7.5 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-96765 The WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) plugin... |
high | 7.2 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-93949 Authentication Bypass Using an Alternate Path or Channel vulnerability in Omegat... |
high | 7.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-93950 Missing Authorization vulnerability in StylemixThemes Motors motors allows Explo... |
high | 7.5 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-93951 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-96278 The WP Photo Album Plus plugin for WordPress is vulnerable to Stored Cross-Site... |
high | 7.2 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-104759 The WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) plugin... |
high | 8.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-106606 Deserialization of Untrusted Data vulnerability in YITH YITH WooCommerce Affilia... |
high | 7.2 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-93746 The WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping... |
high | 7.5 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-100178 The WPAdverts – Classifieds Plugin plugin for WordPress is vulnerable to Stored... |
high | 7.2 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-101920 The Molongui Authorship – Author Boxes, Guest Authors & Co-Authors for WordPress... |
high | 7.2 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-100147 The FunnelKit – Funnel Builder for WooCommerce Checkout plugin for WordPress is... |
high | 7.2 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-94538 The WP File Download plugin for WordPress is vulnerable to authorization bypass... |
high | 8.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-95684 The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to... |
high | 7.2 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-96558 The Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker plugin for WordPres... |
high | 7.2 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-96572 The WP Meteor Website Speed Optimization Addon plugin for WordPress is vulnerabl... |
high | 7.2 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-96840 The Post Grid Gutenberg Blocks – PostX plugin for WordPress is vulnerable to Sto... |
high | 7.2 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-12626 The Online Scheduling and Appointment Booking System – Bookly plugin for WordPre... |
high | 7.2 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-107742 The 10Web Booster – Website speed optimization, Cache & Page Speed optimizer plu... |
high | 7.2 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-100196 The LazyLoad Plugin – Lazy Load Images, Videos, and Iframes plugin for WordPress... |
high | 7.2 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-100161 The Photo Reviews for WooCommerce plugin for WordPress is vulnerable to Stored D... |
high | 7.2 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-96667 The Real Estate Manager – Property Listing and Agent Management plugin for WordP... |
high | 7.2 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-96682 The Presto Player plugin for WordPress is vulnerable to Stored Cross-Site Script... |
high | 7.2 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-92975 The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress... |
high | 8.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-93775 The Podlove Podcast Publisher plugin for WordPress is vulnerable to Stored Cross... |
high | 7.2 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-94256 The SMS Alert WordPress plugin before 4.0.1 does not verify that the account bei... |
high | 8.1 | — | — | 2026-10-10 | 2026-10-13 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.