October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,481
Critical
1,390
High
6,087
Medium
6,447
Low
659
Severity not reported
2,898
In CISA KEV
21
Most affected vendors (by CPE data where available): microsoft (1359), google (759), oracle (403), apple (294), ibm (149), adobe (138), apache (73), imagemagick (72), broadcom (61), freerdp (60)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-95526 Unauthenticated Broken Access Control in BEAR <= 1.2.2 versions. |
high | 7.3 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-95594 Incorrect Privilege Assignment vulnerability in Cozy Vision Technologies Pvt. |
high | 8.1 | — | — | 2026-10-06 | 2026-10-12 |
| CVE-2026-62072 Subscriber Broken Access Control in Progress Planner <= 1.10.0 versions. |
high | 8.8 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-42634 Unauthenticated Cross Site Scripting (XSS) in Video Background Block – Use video... |
high | 7.1 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-42635 Unauthenticated Cross Site Scripting (XSS) in WooCommerce Simple Auctions <= 3.0... |
high | 7.1 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-42636 Unauthenticated Cross Site Scripting (XSS) in WP Cookie Notice for GDPR, CCPA &... |
high | 7.1 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-42638 Missing Authorization vulnerability in Awesomemotive Easy Digital Downloads easy... |
high | 7.5 | — | — | 2026-10-06 | 2026-10-07 |
| CVE-2026-48197 Incorrect Privilege Assignment vulnerability in PublishPress PublishPress Capabi... |
high | 7.2 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-48199 Unauthenticated Broken Access Control in Sermon'e <= 1.0.2 versions. |
high | 7.5 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-41562 Unauthenticated Sensitive Data Exposure in Norvis Backup <= 1.1.0 versions. |
high | 7.5 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-42413 Unauthenticated Sensitive Data Exposure in Snapshotify – All-in-One Backup & Res... |
high | 7.5 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-42414 Subscriber SQL Injection in ListingPro <= 2.9.12 versions. |
high | 8.5 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-42416 Subscriber SQL Injection in UDesign Core <= 4.15.0 versions. |
high | 8.5 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-42418 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-06 | 2026-10-07 |
| CVE-2026-40806 Unauthenticated Cross Site Scripting (XSS) in Blog, Posts and Category Filter fo... |
high | 7.1 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-40807 Unauthenticated Cross Site Scripting (XSS) in CF7 Views – Complete Entry Managem... |
high | 7.1 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-41559 Unauthenticated Sensitive Data Exposure in SafeSnap – Verified WordPress Backup... |
high | 7.5 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-41560 Unauthenticated Broken Access Control in WXD Backup Lite <= 1.0.2 versions. |
high | 7.5 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-41561 Unauthenticated Sensitive Data Exposure in Museder RestoreOne <= 2.7.276 version... |
high | 7.5 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-39792 Unauthenticated Arbitrary File Deletion in Simple File List <= 6.3.11 versions. |
high | 8.6 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-39793 Subscriber Broken Authentication in Simple JWT Login 4.0.0 versions. |
high | 8.8 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-39794 Unauthenticated Broken Access Control in WooCommerce Multivendor Marketplace – R... |
high | 7.5 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-39796 Unauthenticated Broken Access Control in Advanced Posts Listing – Show Post List... |
high | 7.5 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-39790 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-06 | 2026-10-08 |
| CVE-2026-39774 Unauthenticated Privilege Escalation in Tourfic Pro <= 1.17.3 versions. |
high | 8.8 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-39775 Subscriber Privilege Escalation in JobZilla - Job Board WordPress Theme <= 2.2 v... |
high | 8.8 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-39776 Editor Remote Code Execution (RCE) in Tabs <= 2.5 versions. |
high | 8.0 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-39778 Unauthenticated Cross Site Scripting (XSS) in Ansar Import – One Click Starter S... |
high | 7.1 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-39780 Unauthenticated Cross Site Scripting (XSS) in Youzify <= 1.3.7 versions. |
high | 7.1 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-39781 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-06 | 2026-10-15 |
| CVE-2026-39784 Unauthenticated Cross Site Scripting (XSS) in Hotel Booking <= 3.8 versions. |
high | 7.1 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-39769 Authentication Bypass Using an Alternate Path or Channel vulnerability in Iqonic... |
high | 7.5 | — | — | 2026-10-06 | 2026-10-23 |
| CVE-2026-39771 Subscriber SQL Injection in Buddyboss Platform <= 3.1.0 versions. |
high | 8.5 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-39765 Shop Manager Privilege Escalation in Challan <= 3.7.88 versions. |
high | 7.2 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-39766 Unauthenticated Cross Site Scripting (XSS) in ARForms <= 7.1.2 versions. |
high | 7.1 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-39758 Unauthenticated Cross Site Scripting (XSS) in Midtrans-WooCommerce <= 2.32.3 ver... |
high | 7.1 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-39747 Subscriber SQL Injection in Woffice <= 5.4.35 versions. |
high | 8.5 | — | — | 2026-10-06 | 2026-11-05 |
| CVE-2026-39748 Unauthenticated Cross Site Scripting (XSS) in EduMall <= 4.5.3 versions. |
high | 7.1 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-39750 Unauthenticated Cross Site Scripting (XSS) in StoreGrowth: Smart Sales Booster f... |
high | 7.1 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-39751 Unauthenticated Broken Access Control in PayPlug for WooCommerce (Official) <= 3... |
high | 7.5 | — | — | 2026-10-06 | 2026-10-06 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.