October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,481
Critical
1,390
High
6,087
Medium
6,447
Low
659
Severity not reported
2,898
In CISA KEV
21
Most affected vendors (by CPE data where available): microsoft (1359), google (759), oracle (403), apple (300), ibm (149), adobe (138), apache (73), imagemagick (72), broadcom (61), freerdp (60)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-39752 Contributor Arbitrary File Deletion in Jobs for WordPress <= 2.8.2 versions. |
high | 7.7 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-39728 Unauthenticated Server Side Request Forgery (SSRF) in Instapage Plugin <= 3.7.2... |
high | 7.2 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-39729 Unauthenticated Sensitive Data Exposure in Edwiser Bridge <= 4.3.4 versions. |
high | 7.2 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-39730 Missing Authorization vulnerability in Marcin Wise Chat wise-chat allows Exploit... |
high | 7.1 | — | — | 2026-10-06 | 2026-10-07 |
| CVE-2026-39731 Unauthenticated Cross Site Scripting (XSS) in Database for CF7 <= 1.2.6 versions... |
high | 7.1 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-39745 Unauthenticated Cross Site Scripting (XSS) in Contact Form to DB by BestWebSoft... |
high | 7.1 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-39719 Unauthenticated Server Side Request Forgery (SSRF) in PDF Smart Viewer for Eleme... |
high | 7.2 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-39720 Unauthenticated Cross Site Scripting (XSS) in Mapster WP Maps <= 2.0.4 versions. |
high | 7.1 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-39722 Unauthenticated Cross Site Scripting (XSS) in WPLMS <= 4.972 versions. |
high | 7.1 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-39724 Unauthenticated Cross Site Scripting (XSS) in HTTP Requests Manager <= 1.3.11 ve... |
high | 7.1 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-39726 Unauthenticated Cross Site Scripting (XSS) in Lumise Product Designer <= 2.1.1 v... |
high | 7.1 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-32574 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-06 | 2026-10-13 |
| CVE-2026-32575 Unauthenticated Cross Site Scripting (XSS) in SUMO Affiliates Pro <= 11.7.0 vers... |
high | 7.1 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-32577 Unauthenticated Cross Site Scripting (XSS) in Frontend File Manager <= 23.6 vers... |
high | 7.1 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-32578 Subscriber Broken Access Control in ECPay Ecommerce for WooCommerce <= 1.1.26060... |
high | 7.1 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-32580 Unauthenticated SQL Injection in WooCommerce Lottery <= 2.2.9 versions. |
high | 7.5 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-32581 Subscriber SQL Injection in Mooberry Book Manager 4.16.2 versions. |
high | 7.1 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-32569 Unauthenticated Cross Site Scripting (XSS) in WP Media folder <= 6.2.2 versions. |
high | 7.1 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-32570 Unauthenticated Cross Site Scripting (XSS) in Progressify - Progressive Web App... |
high | 7.1 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-32572 Unauthenticated Cross Site Scripting (XSS) in WP User Frontend Pro <= 4.2.13 ver... |
high | 7.1 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-105317 Subscriber SQL Injection in Paid Member Subscriptions <= 3.1.1 versions. |
high | 8.5 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-25433 Subscriber Broken Access Control in WP2LEADS <= 3.5.7 versions. |
high | 7.1 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-25434 Subscriber SQL Injection in WP2LEADS <= 3.5.7 versions. |
high | 8.5 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-105058 Subscriber Privilege Escalation in WP User Profiles <= 2.7.3 versions. |
high | 8.8 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-105061 Unauthenticated Cross Site Scripting (XSS) in WP Mailster <= 1.9.0.0 versions. |
high | 7.1 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-105070 Unauthenticated Privilege Escalation in Salon booking system <= 10.31.7 versions... |
high | 8.8 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-105071 Unauthenticated Sensitive Data Exposure in SiteVault – Backup, Restore, Migratio... |
high | 7.5 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-104405 Unauthenticated Privilege Escalation in GiveWP <= 4.17.0 versions. |
high | 8.1 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-104406 Unauthenticated Broken Access Control in picu <= 3.10.1 versions. |
high | 7.3 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-104670 Unauthenticated Cross Site Scripting (XSS) in LearnPress <= 4.4.9 versions. |
high | 7.1 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-104672 Unauthenticated Cross Site Scripting (XSS) in GiveWP <= 4.17.0 versions. |
high | 7.1 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-104747 Unauthenticated PHP Object Injection in Haaken <= 1.5 versions. |
high | 8.1 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-104757 Editor Privilege Escalation in Import and export users and customers <= 2.5.5 ve... |
high | 7.2 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-104814 Unauthenticated Cross Site Scripting (XSS) in Form Block <= 1.8.1 versions. |
high | 7.1 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-104387 Unauthenticated Broken Access Control in PowerPress Podcasting <= 11.17.9 versio... |
high | 7.2 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-104394 Unauthenticated Cross Site Scripting (XSS) in Charitable <= 1.8.12.3 versions. |
high | 7.1 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-104395 Unauthenticated Cross Site Scripting (XSS) in picu <= 3.10.1 versions. |
high | 7.1 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-102387 Unauthenticated Sensitive Data Exposure in Xserver Migrator <= 1.6.6 versions. |
high | 7.5 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-102915 Subscriber Broken Access Control in WPO365 <= 44.1 versions. |
high | 8.5 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-103346 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-06 | 2026-10-06 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.