October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,481
Critical
1,390
High
6,087
Medium
6,446
Low
659
Severity not reported
2,899
In CISA KEV
21
Most affected vendors (by CPE data where available): microsoft (1359), google (759), oracle (376), apple (282), ibm (149), adobe (138), apache (73), imagemagick (72), broadcom (61), freerdp (60)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-116086 A flaw was found in konflux-ci. |
high | 8.8 | — | — | 2026-10-31 | 2026-11-02 |
| CVE-2026-116964 A flaw was found in konflux-ci. |
high | 8.4 | — | — | 2026-10-31 | 2026-11-02 |
| CVE-2026-117681 A flaw was found in konflux-ci. |
high | 8.0 | — | — | 2026-10-31 | 2026-11-02 |
| CVE-2026-120075 The WP Activity Log plugin for WordPress is vulnerable to Stored Cross-Site Scri... |
high | 7.2 | — | — | 2026-10-31 | 2026-11-02 |
| CVE-2026-110530 The FeedWordPress plugin for WordPress is vulnerable to Stored Cross-Site Script... |
high | 7.2 | — | — | 2026-10-31 | 2026-11-02 |
| CVE-2026-120070 The User Frontend – Membership, User Registration, User Profile, User Directory... |
high | 8.8 | — | — | 2026-10-31 | 2026-11-02 |
| CVE-2026-107759 The WPO365 | MICROSOFT 365 GRAPH MAILER plugin for WordPress is vulnerable to St... |
high | 7.2 | — | — | 2026-10-31 | 2026-11-02 |
| CVE-2026-118057 The Shield Security – Smart Bot Blocking, Brute-Force Login Protection & File Sc... |
high | 7.2 | — | — | 2026-10-31 | 2026-11-02 |
| CVE-2026-103898 The Wp Social Login and Register Social Counter plugin for WordPress is vulnerab... |
high | 8.1 | — | — | 2026-10-31 | 2026-11-03 |
| CVE-2026-104012 The Rox Appointment Booking – Appointment Booking Scheduling Solution plugin for... |
high | 8.8 | — | — | 2026-10-31 | 2026-11-02 |
| CVE-2026-120040 The Mail logging & Catcher plugin for WordPress is vulnerable to Sensitive Infor... |
high | 7.5 | — | — | 2026-10-31 | 2026-11-02 |
| CVE-2026-118070 The Welcart e-Commerce plugin for WordPress is vulnerable to Stored Cross-Site S... |
high | 7.2 | — | — | 2026-10-31 | 2026-11-02 |
| CVE-2026-119065 The Shipping Zones by Drawing for WooCommerce plugin for WordPress is vulnerable... |
high | 7.2 | — | — | 2026-10-31 | 2026-11-02 |
| CVE-2026-119089 The ThirstyAffiliates – Affiliate Links, Link Branding, Link Tracking & Marketin... |
high | 7.2 | — | — | 2026-10-31 | 2026-11-02 |
| CVE-2026-119162 The User Submitted Posts – Enable Users to Submit Posts from the Front End plugi... |
high | 7.2 | — | — | 2026-10-31 | 2026-11-02 |
| CVE-2026-119163 The FunnelKit Automations – Email Marketing Automation and CRM for WordPress & W... |
high | 7.5 | — | — | 2026-10-31 | 2026-11-02 |
| CVE-2026-115840 The VikRentCar Car Rental Management System plugin for WordPress is vulnerable t... |
high | 7.2 | — | — | 2026-10-31 | 2026-11-02 |
| CVE-2026-116522 The Relevanssi – A Better Search plugin for WordPress is vulnerable to Stored Cr... |
high | 7.2 | — | — | 2026-10-31 | 2026-11-02 |
| CVE-2026-116548 The VikRentCar Car Rental Management System plugin for WordPress is vulnerable t... |
high | 7.2 | — | — | 2026-10-31 | 2026-11-02 |
| CVE-2026-111254 The W3 Total Cache plugin for WordPress is vulnerable to Stored Cross-Site Scrip... |
high | 7.2 | — | — | 2026-10-31 | 2026-11-02 |
| CVE-2026-107750 The PDF Invoices & Packing Slips for WooCommerce plugin for WordPress is vulnera... |
high | 7.2 | — | — | 2026-10-31 | 2026-11-02 |
| CVE-2026-107653 The SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downlo... |
high | 7.2 | — | — | 2026-10-31 | 2026-11-02 |
| CVE-2026-118638 The Mapster WP Maps WordPress plugin before 2.0.6 does not perform any authoriza... |
high | 7.5 | — | — | 2026-10-31 | 2026-11-02 |
| CVE-2026-119977 WordPress Core is vulnerable to Remote Code Execution in versions 4.7 through 7.... |
high | 8.1 | Listed | Wordpress / wordpress | 2026-10-31 | 2026-11-04 |
| CVE-2026-118043 The Bulk Media Register WordPress plugin before 2.01 does not properly validate... |
high | 7.2 | — | — | 2026-10-31 | 2026-11-02 |
| CVE-2026-118185 The Security Optimizer WordPress plugin before 1.6.9 does not limit the number o... |
high | 7.5 | — | — | 2026-10-31 | 2026-11-02 |
| CVE-2026-116520 The PPWP – Password Protect Pages plugin for WordPress is vulnerable to Stored C... |
high | 7.2 | — | — | 2026-10-31 | 2026-11-02 |
| CVE-2026-109234 The Meow Lightbox plugin for WordPress is vulnerable to Stored Cross-Site Script... |
high | 7.2 | — | — | 2026-10-31 | 2026-11-02 |
| CVE-2026-109997 The Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & A... |
high | 7.2 | — | — | 2026-10-31 | 2026-11-02 |
| CVE-2026-116755 Improper Neutralization of Special Elements used in a Command ('Command Injectio... |
high | 7.4 | — | — | 2026-10-31 | 2026-11-02 |
| CVE-2026-63378 TAKO AI Agent for Okta is a local-first AI agent that helps Okta administrators... |
high | 8.8 | — | — | 2026-10-30 | 2026-11-02 |
| CVE-2026-63338 IXP Manager is a full-stack web application for managing Internet Exchange Point... |
high | 8.3 | — | — | 2026-10-30 | 2026-11-02 |
| CVE-2026-63339 IXP Manager is a full-stack web application for managing Internet Exchange Point... |
high | 8.8 | — | — | 2026-10-30 | 2026-11-05 |
| CVE-2026-63341 Aedes is an MQTT broker that can run on any stream server. |
high | 7.5 | — | — | 2026-10-30 | 2026-11-05 |
| CVE-2026-63182 LightSAML implements SAML 2.0 data model classes, XML serialization and deserial... |
high | 8.1 | — | — | 2026-10-30 | 2026-11-02 |
| CVE-2026-63184 Refitter is a tool for generating a C# REST API client using the Refit library. |
high | 7.1 | — | — | 2026-10-30 | 2026-11-02 |
| CVE-2026-118938 In Trail of Bits fickling through 0.1.12, a pickle STACK_GLOBAL operand carrying... |
high | 8.8 | — | — | 2026-10-30 | 2026-11-02 |
| CVE-2026-16760 In Trail of Bits fickling through 0.1.12, the _process_import() method in fickle... |
high | 8.8 | — | — | 2026-10-30 | 2026-11-02 |
| CVE-2026-111578 The PDF Invoices & Packing Slips for WooCommerce WordPress plugin from 5.16.2 be... |
high | 7.5 | — | — | 2026-10-30 | 2026-11-02 |
| CVE-2026-62990 Shopper is a Headless e-commerce Admin Panel. |
high | 8.7 | — | — | 2026-10-30 | 2026-11-05 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.