CVEs published in October 2026
17,265 vulnerabilities, 1,627 critical, 21 exploited.
- mycredWordPress myCred plugin <= 4.0.1 - Bypass Vulnerability vulnerability4.3 Medium
- oceanwpWordPress OceanWP theme <= 4.2.7 - Cross Site Scripting (XSS) vulnerability7.1 High
- buddypressWordPress BuddyPress plugin <= 14.5.2 - SQL Injection vulnerability8.5 High
- thimpress learnpressWordPress LearnPress plugin <= 4.4.11 - Broken Access Control vulnerability7.5 High
- eyal fitoussi geo my wordpressWordPress GEO my WordPress plugin <= 4.5.5.5 - Broken Access Control vulnerability7.5 High
- villatheme handmade – dropshipping for etsy and woocommerceWordPress HANDMADE – Dropshipping for Etsy and WooCommerce plugin <= 1.0.10 - Broken Access Control vulnerability7.1 High
- hamid alinia login with phone numberWordPress Login with phone number plugin <= 1.8.78 - Broken Authentication vulnerability8.8 High
- videowhisper broadcast live videoWordPress Broadcast Live Video plugin <= 7.3.9 - Broken Access Control vulnerability7.1 High
- webtoffee product import export for woocommerceWebToffee Product Import Export for WooCommerce 2.5.1 before 2.6.8 SSRF via Redirects5.1 Medium
- hashgraph guardian, nozomi networks cmc +1 moreAuthenticated RCE in update functionality in Guardian/CMC before 26.4.07.5 High
- hashgraph guardian, nozomi networks cmc +1 moreUpdate bundle signature bypass in Guardian/CMC before 26.4.07.5 High
- cheaper-inference omnirouteOmniRoute 3.8.0 before 3.8.52 Unverified Password Change via /api/settings/require-login7.0 High
- apache software foundation camelApache Camel: Camel-A2A Push Notification Webhook Guard Accepts IPv6 Unique Local Addresses Reached Through a Host Name4.8 Medium
- apache software foundation qpid proton cApache Qpid Proton C: Verifying non compliant TLS wildcard cert can cause stack buffer overflow read7.5 High
- apache software foundation qpid proton cApache Qpid Proton C: Potential authentication bypass: regular AMQP frames can be sent as SASL frames9.8 Critical
- apache software foundation qpid proton cApache Qpid Proton C: Unbounded recursion in parsing AMQP message bodies can lead to crash9.8 Critical
- apache software foundation qpid proton cApache Qpid Proton C: The OpenSSL TLS implementation adds a locally trusted certificate authority to the existing trusted system trust anchors.9.1 Critical
qemuAlpaquita,qemu-hweUbuntu +1 more[Unknown description]No scoreqemuAlpaquita,qemu-hweUbuntu +1 more[Unknown description]No scoreqemuAlpaquita,qemu-hweUbuntu +1 more[Unknown description]No scoreqemuAlpaquita,qemu-hweUbuntu +1 more[Unknown description]No scoreqemuAlpaquita,qemu-hweUbuntu +1 more[Unknown description]No scoreqemuAlpaquita,qemu-hweUbuntu +1 more[Unknown description]No scoreqemuAlpaquita,qemu-hweUbuntu +1 more[Unknown description]No score- foxit software inc. foxit.comCross-user Document Access on Foxit Official Website's HTML-to-PDF Service7.5 High
- foxit software inc. foxit.comSSRF and JavaScript Execution in the Foxit Official Website's HTML-to-PDF Service7.5 High
- foxit software inc. foxit.comHardcoded API Token in Foxit Official Website8.6 High
- checkmk gmbh checkmkTrust of compromised eMudhra root CA in bundled CA stores7.1 High
- devitemsllc ht mega addons for elementor – elementor widgets & template builderHT Mega Addons for Elementor <= 3.2.7 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Tabs Widget href DOM Sink5.4 Medium
- wpeverest everest forms – contact form, payment form, quiz, survey & custom form builder with aiEverest Forms <= 3.6.2 - Unauthenticated Sensitive Information Exposure via Smart-Tag Injection in Smart-Tag Injection in Form Field Values ({post_meta key=...})5.3 Medium
- litespeedtech litespeed cacheLiteSpeed Cache <= 7.9.1 - Unauthenticated Stored Cross-Site Scripting via HTML Minifier Predictable Placeholder (md5(REQUEST_TIME) + two-pass str_replace)5.4 Medium
- mapster wp mapsMapster WP Maps <= 2.0.5 - Unauthenticated Stored Cross-Site Scripting via 'config.loading.background' Parameter7.2 High
- litespeedtech litespeed cacheLiteSpeed Cache <= 7.9.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via VPI Image Attribute Re-Serialization6.4 Medium
- berocket sequential order numbers for woocommerceSequential Order Numbers for WooCommerce <= 3.6.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'condition' Post Meta Array Keys6.4 Medium
- wpeverest everest forms – contact form, payment form, quiz, survey & custom form builder with aiEverest Forms <= 3.6.2 - Reflected Cross-Site Scripting via 'evf_toast_type' Parameter6.1 Medium
- wpsoul greenshift – animation and page builder blocksGreenshift <= 13.2.1 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Comment Content via Split Text innerText5.4 Medium
- wpsoul greenshift – animation and page builder blocksGreenshift <= 13.2.1 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Comment Content via Nested Latest Comments Block5.4 Medium
- themeisle rss aggregator by feedzy – feed to post, autoblogging, news & youtube video feeds aggregatorRSS Aggregator by Feedzy <= 5.2.12 - Unauthenticated Stored Cross-Site Scripting via YouTube media:description Feed Element4.7 Medium
- david lingren media library assistantMedia Library Assistant <= 3.42 - Reflected Cross-Site Scripting via 'search-string' Parameter via {+request:...+} in Pagination Links4.7 Medium
- beardev joomsport – for sports: team & league, football, hockey & moreJoomSport <= 5.7.11 - Authenticated (Contributor+) SQL Injection via 'team_id' Shortcode Attribute6.5 Medium
- hupe13 extensions for leaflet mapExtensions for Leaflet Map <= 5.4 - Unauthenticated Stored DOM-Based Cross-Site Scripting via External GeoJSON Property5.4 Medium
- kaspersky network agent, administration server +1 moreKaspersky has fixed a vulnerability in the Network Agent for Windows module of Kaspersky Security...6.2 Medium
- ict innovations innovations’ php-cgi/php-fpm configurationReflected Cross-Site Scripting in ICT Innovations’ PHP-CGI/PHP-FPM configuration5.1 Medium
- radius synergies xenia m2m platformSQL Injection Vulnerability in Radius Xenia M2M Platform9.3 Critical
- supsysticcom contact form by supsysticContact Form by Supsystic < 1.11.1 - Unauthenticated CRLF / Email Header Injection via Reply-To Field Mapping3.7 Low
- qnap systems inc. hbs 3 hybrid backup sync, hybrid backup sync +1 moreHard-coded Cryptographic Key #28.7 High
- qnap systems inc. hbs 3 hybrid backup sync, hybrid backup sync +1 moreHard-coded Cryptographic Key #18.7 High
- red hat build of keycloak, single sign-on 7 +1 moreKeycloak-services: keycloak-services: hotp race condition allows single otp code reuse across concurrent logins4.2 Medium
- red hat build of keycloak, single sign-on 7 +1 moreKeycloak-services: keycloak-services: par single-use bypass via flow restart5.4 Medium
- red hat build of keycloak, single sign-on 7 +1 moreKeycloak-services: keycloak-services: vault secret disclosure via client registration installation configuration5.3 Medium
- Show moreLoading…