CVEs published in October 2026
17,265 vulnerabilities, 1,627 critical, 21 exploited.
- wedevs happy addons for elementorWordPress Happy Addons for Elementor plugin <= 3.50.1 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- magepeople inc. taxi booking manager for woocommerceWordPress Taxi Booking Manager for WooCommerce plugin <= 2.1.6 - Broken Access Control vulnerability5.3 Medium
- wpfunnelsWordPress WPFunnels plugin <= 3.13.5 - Broken Access Control vulnerability5.3 Medium
- bplugins streamcastWordPress StreamCast plugin <= 2.4.6 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- brainstorm force suredashWordPress SureDash plugin <= 1.12.3 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- wp desk flexible quantity – measurement price calculator for woocommerceWordPress Flexible Quantity – Measurement Price Calculator for WooCommerce plugin <= 2.3.24 - Broken Access Control vulnerability5.3 Medium
- crocoblock jetelements for elementorWordPress JetElements For Elementor plugin <= 2.9.2.6 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- wpfunnelsWordPress WPFunnels plugin <= 3.13.5 - Broken Access Control vulnerability5.3 Medium
- brainstorm force sureformsWordPress SureForms plugin <= 2.12.9 - Broken Access Control vulnerability5.3 Medium
- kadence wp gutenberg blocks by kadence blocksWordPress Gutenberg Blocks by Kadence Blocks plugin <= 3.8.0.2 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- publishpress authorsWordPress PublishPress Authors plugin <= 4.17.0 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- stylemix masterstudy lmsWordPress MasterStudy LMS plugin <= 3.7.55 - Broken Access Control vulnerability4.3 Medium
- webba appointment booking bookingWordPress Webba Booking plugin <= 6.5.4 - Broken Access Control vulnerability4.3 Medium
- wedevs wp user frontendWordPress WP User Frontend plugin <= 4.3.13 - Broken Access Control vulnerability4.3 Medium
- wp user manager user managerWordPress WP User Manager plugin <= 2.9.26 - Broken Access Control vulnerability5.3 Medium
- wedevs wp user frontendWordPress WP User Frontend plugin <= 4.3.13 - Broken Access Control vulnerability5.3 Medium
- stylemix masterstudy lms wordpress pluginMasterStudy LMS WordPress Plugin < 3.7.50 Missing Authorization via stm_lms_send_test_email_ajax5.3 Medium
- stylemix masterstudy lms wordpress pluginMasterStudy LMS WordPress Plugin < 3.7.50 Path Traversal via stm_lms_step Parameter5.3 Medium
- elastic cloud enterpriseImproper Link Resolution Before File Access ('Link Following') in Elastic Cloud Enterprise (ECE) Leading to Information Disclosure and Data Modification7.5 High
- elastic cloud enterpriseIncorrect Authorization in Elastic Cloud Enterprise (ECE) Leading to Unauthorized Modification of Platform Settings4.3 Medium
- elastic cloud enterpriseInsertion of Sensitive Information into Externally-Accessible File or Directory in Elastic Cloud Enterprise (ECE) Leading to Credential Disclosure6.4 Medium
- elastic cloud enterpriseImproper Link Resolution Before File Access ('Link Following') in Elastic Cloud Enterprise (ECE) Leading to Information Disclosure and Data Loss8.2 High
- elastic cloud enterpriseImproper Link Resolution Before File Access ('Link Following') in Elastic Cloud Enterprise (ECE) Leading to Authentication Bypass7.2 High
- elastic cloud enterpriseInsertion of Sensitive Information into Externally-Accessible File or Directory in Elastic Cloud Enterprise (ECE) Leading to Privilege Escalation6.4 Medium
- elastic cloud enterpriseAuthorization Bypass Through User-Controlled Key in Elastic Cloud Enterprise (ECE) Leading to Privilege Escalation6.8 Medium
- crocoblock jetengineWordPress JetEngine plugin <= 3.9.0.1 - SQL Injection vulnerability8.5 High
- brainstorm force sureformsWordPress SureForms plugin <= 2.12.9 - Content Injection vulnerability5.3 Medium
- red hat build of keycloak, single sign-on 7 +1 moreKeycloak-services: keycloak-services: redirect uri domain allowlist bypass via dns resolution to loopback6.8 Medium
- braveWordPress Brave plugin <= 0.8.8 - Content Injection vulnerability5.3 Medium
- kaliforms kali formsWordPress Kali Forms plugin <= 2.4.27 - Broken Access Control vulnerability5.3 Medium
- themegrill user registrationWordPress User Registration plugin <= 5.3.0 - Content Injection vulnerability5.3 Medium
- instawp connectWordPress InstaWP Connect plugin <= 0.1.4.2 - Cross Site Request Forgery (CSRF) vulnerability8.8 High
- crocoblock jetsmartfiltersWordPress JetSmartFilters plugin <= 3.8.6.2 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- bmc helix operations managementReflected Cross-Site Scripting in BMC Helix Operations Management4.8 Medium
- bmc it service management suiteImproper Authorization in BMC ITSM SmartIT Change Approvals5.3 Medium
- bmc it service management suiteReflected Cross-Site Scripting in BMC ITSM SmartIT4.8 Medium
- red hat ceph storage 9, enterprise linux 10, enterprise linux 6 +7 more +9 moreDnsmasq: dnsmasq: heap out-of-bounds read in dhcpv6 option 39 fqdn decoder4.3 Medium
- red hat ceph storage 9, enterprise linux 10, enterprise linux 6 +7 more +9 moreDnsmasq: dnsmasq: --leasequery without address argument applies no source address check4.3 Medium
- bmc it service management suiteImproper Authorization in BMC ITSM SmartIT Attachments5.3 Medium
- bmc it service management suiteSystem Account Credential Disclosure in BMC ITSM5.3 Medium
- carazo import and export users and customersWordPress Import and export users and customers plugin <= 2.5.9 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- themeisle multiple pages generator by themeisleMultiple Pages Generator by Themeisle before 4.2.5 Stored XSS via Shortcode base-url5.1 Medium
- bmc it service management suitePath Traversal in BMC ITSM6.9 Medium
- lwiplwIP 2.0.0 through 2.2.1 SNMP Agent Out-of-Bounds Read via snmp_pbuf_stream_writeto()6.9 Medium
- ggml-org llama.cppllama.cpp b2877 before b11935 ggml-rpc Server DoS via Oversized recv_msg Length8.7 High
- hughsk flatflat through 6.0.1 Denial of Service via unflatten() Numeric Array Index Keys8.2 High
- agnoAgno through 3.1.11 Code Execution via PandasTools Unsafe Reflection9.2 Critical
- idinging freemailFreeMail before 5.3.2 Authorization Bypass via /api/create Mailbox Claiming7.2 High
- thinkgem jeesiteJeeSite 5.11.0 through 5.19.1 IDOR in AI CMS Chat Module2.3 Low
- gomarkdown markdownPython-Markdown 3.0 through 3.11.2 Denial of Service via Link Bracket Parsing8.7 High
- Show moreLoading…