Skip to content
Noroxi
By publication date

Exploited and new serious CVEs: October 2026

8,751 records · 22 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

Page 88 of 88

  • CVE-2026-119977
    62This week

    WordPress Core 4.7.0 - 7.1.3 - Unauthenticated Upgrade-Window Staged-Installer Remote Code Execution

    HighCVSS 8.1KEVWeaponizedEPSS 1%

    wordpress · wordpressOct 31, 2026

  • CVE-2026-107653
    28Monitor

    SureCart <= 4.9.4 - Unauthenticated Stored Cross-Site Scripting via 'manual-payment-instructions' Attribute of sc-order-manual-instructions in Comments

    HighCVSS 7.2No exploitEPSS 0%

    surecart · surecart – ecommerce made easy for selling physical products, digital downloads, subscriptions, donations, & paymentsOct 31, 2026

  • CVE-2026-107750
    28Monitor

    PDF Invoices & Packing Slips for WooCommerce <= 5.16.4 - Unauthenticated Stored Cross-Site Scripting via Billing First Name / Last Name / Company / Customer Not

    HighCVSS 7.2No exploitEPSS 0%

    wpovernight · pdf invoices & packing slips for woocommerceOct 31, 2026

  • CVE-2026-109220
    39Monitor

    PDF Invoice for WooCommerce + Drag and Drop Template Builder <= 7.1.1 - Unauthenticated PHP Object Injection to Remote Code Execution via 'customer_note' Checko

    CriticalCVSS 9.8No exploitEPSS 0%

    addonsorg · pdf invoice for woocommerce + drag and drop template builderOct 31, 2026

  • CVE-2026-111254
    28Monitor

    W3 Total Cache <= 2.10.7 - Unauthenticated Stored Cross-Site Scripting via Comment Content Cached as HTML after License Expiry

    HighCVSS 7.2No exploitEPSS 0%

    boldgrid · w3 total cacheOct 31, 2026

  • CVE-2026-115840
    28Monitor

    VikRentCar Car Rental Management System <= 1.4.9 - Unauthenticated Stored Cross-Site Scripting via 'poplink' Parameter

    HighCVSS 7.2No exploitEPSS 0%

    e4jvikwp · vikrentcar car rental management systemOct 31, 2026

  • CVE-2026-116522
    28Monitor

    Relevanssi <= 4.28.5 - Unauthenticated Stored Cross-Site Scripting via Comment Content via Late Entity Decode

    HighCVSS 7.2No exploitEPSS 0%

    comesio · relevanssi – a better searchOct 31, 2026

  • CVE-2026-116548
    28Monitor

    VikRentCar Car Rental Management System <= 1.4.10 - Unauthenticated Stored Cross-Site Scripting via 'optionals' Parameter

    HighCVSS 7.2Proof of conceptEPSS 0%

    e4jvikwp · vikrentcar car rental management systemOct 31, 2026

  • CVE-2026-116557
    36Monitor

    WP Booking System <= 2.1.0.5 - Missing Authorization to Unauthenticated Arbitrary Calendar Note Deletion via wpbs_calendar_remove_note AJAX Action

    CriticalCVSS 9.1No exploitEPSS 0%

    murgroland · wp booking system – booking calendarOct 31, 2026

  • CVE-2026-118070
    28Monitor

    Welcart e-Commerce <= 2.12.5 - Unauthenticated Stored Cross-Site Scripting via 'gid' Parameter

    HighCVSS 7.2No exploitEPSS 0%

    uscnanbu · welcart e-commerceOct 31, 2026

  • CVE-2026-119065
    28Monitor

    Shipping Zones by Drawing for WooCommerce <= 3.3.0 - Unauthenticated Stored Cross-Site Scripting via 'szbd-picked' Checkout Parameter

    HighCVSS 7.2No exploitEPSS 0%

    arosoft · shipping zones by drawing for woocommerceOct 31, 2026

  • CVE-2026-119089
    28Monitor

    ThirstyAffiliates <= 3.12.1 - Unauthenticated Stored Cross-Site Scripting via Comment Content via <ta> Tag

    HighCVSS 7.2No exploitEPSS 0%

    supercleanse · thirstyaffiliates – affiliate links, link branding, link tracking & marketing pluginOct 31, 2026

  • CVE-2026-119162
    28Monitor

    User Submitted Posts <= 20260916 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'user-submitted-content' Parameter via Block-Comment Shortcode Spli

    HighCVSS 7.2No exploitEPSS 0%

    specialk · user submitted posts – enable users to submit posts from the front endOct 31, 2026

  • CVE-2026-119163
    30Monitor

    FunnelKit Automations <= 3.8.5.2 - Unauthenticated SQL Injection via 'bwfan_cart_id' Parameter

    HighCVSS 7.5No exploitEPSS 0%

    teamfunnelkit · funnelkit automations – email marketing automation and crm for wordpress & woocommerceOct 31, 2026

  • CVE-2026-120019
    21Monitor

    W3 Total Cache <= 2.10.7 - Unauthenticated Stored Cross-Site Scripting via Comment Content via Predictable Minify Placeholder

    MediumCVSS 5.4Proof of conceptEPSS 0%

    boldgrid · w3 total cacheOct 31, 2026

  • CVE-2026-120040
    30Monitor

    Mail logging & Catcher <= 2.2.0 - Authenticated (Subscriber+) Sensitive Information Exposure to Privilege Escalation to Mail Log Viewer / Password-Reset Email D

    HighCVSS 7.5No exploitEPSS 0%

    wardee · mail logging & catcherOct 31, 2026

  • CVE-2026-89270
    36Monitor

    Popup Builder <= 4.4.5 - Missing Authorization to Unauthenticated Arbitrary Popup Post Trashing via 'post_type' and 'sg_popup_preview_id' Parameters

    CriticalCVSS 9.1No exploitEPSS 0%

    popupbuilder · popup builder – create highly converting, mobile friendly marketing popups.Oct 31, 2026

  • CVE-2026-103898
    32Monitor

    Wp Social Login and Register Social Counter <= 3.2.2 - Unauthenticated Authentication Bypass via Insufficient Email Verification in Social Login Callback

    HighCVSS 8.1No exploitEPSS 0%

    roxnor · wp social login and register social counterOct 31, 2026

  • CVE-2026-104012
    35Monitor

    Rox Appointment Booking <= 1.3.1 - Unauthenticated Privilege Escalation via Mass Assignment to Mass Assignment via '/public/booking' Endpoint

    HighCVSS 8.8No exploitEPSS 0%

    roxnor · rox appointment booking – event, calendar & appointment schedulingOct 31, 2026

  • CVE-2026-107759
    28Monitor

    WPO365 | MICROSOFT 365 GRAPH MAILER <= 6.2 - Unauthenticated Stored Cross-Site Scripting via Email Subject via wp_mail

    HighCVSS 7.2No exploitEPSS 0%

    wpo365 · wpo365 | microsoft 365 graph mailerOct 31, 2026

  • CVE-2026-116512
    39Monitor

    Project Manager <= 4.1.1 - Unauthenticated Remote Code Execution via 'id' Parameter Function Injection

    CriticalCVSS 9.8Proof of conceptEPSS 0%

    wedevs · project manager – ai powered project management, task management, kanban board & time trackerOct 31, 2026

  • CVE-2026-118057
    28Monitor

    Shield Security <= 22.3.2 - Unauthenticated Stored Cross-Site Scripting via Request Path (REQUEST_URI) in Traffic Log

    HighCVSS 7.2No exploitEPSS 0%

    paultgoodchild · shield security – smart bot blocking, brute-force login protection & file scanningOct 31, 2026

  • CVE-2026-119096
    39Monitor

    Uncanny Toolkit for LearnDash <= 3.8.2 - Unauthenticated Authentication Bypass via 'email' Parameter

    CriticalCVSS 9.8No exploitEPSS 0%

    uncannyowl · uncanny toolkit for learndashOct 31, 2026

  • CVE-2026-120070
    35Monitor

    User Frontend <= 4.3.13 - Authenticated (Subscriber+) Privilege Escalation via post_content Parameter

    HighCVSS 8.8No exploitEPSS 0%

    wedevs · user frontend – membership, user registration, user profile, user directory & content restriction with frontend post submissionOct 31, 2026

  • CVE-2026-103882
    36Monitor

    Acadlix LMS <= 1.1.9 - Unauthenticated Arbitrary File Deletion via 'delete_file_data.file_path' Parameter

    CriticalCVSS 9.1No exploitEPSS 0%

    acadlix · acadlix lms – ai quiz maker, online exam & course plugin for wordpressOct 31, 2026

  • CVE-2026-110530
    28Monitor

    FeedWordPress <= 2026.0517 - Unauthenticated Stored Cross-Site Scripting via Syndicated Feed Content

    HighCVSS 7.2No exploitEPSS 0%

    radgeek · feedwordpressOct 31, 2026

  • CVE-2026-114217
    34Monitor

    Konflux-ci: github token plaintext exposure in ci/cd scripts

    HighCVSS 8.6No exploitEPSS 0%

    Oct 31, 2026

  • CVE-2026-116086
    35Monitor

    Konflux-ci: jq filter injection in github workflow issue management

    HighCVSS 8.8No exploitEPSS 0%

    Oct 31, 2026

  • CVE-2026-116964
    33Monitor

    Konflux-ci: remote code execution via eval() in manifest scripts

    HighCVSS 8.4No exploitEPSS 0%

    Oct 31, 2026

  • CVE-2026-117681
    32Monitor

    Konflux-ci: ui proxy skips backend tls verification on non-openshift clusters, leaking a token that can impersonate anyone

    HighCVSS 8.0No exploitEPSS 0%

    Oct 31, 2026

  • CVE-2026-118235
    39Monitor

    SimpleForm <= 3.10.2 - Unauthenticated Arbitrary File Upload via Trailing-Dot Filename via Unknown File Key in simpleform_get_submit_data

    CriticalCVSS 9.8No exploitEPSS 0%

    wpazleen · simpleform – form maker to chat apps with quiz, poll and multi lead notificationsOct 31, 2026

  • CVE-2026-120075
    28Monitor

    WP Activity Log <= 5.6.1 - Unauthenticated Stored Cross-Site Scripting

    HighCVSS 7.2No exploitEPSS 0%

    melapress · wp activity logOct 31, 2026

  • CVE-2026-109197
    30Monitor

    WP Directory Kit <= 1.6.0 - Unauthenticated SQL Injection via 'idfield' Parameter

    HighCVSS 7.5No exploitEPSS 0%

    wpdirectorykit · wp directory kitOct 31, 2026

  • CVE-2026-120114
    28Monitor

    Debug Log Manager <= 2.5.2 - Unauthenticated Stored Cross-Site Scripting via 'log_js_errors' AJAX Endpoint

    HighCVSS 7.2No exploitEPSS 0%

    qriouslad · debug log manager – conveniently monitor and inspect errorsOct 31, 2026

  • CVE-2026-120194
    30Monitor

    Json-glib: json-glib: infinite loop in json_path_query() with negative jsonpath slice step

    HighCVSS 7.5No exploitEPSS 0%

    red hat · red hat enterprise linux 10Oct 31, 2026

  • CVE-2026-76010
    35Monitor

    Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery <= 4.4.1 - Authenticated (Custom+) Remote Code Execution via XML-RPC 'meta_data' Mass Assignment a

    HighCVSS 8.8No exploitEPSS 0%

    smub · photo gallery, sliders, proofing and themes – nextgen galleryOct 31, 2026

  • RUSTSEC-2026-0434
    32Monitor

    `ant-releases`: extracting a release archive can write files outside the destination directory (path traversal / zip-slip)

    HighCVSS 8.2No exploit

    Oct 31, 2026

  • CVE-2026-78189
    39Monitor

    WebDyne versions from 3.007 before 3.022 for Perl execute .psp files outside the document root via path traversal in the PSGI API route fallback

    CriticalCVSS 9.8No exploitEPSS 0%

    Oct 31, 2026

  • CVE-2026-78191
    39Monitor

    WebDyne versions from 2.031 before 3.022 for Perl execute files with .psp anywhere in the name as Perl pages

    CriticalCVSS 9.8No exploitEPSS 0%

    Oct 31, 2026

  • CVE-2026-78192
    30Monitor

    WebDyne versions from 2.022 before 3.022 for Perl disclose application source to unauthenticated clients via the viewer in the default index page

    HighCVSS 7.5No exploitEPSS 0%

    Oct 31, 2026

  • CVE-2026-102212
    33Monitor

    Pre-Auth Heap Buffer Overflow in the Multipart Request

    HighCVSS 8.4No exploitEPSS 0%

    opengear · im7200Oct 31, 2026

  • CVE-2026-120201
    38Monitor

    Jpom 2.10.0 through 2.11.12 Authentication Bypass via JPOM-USER-TOKEN Header

    CriticalCVSS 9.3Proof of conceptEPSS 2%

    dromara · jpomOct 31, 2026

  • CVE-2026-120202
    28Monitor

    Highflame ramparts 0.8.1 through 0.8.10 Skill Bundle Scan Bypass via Nested .pyc

    HighCVSS 7.1No exploitEPSS 0%

    highflame-ai · rampartsOct 31, 2026

  • CVE-2026-120203
    34Monitor

    ShowDoc 2.8.14 before 3.9.6 Code Injection via Mock Templates

    HighCVSS 8.7No exploitEPSS 0%

    showdoc · showdocOct 31, 2026

  • CVE-2026-120205
    29Monitor

    Thelia before 3.1.0 Stored XSS via Coupon Condition Customer Name

    HighCVSS 7.4No exploitEPSS 0%

    thelia · theliaOct 31, 2026

  • CVE-2026-120207
    28Monitor

    Thelia Page Module before 2.0.4 CSRF via Page Tag, Document and Image Delete Routes

    HighCVSS 7.0No exploitEPSS 0%

    thelia · thelia page moduleOct 31, 2026

  • CVE-2026-120208
    30Monitor

    libheif 1.18.0 before 1.23.3 Heap Buffer Overflow via unci Mixed-Interleave Decoder

    HighCVSS 7.7No exploitEPSS 0%

    strukturag · libheifOct 31, 2026

  • CVE-2026-120209
    37Monitor

    AJ-Report through 1.7.1 Authentication Bypass leading to RCE via Share-Token

    CriticalCVSS 9.3Proof of conceptEPSS 0%

    anji-plus · aj-reportOct 31, 2026

  • CVE-2026-118147
    29Monitor

    Visual Studio Spoofing Vulnerability

    HighCVSS 7.4No exploitEPSS 0%

    microsoft · microsoft visual studio 2017 version 15.9Oct 31, 2026

  • CVE-2026-118636
    39Monitor

    Apache MINA: Unsafe Deserialization (CWE-502) in JavaNativeMessageDecoder

    CriticalCVSS 9.8No exploitEPSS 0%

    apache software foundation · apache minaOct 31, 2026

  • CVE-2026-120135
    32Monitor

    Apache Thrift: Java TProtocolUtil.skip() does not limit the recursion depth by default

    HighCVSS 8.2No exploitEPSS 0%

    apache software foundation · apache thriftOct 31, 2026