Security Box Score — October 17, 2026

100 CVEs published, led by thorsten (28).

100 CVEs published October 17, 2026: 3 critical, 42 high, 40 medium, 3 low; 0 in the KEV catalog at press time; 0 with a public exploit reference; 12 awaiting enrichment. Elevated volume. 25 rendered as box scores below; the remaining 75 in the results table.

Standings

League
	MTD	YTD	2025 same span	2025 full
CVEs published	9093	59223	—	—
KEV catalog size	1748

Publication counts reflect the record since May 20, 2026 (archive start); KEV figures are catalog-wide.

Prior-year comparisons begin when the archive covers a full year; archive begins May 20, 2026.

3746 disclosures carry no usable vendor attribution (upstream records marked n/a or unknown) and are excluded from the vendor tables. C/H/M/L = YTD disclosures by severity band. KEV = catalog entries all-time / YTD. KEV/100 = KEV additions YTD ÷ CVEs YTD × 100. Med CVSS / Med EPSS = medians over the vendor's YTD disclosures. Δ = this month-to-date minus the same day-span of last month.

Operating Systems & Platforms
Vendor	MTD	YTD	C	H	M	L	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
linux	269	6528	532	2699	910	1	15	6	0.1	7.8	.0018	-1237 ▼
microsoft	1460	4363	269	3016	1061	17	291	32	0.7	7.8	.0045	+461 ▲
google	340	3171	390	1236	1407	138	80	9	0.3	7.5	.0026	-176 ▼
red hat	168	1067	58	422	526	61	2	0	0.0	6.5	.0031	+58 ▲
apple	0	564	67	166	317	14	89	9	1.6	6.5	.0019	-246 ▼
freebsd	13	61	3	43	9	3	0	0	0.0	7.8	.0016	+13 ▲
suse	5	58	8	29	19	2	0	0	0.0	7.5	.0033	-12 ▼
canonical	3	53	16	12	20	5	0	0	0.0	7.7	.0021	+3 ▲

Network & Infrastructure
Vendor	MTD	YTD	C	H	M	L	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
cisco	37	219	71	84	63	1	61	18	8.2	8.4	.0044	-60 ▼
ubiquiti	6	71	35	31	3	2	3	3	4.2	8.8	.0050	+6 ▲
palo alto networks	13	65	1	8	38	18	14	3	4.6	4.8	.0028	+4 ▲
fortinet	12	54	13	14	22	5	31	9	16.7	7.0	.0038	+2 ▲
netgear	6	40	0	0	32	8	0	0	0.0	4.3	.0026	+4 ▲
f5	11	37	10	20	6	1	5	2	5.4	8.7	.0048	+3 ▲
ivanti	8	32	8	20	4	0	26	6	18.8	8.8	.0137	-2 ▼
sonicwall	6	25	8	12	5	0	19	4	16.0	7.8	.0049	+1 ▲

Open Source Ecosystems
Vendor	MTD	YTD	C	H	M	L	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
apache	162	869	180	389	266	21	33	2	0.2	7.5	.0056	+70 ▲
mozilla	85	464	127	185	125	0	9	0	0.0	8.8	.0028	-28 ▼
gitlab	26	130	9	29	78	14	5	3	2.3	5.3	.0033	+9 ▲
drupal	0	94	11	9	66	8	4	1	1.1	5.7	.0027	-26 ▼
github	2	25	2	12	11	0	0	0	0.0	7.4	.0058	-1 ▼
docker	8	20	2	10	8	0	0	0	0.0	7.3	.0015	+5 ▲
wordpress	0	6	1	4	1	0	3	3	50.0	8.7	.0363	0
eclipse	0	2	2	0	0	0	0	0	0.0	9.3	.0050	0

Enterprise Applications
Vendor	MTD	YTD	C	H	M	L	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
oracle	0	2905	581	1660	563	101	28	4	0.1	7.8	.0036	-634 ▼
ibm	205	1228	233	576	398	21	6	1	0.1	7.5	.0035	-2 ▼
adobe	177	1007	108	465	425	9	21	5	0.5	7.5	.0035	+6 ▲
progress	71	137	21	83	32	1	6	1	0.7	7.5	.0034	+68 ▲
zohocorp	1	43	6	29	8	0	0	0	0.0	8.1	.0113	-4 ▼
solarwinds	0	26	18	5	3	0	10	4	15.4	9.1	.0067	-1 ▼
veeam	6	25	7	11	7	0	1	0	0.0	8.5	.0036	+6 ▲
servicenow	0	10	7	3	0	0	2	0	0.0	9.4	.0046	0

Industrial & Embedded
Vendor	MTD	YTD	C	H	M	L	KEV	Med CVSS	Med EPSS	Δ
siemens	33	87	9	52	23	3	0	7.3	.0028	+18 ▲
d-link	2	76	23	29	12	12	3	8.5	.0164	-19 ▼
synology	0	46	5	10	25	6	0	5.6	.0032	0
rockwell automation	2	45	5	34	6	0	0	8.7	.0028	-16 ▼
advantech	0	20	2	17	1	0	0	8.6	.0071	-17 ▼
schneider electric	1	19	2	12	5	0	0	8.6	.0043	-8 ▼
abb	1	12	1	6	5	0	0	7.2	.0017	+1 ▲
hitachi energy	0	12	2	4	6	0	0	7.0	.0025	-4 ▼

Other
Vendor	MTD	YTD	C	H	M	L	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
dell	52	430	45	194	170	21	2	1	0.2	7.2	.0026	-125 ▼
nvidia	20	321	27	221	73	0	0	0	0.0	7.8	.0019	-12 ▼
sourcecodester	32	269	0	0	162	107	0	0	0.0	5.5	.0041	-16 ▼
openclaw	1	229	5	117	85	22	0	0	0.0	7.1	.0031	-1 ▼
hewlett packard enterprise (hpe)	38	204	39	92	64	9	1	1	0.5	7.3	.0042	-91 ▼
mongodb	22	191	6	106	72	7	1	0	0.0	7.1	.0035	-34 ▼
juniper networks	153	175	23	130	22	0	7	0	0.0	8.6	.0035	+153 ▲
itsourcecode	18	171	0	0	42	129	0	0	0.0	2.1	.0033	-16 ▼

Leaders (trailing 30 days unless noted)

Highest EPSS
CVE	EPSS	%ile	CVSS
CVE-2026-93616	.7587	99.5	9.8
CVE-2026-87902	.3998	98.6	8.1
CVE-2026-59774	.2831	98.1	9.8
CVE-2026-104935	.2598	98.0	8.6
CVE-2026-111214	.0863	95.1	8.6
CVE-2026-111218	.0844	95.0	8.6
CVE-2026-111215	.0705	94.1	8.6
CVE-2026-111217	.0705	94.1	8.6
CVE-2026-12269	.0699	94.1	8.8
CVE-2026-111216	.0655	93.7	8.6

Highest CVSS
CVE	CVSS	EPSS
CVE-2026-108576	10.0	.0245
CVE-2026-105484	10.0	.0213
CVE-2026-73369	10.0	.0125
CVE-2026-75699	10.0	.0125
CVE-2026-75703	10.0	.0125
CVE-2026-75721	10.0	.0125
CVE-2026-84412	10.0	.0125
CVE-2026-89275	10.0	.0125
CVE-2026-86708	10.0	.0124
CVE-2026-61732	10.0	.0122

Most disclosures (vendor)
Vendor	CVEs
microsoft	1463
linux	877
google	486
ibm	402
red hat	322
apache	265
adobe	230
mozilla	163
nvidia	155
juniper networks	153

Most KEV additions (YTD)
Vendor	KEV
microsoft	32
cisco	18
apple	9
fortinet	9
google	9
ivanti	6
linux	6
adobe	5
berriai	4
checkpoint	4

Most-affected ecosystems
Ecosystem	Advisories
Maven	95
npm	47
PyPI	36
NuGet	29
Packagist	24
Go	12
crates.io	10
RubyGems	4

Fastest to KEV
CVE	Vendor	Days
CVE-2026-102764	BeyondTrust	0
CVE-2026-86950	Apple	0
CVE-2026-88779	NetScaler	0
CVE-2026-93952	Arista Networks	0
CVE-2026-102489	Zammad GmbH	1
CVE-2026-102490	Zammad GmbH	1
CVE-2026-87902	WordPress	2
CVE-2026-21589	Atlassian	9
CVE-2026-105133	Ahsay	10
CVE-2026-105134	Ahsay	10

Longest unpatched (KEV due date passed)
CVE	Vendor	Due	Days over
CVE-2021-27104	n/a	2021-11-17	1795
CVE-2021-27102	n/a	2021-11-17	1795
CVE-2021-27101	n/a	2021-11-17	1795
CVE-2021-27103	n/a	2021-11-17	1795
CVE-2021-21017	Adobe	2021-11-17	1795
CVE-2021-28550	Adobe	2021-11-17	1795
CVE-2021-42013	Apache Software Foundation	2021-11-17	1795
CVE-2021-41773	Apache Software Foundation	2021-11-17	1795
CVE-2021-30858	Apple	2021-11-17	1795
CVE-2021-30860	Apple	2021-11-17	1795

Transactions

DUE DATE PASSED — CVE-2026-104935 (Ivanti Connect Secure). CISA remediation deadline was October 16, 2026; still in catalog.

DUE DATE PASSED — CVE-2026-96951 (Microsoft Outlook.com). CISA remediation deadline was October 16, 2026; still in catalog.

RESCORED — CVE-2025-61624 (Fortinet FortiOS). CVSS 5.4 → 6.5 (NVD).

PATCH SHIPPED — CVE-2026-108334 (Red Hat Connectivity Link 1.4). Fixed in Red Hat Connectivity Link 1.4 1791975888.

PATCH SHIPPED — CVE-2026-17591 (Red Hat Hardened Images). Fixed in Red Hat Hardened Images 3.8.9-2.1.hum1.

PATCH SHIPPED — CVE-2026-85977 (Red Hat Hardened Images). Fixed in Red Hat Hardened Images 1.3.8-0.1.hum1.

Yesterday's Results

How to read these box scores · glossary

100 CVEs published. 25 box scores, 75 table rows — nothing truncated.

CVE-2026-111853HIGH

Tektronix 3 Series MDO — An issue was discovered on Tektronix 3 Series MDO devices before 1.21.1. An OS command injection vulnerabil…

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   L   N  U  H  H  H    8.8   .0086   57.7     —

AFFECTED
  Product       Versions     Fixed
  3 Series MDO  unspecified  —

TIMELINE
  Oct 17  Reserved by CNA
  Oct 17  Published (CNA: mitre)

CWE-78 · CNA: mitre · CVSS v3.1 · 2 references · NVD status: Received

CVE-2026-110268MEDIUM

wpazleen Post Export Import with Media — Post Export Import with Media <= 1.17.2 - Authenticated (Administrator+) Path Traversal via 'theme_slug' Parameter

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   H   N  U  H  N  N    4.9   .0077   54.6     —

AFFECTED
  Product                        Versions     Fixed
  Post Export Import with Media  unspecified  —

TIMELINE
  Oct 13  Reserved by CNA
  Oct 17  Published (CNA: Wordfence)

CWE-22 · CNA: Wordfence · CVSS v3.1 · 11 references · NVD status: Received

CVE-2026-111855HIGH

Tektronix 3 Series MDO — An issue was discovered on Tektronix 3 Series MDO devices before 1.21.1. A path traversal vulnerability exi…

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  H  N  N    7.5   .0049   41.0     —

AFFECTED
  Product       Versions     Fixed
  3 Series MDO  unspecified  —

TIMELINE
  Oct 17  Reserved by CNA
  Oct 17  Published (CNA: mitre)

CWE-22 · CNA: mitre · CVSS v3.1 · 2 references · NVD status: Received

CVE-2026-104734HIGH

themeum Kirki – Freeform Page Builder, Website Builder & Customizer — Kirki <= 6.3.2 - Authenticated (Administrator+) PHP Object Injection via Deserialization of Untrusted Input via ZIP Template Import

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   H   N  U  H  H  H    7.2   .0047   38.9     —

AFFECTED
  Product                                                      Versions     Fixed
  Kirki – Freeform Page Builder, Website Builder & Customizer  unspecified  —

TIMELINE
  Oct 2   Reserved by CNA
  Oct 17  Published (CNA: Wordfence)

CWE-502 · CNA: Wordfence · CVSS v3.1 · 6 references · NVD status: Received

CVE-2026-104736CRITICAL

thimpress LearnPress – WordPress LMS Plugin for Create and Sell Online Courses — LearnPress <= 4.4.10 - Unauthenticated PHP Object Injection via 'checkout-email' Parameter

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  H  H  H    9.8   .0044   36.6     —

AFFECTED
  Product                                                               Versions     Fixed
  LearnPress – WordPress LMS Plugin for Create and Sell Online Courses  unspecified  —

TIMELINE
  Oct 2   Reserved by CNA
  Oct 17  Published (CNA: Wordfence)

CWE-502 · CNA: Wordfence · CVSS v3.1 · 6 references · NVD status: Received

CVE-2026-110653CRITICAL

latepoint Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress — Appointment Booking Plugin <= 5.7.4 - Unauthenticated Authentication Bypass via Race Condition on OTP Attempts Counter

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  H  H  N    9.1   .0040   33.0     —

AFFECTED
  Product                                                                       Versions     Fixed
  Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress  unspecified  —

TIMELINE
  Oct 14  Reserved by CNA
  Oct 17  Published (CNA: Wordfence)

CWE-287 · CNA: Wordfence · CVSS v3.1 · 7 references · NVD status: Received

CVE-2026-107762HIGH

themeum Kirki – Freeform Page Builder, Website Builder & Customizer — Kirki <= 6.3.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Exposure via Context Smuggling via 'context' Parameter

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  H  N  N    7.5   .0040   32.2     —

AFFECTED
  Product                                                      Versions     Fixed
  Kirki – Freeform Page Builder, Website Builder & Customizer  unspecified  —

TIMELINE
  Oct 8   Reserved by CNA
  Oct 17  Published (CNA: Wordfence)

CWE-639 · CNA: Wordfence · CVSS v3.1 · 6 references · NVD status: Received

CVE-2026-111854HIGH

Tektronix 3 Series MDO — An issue was discovered on Tektronix 3 Series MDO devices before 1.21.1. A path traversal vulnerability in …

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   L   N  U  H  H  N    8.1   .0039   31.6     —

AFFECTED
  Product       Versions     Fixed
  3 Series MDO  unspecified  —

TIMELINE
  Oct 17  Reserved by CNA
  Oct 17  Published (CNA: mitre)

CWE-22 · CNA: mitre · CVSS v3.1 · 2 references · NVD status: Received

CVE-2026-92798HIGH

wpeverest User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder — User Registration & Membership <= 5.2.8 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via Referer Header via 'referrer_url' Smart Tag

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   L   N  U  H  H  N    8.1   .0037   29.2     —

AFFECTED
  Product                                                                                                                                               Versions     Fixed
  User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder  unspecified  —

TIMELINE
  Sep 16  Reserved by CNA
  Oct 17  Published (CNA: Wordfence)

CWE-94 · CNA: Wordfence · CVSS v3.1 · 6 references · NVD status: Received

CVE-2026-108123HIGH

murgroland WP Booking System – Booking Calendar — WP Booking System <= 2.1.0.3 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'wpbs_action=email_logs' Action

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  H  N  N    7.5   .0032   23.1     —

AFFECTED
  Product                               Versions     Fixed
  WP Booking System – Booking Calendar  unspecified  —

TIMELINE
  Oct 9   Reserved by CNA
  Oct 17  Published (CNA: Wordfence)

CWE-862 · CNA: Wordfence · CVSS v3.1 · 6 references · NVD status: Received

CVE-2026-107752MEDIUM

uscnanbu Welcart e-Commerce — Welcart e-Commerce <= 2.12.4 - Authenticated (Editor+) SQL Injection via 'wp_usces_order_old' Cookie

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   H   N  U  H  N  N    4.9   .0030   21.4     —

AFFECTED
  Product             Versions     Fixed
  Welcart e-Commerce  unspecified  —

TIMELINE
  Oct 8   Reserved by CNA
  Oct 17  Published (CNA: Wordfence)

CWE-89 · CNA: Wordfence · CVSS v3.1 · 8 references · NVD status: Received

CVE-2026-111602LOW

latepoint Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress — Appointment Booking Plugin <= 5.7.4 - Unauthenticated Sensitive Information Disclosure via ORM Operator Injection in 'customer[uuid]' Parameter

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   H   N   N  U  L  N  N    3.7   .0029   20.1     —

AFFECTED
  Product                                                                       Versions     Fixed
  Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress  unspecified  —

TIMELINE
  Oct 16  Reserved by CNA
  Oct 17  Published (CNA: Wordfence)

CWE-200 · CNA: Wordfence · CVSS v3.1 · 6 references · NVD status: Received

CVE-2026-109208HIGH

thimpress LearnPress – WordPress LMS Plugin for Create and Sell Online Courses — LearnPress <= 4.4.10 - Unauthenticated Stored Cross-Site Scripting via 'quantity' and 'order_comments' Parameters

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  C  L  L  N    7.2   .0029   19.6     —

AFFECTED
  Product                                                               Versions     Fixed
  LearnPress – WordPress LMS Plugin for Create and Sell Online Courses  unspecified  —

TIMELINE
  Oct 12  Reserved by CNA
  Oct 17  Published (CNA: Wordfence)

CWE-79 · CNA: Wordfence · CVSS v3.1 · 9 references · NVD status: Received

CVE-2026-110253MEDIUM

boldgrid weForms – Easy Drag & Drop Contact Form Builder For WordPress — weForms <= 1.6.28 - Unauthenticated Limited Media File Deletion via 'wpuf_files' Parameter

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   R  U  N  L  L    5.4   .0028   19.0     —

AFFECTED
  Product                                                        Versions     Fixed
  weForms – Easy Drag & Drop Contact Form Builder For WordPress  unspecified  —

TIMELINE
  Oct 13  Reserved by CNA
  Oct 17  Published (CNA: Wordfence)

CWE-22 · CNA: Wordfence · CVSS v3.1 · 7 references · NVD status: Received

CVE-2026-111110HIGH

stiofansisland Payment forms, Buy now buttons, and Invoicing System | GetPaid — Payment forms, Buy now buttons, and Invoicing System | GetPaid <= 2.8.61 - Unauthenticated Stored Cross-Site Scripting via 'mmdwqzpoxadd' Parameter

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  C  L  L  N    7.2   .0028   18.9     —

AFFECTED
  Product                                                         Versions     Fixed
  Payment forms, Buy now buttons, and Invoicing System | GetPaid  unspecified  —

TIMELINE
  Oct 15  Reserved by CNA
  Oct 17  Published (CNA: Wordfence)

CWE-79 · CNA: Wordfence · CVSS v3.1 · 8 references · NVD status: Received

CVE-2026-100316HIGH

davidanderson European VAT Compliance Assistant for WooCommerce — European VAT Compliance Assistant for WooCommerce <= 1.36.10 - Unauthenticated Stored Cross-Site Scripting via CF-IPCountry Header

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  C  L  L  N    7.2   .0027   18.3     —

AFFECTED
  Product                                            Versions     Fixed
  European VAT Compliance Assistant for WooCommerce  unspecified  —

TIMELINE
  Sep 25  Reserved by CNA
  Oct 17  Published (CNA: Wordfence)

CWE-79 · CNA: Wordfence · CVSS v3.1 · 6 references · NVD status: Received

CVE-2026-109368MEDIUM

murgroland WP Booking System – Booking Calendar — WP Booking System <= 2.1.0.3 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via wpbs_refresh_calendar_editor AJAX action

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   L   N  U  H  N  N    6.5   .0026   17.0     —

AFFECTED
  Product                               Versions     Fixed
  WP Booking System – Booking Calendar  unspecified  —

TIMELINE
  Oct 12  Reserved by CNA
  Oct 17  Published (CNA: Wordfence)

CWE-862 · CNA: Wordfence · CVSS v3.1 · 7 references · NVD status: Received

CVE-2026-109369MEDIUM

murgroland WP Booking System – Booking Calendar — WP Booking System <= 2.1.0.3 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation via 'user_permission' Parameter via Cross-Form Nonce Reuse

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   H   L   N  U  H  H  N    6.8   .0026   15.9     —

AFFECTED
  Product                               Versions     Fixed
  WP Booking System – Booking Calendar  unspecified  —

TIMELINE
  Oct 12  Reserved by CNA
  Oct 17  Published (CNA: Wordfence)

CWE-862 · CNA: Wordfence · CVSS v3.1 · 6 references · NVD status: Received

CVE-2026-107744MEDIUM

thimpress LearnPress – WordPress LMS Plugin for Create and Sell Online Courses — LearnPress <= 4.4.10 - Missing Authorization to Authenticated (Subscriber+) Email Address Enumeration via 'search-authors' AJAX Action

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   L   N  U  H  N  N    6.5   .0025   15.3     —

AFFECTED
  Product                                                               Versions     Fixed
  LearnPress – WordPress LMS Plugin for Create and Sell Online Courses  unspecified  —

TIMELINE
  Oct 8   Reserved by CNA
  Oct 17  Published (CNA: Wordfence)

CWE-862 · CNA: Wordfence · CVSS v3.1 · 5 references · NVD status: Received

CVE-2026-103899HIGH

daigo75 EU VAT Assistant for WooCommerce — EU VAT Assistant for WooCommerce <= 2.1.30.260413 - Unauthenticated Stored Cross-Site Scripting via 'vat_number' Parameter

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  C  L  L  N    7.2   .0024   14.2     —

AFFECTED
  Product                           Versions     Fixed
  EU VAT Assistant for WooCommerce  unspecified  —

TIMELINE
  Oct 1   Reserved by CNA
  Oct 17  Published (CNA: Wordfence)

CWE-79 · CNA: Wordfence · CVSS v3.1 · 7 references · NVD status: Received

CVE-2026-96660HIGH

wpeverest User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder — User Registration & Membership <= 5.2.8 - Unauthenticated Stored Cross-Site Scripting via Checkbox Field Value

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  C  L  L  N    7.2   .0023   12.8     —

AFFECTED
  Product                                                                                                                                               Versions     Fixed
  User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder  unspecified  —

TIMELINE
  Sep 23  Reserved by CNA
  Oct 17  Published (CNA: Wordfence)

CWE-79 · CNA: Wordfence · CVSS v3.1 · 6 references · NVD status: Received

CVE-2026-111601MEDIUM

hippooo Hippoo Mobile App for WooCommerce — Hippoo Mobile App for WooCommerce <= 1.12.0 - Reflected Cross-Site Scripting via 'token_id' Parameter

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   R  C  L  L  N    6.1   .0023   12.4     —

AFFECTED
  Product                            Versions     Fixed
  Hippoo Mobile App for WooCommerce  unspecified  —

TIMELINE
  Oct 16  Reserved by CNA
  Oct 17  Published (CNA: Wordfence)

CWE-79 · CNA: Wordfence · CVSS v3.1 · 5 references · NVD status: Received

CVE-2026-109983MEDIUM

wssoffice21 YMC Filter — YMC Filter <= 3.12.19 - Authenticated (Author+) Stored DOM-Based Cross-Site Scripting via 'post_title' Parameter

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   L   N  C  L  L  N    6.4   .0022   11.1     —

AFFECTED
  Product     Versions     Fixed
  YMC Filter  unspecified  —

TIMELINE
  Oct 13  Reserved by CNA
  Oct 17  Published (CNA: Wordfence)

CWE-79 · CNA: Wordfence · CVSS v3.1 · 7 references · NVD status: Received

CVE-2026-107763MEDIUM

hostspa Fastcache by Host.it — Fastcache by Host.it <= 1.7.5 - Missing Authorization to Authenticated (Subscriber+) Arbitrary .htaccess Page-Cache Block Modification via updateSettings() admin_action_update Hook

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   L   N  U  N  L  N    4.3   .0021   10.9     —

AFFECTED
  Product               Versions     Fixed
  Fastcache by Host.it  unspecified  —

TIMELINE
  Oct 8   Reserved by CNA
  Oct 17  Published (CNA: Wordfence)

CWE-862 · CNA: Wordfence · CVSS v3.1 · 5 references · NVD status: Received

CVE-2026-92715MEDIUM

themeum Tutor LMS – eLearning and online course solution — Tutor LMS <= 4.1.0 - Insecure Direct Object Reference to Authenticated (Author+) Arbitrary Course Modification and Ownership Takeover via 'ID' Parameter

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   L   N  U  N  L  N    4.3   .0020    9.7     —

AFFECTED
  Product                                           Versions     Fixed
  Tutor LMS – eLearning and online course solution  unspecified  —

TIMELINE
  Sep 16  Reserved by CNA
  Oct 17  Published (CNA: Wordfence)

CWE-639 · CNA: Wordfence · CVSS v3.1 · 6 references · NVD status: Received

Remainder (ranked, continued)
CVE	CVSS	EPSS %ile	Vendor	Product	CWE	Title
CVE-2026-109985	6.4	9.3	wpdevteam	xSpeed Cache: AI-Powered Performance Hub with MCP, Caching & CDN	CWE-79	xSpeed Cache: AI-Powered Performance Hub with MCP, Caching & CDN <= 1.4.2 - A…
CVE-2026-81344	await	8.9	Unknown	ACF Frontend Admin by DynamiApps	—	Frontend Admin by DynamiApps <= 3.29.13 - Admin+ PHP Object Injection
CVE-2026-109989	6.4	8.4	themifyme	Themify Popup	CWE-79	Themify Popup <= 1.4.7 - Authenticated (Author+) Stored Cross-Site Scripting …
CVE-2026-111726	6.4	8.4	themifyme	Themify Builder	CWE-79	Themify Builder <= 7.8.2 - Authenticated (Contributor+) Stored Cross-Site Scr…
CVE-2026-110384	7.1	8.1	Heateor Support	Fancy Comments WordPress	CWE-79	WordPress Fancy Comments WordPress plugin <= 1.2.21 - Cross Site Scripting (X…
CVE-2026-104246	await	5.3	Unknown	Contact Form 7 Signature Addon	—	Contact Form 7 Signature Addon <= 4.2.2 - Unauthenticated Arbitrary File Read…
CVE-2026-91074	await	5.0	Unknown	BSK PDF Manager	—	BSK PDF Manager <= 3.8.1 - Contributor+ SQLi via tags_specific Shortcode Attr…
CVE-2026-104122	await	4.3	Unknown	Ukr-To-Lat	—	Ukr-To-Lat <= 1.3.5 - Contributor+ SQLi via Term Name
CVE-2026-92978	4.3	4.1	wpeverest	User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder	CWE-352	User Registration & Membership <= 5.2.8 - Cross-Site Request Forgery to trigg…
CVE-2026-97314	await	3.4	Unknown	ThirstyAffiliates	—	ThirstyAffiliates < 3.12.1 - Unauthenticated Non-Public Affiliate Link Destin…
CVE-2026-103376	await	2.9	Unknown	PeachPay — Payments & Express Checkout for WooCommerce (supports Stripe, PayPal, Square, Authorize.net, NMI)	—	PeachPay 1.117.9 - 1.120.69 - Unauthenticated Order Key Disclosure via Conves…
CVE-2026-92431	await	2.7	Unknown	Patreon WordPress	—	Patreon WordPress < 1.10.0 - Unauthenticated Taxonomy and Term Enumeration
CVE-2026-92432	await	2.7	Unknown	Patreon WordPress	—	Patreon WordPress < 1.10.0 - Open Redirect via 'state' Parameter
CVE-2026-110527	await	2.7	Unknown	WP User Manager	—	WP User Manager 2.9 - 2.9.19 - Unauthenticated Account Creation via Stripe Re…
CVE-2026-81343	await	2.5	Unknown	ACF Frontend Admin by DynamiApps	—	Frontend Admin by DynamiApps <= 3.29.13 - Unauthenticated ACF Options Page Fi…
CVE-2026-92433	await	1.4	Unknown	Patreon WordPress	—	Patreon WordPress < 1.10.0 - Patreon Integration Takeover via CSRF
CVE-2026-106470	await	0.7	Unknown	WP Data Access	—	WP Data Access < 5.5.88 - Subscriber+ SSRF
CVE-2026-111911	9.3	—	thorsten	phpMyFAQ	CWE-287	phpMyFAQ 4.0.0 before 4.1.9 Authentication Bypass via WebAuthn Credential Inj…
CVE-2026-111884	8.7	—	thorsten	phpMyFAQ	CWE-308	phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Missing Current-Passw…
CVE-2026-111901	8.7	—	thorsten	phpMyFAQ	CWE-400	phpMyFAQ 4.2.0-alpha before 4.2.0-beta Unauthenticated DoS via API Pagination
CVE-2026-111908	8.7	—	thorsten	phpMyFAQ	CWE-639	phpMyFAQ 4.0.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta BOLA in FAQ Upd…
CVE-2026-111923	8.7	—	fleetdm	fleet	CWE-674	Fleet before 4.89.0 Unauthenticated DoS via Apple MDM Enrollment Plist Parsing
CVE-2026-111924	8.7	—	fleetdm	fleet	CWE-409	Fleet before 4.83.0 Denial of Service via Unbounded Gzip Decompression
CVE-2026-111927	8.7	—	coder	coder	CWE-522	Coder before 2.35.4 Credential Theft via Workspace Proxy Hostname Prefix Match
CVE-2026-111882	8.6	—	thorsten	phpMyFAQ	CWE-287	phpMyFAQ 3.2.0-alpha before 4.1.9 and 4.2.0-alpha before 4.2.0-beta TOTP 2FA …
CVE-2026-111893	8.5	—	thorsten	phpMyFAQ	CWE-269	phpMyFAQ 4.2.0-alpha before 4.2.0-beta Privilege Escalation via Group Categor…
CVE-2026-111880	8.3	—	FreeRDP	FreeRDP	CWE-787	FreeRDP 2.0.0 before 3.32.0 Heap Out-of-Bounds Write via NTLM MIC Offset
CVE-2026-111898	7.7	—	thorsten	phpMyFAQ	CWE-287	phpMyFAQ 4.2.0-alpha before 4.2.0-beta Account Takeover via Keycloak Implicit…
CVE-2026-111895	7.6	—	thorsten	phpMyFAQ	CWE-287	phpMyFAQ 3.2.0 before 4.0.0 and 4.0.2 before 4.2.0-beta Account Takeover via …
CVE-2026-110889	7.5	—	Gantry	Gantry 5 Framework	CWE-209	WordPress Gantry 5 Framework plugin <= 5.6.4 - Sensitive Data Exposure vulner…
CVE-2026-111881	7.2	—	FreeRDP	FreeRDP	CWE-191	FreeRDP 3.14.1 before 3.32.0 Integer Underflow in BMP Writer via Clipboard
CVE-2026-111909	7.2	—	thorsten	phpMyFAQ	CWE-269	phpMyFAQ before 4.1.9 Missing Authorization Allows Superadmin Deletion via de…
CVE-2026-111922	7.2	—	go-vikunja	vikunja	CWE-942	Vikunja 2.2.0 before 2.7.0 Permissive CORS Policy Trusting Localhost Origins
CVE-2026-109701	7.1	—	PAYCOMET	PAYCOMET for WooCommerce	CWE-79	WordPress PAYCOMET for WooCommerce plugin <= 5.45 - Cross Site Scripting (XSS…
CVE-2026-111886	7.1	—	thorsten	phpMyFAQ	CWE-307	phpMyFAQ 4.2.0-alpha.2 before 4.2.0-beta 2FA Brute-Force via remove-twofactor…
CVE-2026-111897	7.1	—	thorsten	phpMyFAQ	CWE-862	phpMyFAQ 4.2.0-alpha before 4.2.0-beta Authorization Bypass in Attachment Adm…
CVE-2026-111906	7.1	—	thorsten	phpMyFAQ	CWE-352	phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta CSRF in Elasticsearch…
CVE-2026-111907	7.1	—	thorsten	phpMyFAQ	CWE-352	phpMyFAQ 4.0.0 before 4.1.9 CSRF via /admin/api/update-database
CVE-2026-111910	7.1	—	thorsten	phpMyFAQ	CWE-862	phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Authorization Bypass …
CVE-2026-111912	7.1	—	Admidio	admidio	CWE-639	Admidio 5.0.0 before 5.0.16 IDOR via Forum Topic Update
CVE-2026-111914	7.1	—	Admidio	admidio	CWE-862	Admidio 5.0.11 before 5.0.16 Broken Access Control via inventory_data.php
CVE-2026-111917	7.1	—	go-vikunja	vikunja	CWE-613	Vikunja 2.3.0 before 2.7.0 WebSocket Authentication Ignores Session Revocation
CVE-2026-111919	7.1	—	go-vikunja	vikunja	CWE-613	Vikunja 0.22.0 before 2.7.0 Improper Access Revocation via Webhooks
CVE-2026-111885	7.0	—	thorsten	phpMyFAQ	CWE-1220	phpMyFAQ 4.2.0-alpha before 4.2.0-beta Missing Authorization via deleteGroup API
CVE-2026-111890	7.0	—	thorsten	phpMyFAQ	CWE-269	phpMyFAQ 4.2.0-alpha.2 before 4.2.0-beta Privilege Escalation via updateUserR…
CVE-2026-111891	7.0	—	thorsten	phpMyFAQ	CWE-269	phpMyFAQ from 4.2.0-alpha.2 before 4.2.0-beta Privilege Escalation via Group …
CVE-2026-111905	7.0	—	thorsten	phpMyFAQ	CWE-639	phpMyFAQ 3.2.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta IDOR Leaks TOTP…
CVE-2026-111866	6.9	—	nemoTyrant	manong	CWE-89	nemoTyrant manong func.php arr2sql sql injection
CVE-2026-111887	6.9	—	thorsten	phpMyFAQ	CWE-204	phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Account Enumeration v…
CVE-2026-111892	6.9	—	thorsten	phpMyFAQ	CWE-307	phpMyFAQ 4.2.0-alpha before 4.2.0-beta Missing Rate Limiting on Password-Rese…
CVE-2026-111902	6.9	—	thorsten	phpMyFAQ	CWE-639	phpMyFAQ 4.2.0-alpha before 4.2.0-beta Authorization Bypass via Comments and …
CVE-2026-111904	6.9	—	thorsten	phpMyFAQ	CWE-200	phpMyFAQ 4.2.0-alpha before 4.2.0-beta Information Disclosure via open-questi…
CVE-2026-111916	6.9	—	Admidio	admidio	CWE-862	Admidio before 5.0.16 Information Disclosure via rss/links.php Weblinks Feed
CVE-2026-111933	6.3	—	coder	coder	CWE-203	Coder before 2.34.2 User Enumeration via Login Placeholder Hash
CVE-2026-111934	6.3	—	coder	coder	CWE-348	Coder before 2.34.7 IP Spoofing via X-Forwarded-For Header
CVE-2026-111929	6.0	—	coder	coder	CWE-863	Coder 2.30.0 before 2.34.8 Cross-Organization File Disclosure via DownloadFil…
CVE-2024-58398	5.3	—	coder	coder	CWE-601	Coder 2.3.1 before 2.16.1 Open Redirect via Login Page redirect Parameter
CVE-2026-111889	5.3	—	thorsten	phpMyFAQ	CWE-862	phpMyFAQ 4.1.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Missing Authori…
CVE-2026-111900	5.3	—	thorsten	phpMyFAQ	CWE-863	phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Draft FAQ Attachment …
CVE-2026-111913	5.3	—	Admidio	admidio	CWE-285	Admidio 5.0.0 before 5.0.16 Authorization Bypass via pdfl Mode in lists_show.php
CVE-2026-111918	5.3	—	go-vikunja	vikunja	CWE-863	Vikunja 1.0.0-rc0 before 2.7.0 Cross-Tenant Task Position Writes via Saved Fi…
CVE-2026-111920	5.3	—	go-vikunja	vikunja	CWE-269	Vikunja 2.6.0 Broken Access Control via Inherited Project Permissions
CVE-2026-111921	5.3	—	go-vikunja	vikunja	CWE-863	Vikunja 0.13.0 before 2.7.0 Incorrect Authorization in Link Share Deletion
CVE-2026-111928	5.3	—	coder	coder	CWE-863	Coder 2.0.0 before 2.34.8 Authorization Bypass via User-Level ACL in RBAC Policy
CVE-2026-111930	5.3	—	coder	coder	CWE-200	Coder from 2.26.0 before 2.34.8 Information Disclosure via Workspace ACL Endp…
CVE-2026-111931	5.3	—	coder	coder	CWE-601	Coder 2.0.0 before 2.34.8 Open Redirect via Workspace App Proxy
CVE-2026-111888	5.1	—	thorsten	phpMyFAQ	CWE-863	phpMyFAQ 4.0.0 before 4.1.9 Incorrect Authorization via news update API
CVE-2026-111894	5.1	—	thorsten	phpMyFAQ	CWE-79	phpMyFAQ 3.2.1 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Stored XSS via …
CVE-2026-111896	5.1	—	thorsten	phpMyFAQ	CWE-182	phpMyFAQ 4.2.0-alpha before 4.2.0-beta Stored XSS via SVG Upload Sanitizer By…
CVE-2026-111903	5.1	—	thorsten	phpMyFAQ	CWE-79	phpMyFAQ 4.2.0-alpha before 4.2.0-beta Stored XSS via SVG DTD Entity Bypass
CVE-2026-111926	4.8	—	coder	coder	CWE-200	Coder from 2.10.0 before 2.34.8 Information Disclosure via Agent /debug/manifest
CVE-2026-111932	4.8	—	coder	coder	CWE-79	Coder before 2.34.2 Stored HTML Injection via Appearance Settings
CVE-2026-110882	4.3	—	Cozy Vision Technologies Pvt. Ltd.	SMS Alert Order Notifications	CWE-862	WordPress SMS Alert Order Notifications plugin <= 4.0.1 - Broken Access Contr…
CVE-2025-71435	2.3	—	coder	coder	CWE-613	Coder before 2.23.0 Session Expiration Bypass via OIDC Without Refresh Token
CVE-2026-111865	1.9	—	THU-MIG	yoloe	CWE-94	THU-MIG yoloe AutoBackend Model Loading autobackend.py eval eval injection

Methodology

Ranking. Sort: (1) KEV membership, descending. (2) EPSS score, descending. (3) CVSS base score, descending. (4) CVE ID, ascending. CVEs lacking EPSS or CVSS data sort below those that have it within their KEV tier and are labeled AWAITING ENRICHMENT. Missing scores are never imputed.

Standings. Vendor tables exclude records whose vendor field is a placeholder (n/a, unknown); the excluded count is stated under the standings. Rate stats are arithmetic over published figures: KEV/100 = KEV additions YTD ÷ CVEs YTD × 100; Med CVSS and Med EPSS are medians over the vendor's year-to-date disclosures.

Day boundary. A day is a UTC calendar day. This page covers 2026-10-17 00:00:00–23:59:59 UTC. All times shown are UTC.

Feed status for this edition. cvelist: ok · kev: ok · epss: ok · nvd: ok.

Sources. CVE records from the CVE Program (cvelistV5). Enrichment from the National Vulnerability Database (NIST). Known-exploited status from the CISA KEV catalog. Exploit probability from FIRST EPSS. Open-source advisories from OSV.dev. This page reports the public record; it does not analyze, rank by opinion, or editorialize. See full methodology.

Machine-readable. This edition as JSON or CSV — the ranked results, transactions, and counts, for citation or ingestion. Frozen at publication; later changes appear as transactions on later editions.