CVE Tools
Track your stack

October

62 CVEs tracked. 1 of them are in CISA KEV.

This hub aggregates every CVE we track for October, a product in the web cms plugins space. Use it to gauge the current risk picture and drill into individual advisories.

October CVEs per month

Nov 2024 to Oct 2026. Point at a month, or focus the strip and use the arrow keys.
October CVEs per month
MonthCVEs
2024-110
2024-120
2025-010
2025-020
2025-030
2025-040
2025-051
2025-060
2025-070
2025-080
2025-090
2025-100
2025-110
2025-120
2026-012
2026-020
2026-030
2026-049
2026-050
2026-060
2026-070
2026-080
2026-091
2026-100

Severity

How the 62 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.

  • Critical58%
  • High1423%
  • Medium3455%
  • Low915%

Latest CVEs

The 15 most recently published vulnerabilities affecting October.

  1. CVE-2026-49400October CMS: PHP Object Injection via Backend Widget Session Storage3.3
  2. CVE-2026-29179October: Editor Sub-Permission Bypass for Asset and Blueprint File Operations3.3
  3. CVE-2026-27937October: Reflected XSS via DataTable Form Widget3.1
  4. CVE-2026-26274October: Safe Mode Bypass via Twig Database Write Operations6.6
  5. CVE-2026-26067October: Safe Mode Bypass via CSS Preprocessor Compilers4.9
  6. CVE-2026-25133October CMS has Stored XSS via SVG Filter Bypass4.8
  7. CVE-2026-25125October CMS: Environment Variable Exfiltration via INI Parser Interpolation4.9
  8. CVE-2026-24907October CMS has Stored XSS via Event Log Mail Preview5.4
  9. CVE-2026-24906October CMS has Stored XSS in its Backend Editor Markup Classes5.4
  10. CVE-2026-22692October CMS: Twig Sandbox Bypass via Collection Methods4.9
  11. CVE-2025-61674October CMS Vulnerable to Stored XSS via Editor and Branding Styles6.1
  12. CVE-2025-61676October CMS Vulnerable to Stored XSS via Branding Styles6.1
  13. CVE-2024-51991October CMS Allows Unprotected SVG Rename in Media Manager4.9
  14. CVE-2024-45962October 3.6.30 allows an authenticated admin account to upload a PDF file containing malicious JavaScript into the target system. If the file is accessed through the website, it could lead to a Cro...4.7
  15. CVE-2024-25837A stored cross-site scripting (XSS) vulnerability in October CMS Bloghub Plugin v1.3.8 and lower allows attackers to execute arbitrary web scripts or HTML via a crafted payload into the Comments se...5.4

Product grouping is registry-driven, with AI assist and human review. How it works