October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,481
Critical
1,390
High
6,087
Medium
6,446
Low
659
Severity not reported
2,899
In CISA KEV
21
Most affected vendors (by CPE data where available): microsoft (1359), google (759), oracle (376), apple (282), ibm (149), adobe (138), apache (73), imagemagick (72), broadcom (61), freerdp (60)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-93934 Deserialization of Untrusted Data vulnerability in ThemeREX Group Partiso partis... |
critical | 9.8 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-93935 Deserialization of Untrusted Data vulnerability in ThemeREX Group Let's Play pla... |
critical | 9.8 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-104803 The WPCOM Member plugin for WordPress is vulnerable to Authentication Bypass in... |
critical | 9.8 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-62045 Deserialization of Untrusted Data vulnerability in ThemeREX Group Booklovers boo... |
critical | 9.8 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-62046 Deserialization of Untrusted Data vulnerability in ThemeREX Group Gutentype gute... |
critical | 9.8 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-104801 The PPOM – Product Addons & Custom Fields for WooCommerce plugin for WordPress i... |
critical | 9.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-97670 The Avada (Fusion) Builder plugin for WordPress is vulnerable to authorization b... |
critical | 9.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-103889 The 3D Product configurator for WooCommerce plugin for WordPress is vulnerable t... |
critical | 9.8 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-94589 The Extensions For CF7 (Contact form 7 Database, Conditional Fields and Redirect... |
critical | 9.8 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-107645 The Blocksy Companion plugin for WordPress is vulnerable to privilege escalation... |
critical | 9.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-104732 The Advanced IP Blocker plugin for WordPress is vulnerable to Authentication Byp... |
critical | 9.8 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-108474 In JetBrains Exposed before 1.5.1 sQL injection was possible via unescaped strin... |
critical | 9.8 | — | — | 2026-10-10 | 2026-10-14 |
| CVE-2026-108261 Tina is a headless content management system. |
critical | 9.3 | — | — | 2026-10-09 | 2026-10-16 |
| CVE-2026-108263 Astron Agent is an agentic workflow platform for building and running AI agents. |
critical | 9.9 | — | — | 2026-10-09 | 2026-10-16 |
| CVE-2026-108264 Wizarr is an advanced user invitation and management system for Jellyfin, Plex,... |
critical | 9.1 | — | — | 2026-10-09 | 2026-10-16 |
| CVE-2026-78797 An issue in iStoreOS istoreos-24.10.7 and before allows a remote attacker to exe... |
critical | 9.8 | — | — | 2026-10-09 | 2026-10-16 |
| CVE-2026-107845 Contao is an Open Source CMS. |
critical | 9.3 | — | — | 2026-10-09 | 2026-10-16 |
| CVE-2026-78835 Rocket Software Rocket Remote Desktop 18.0.8583.1 is vulnerable to Insufficientl... |
critical | 9.8 | — | — | 2026-10-09 | 2026-10-16 |
| CVE-2026-78796 An issue in Netcore B11 Enterprise-level full Gigabit 9-port shop wireless route... |
critical | 9.8 | — | — | 2026-10-09 | 2026-10-19 |
| CVE-2026-15340 lwIP SMTP client does not check the size of inputs, potentially allowing a buffe... |
critical | 9.8 | — | — | 2026-10-09 | 2026-10-11 |
| CVE-2026-108109 PHPNuxBill through 2025.3.20 contains an account takeover vulnerability in the c... |
critical | 9.1 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-108107 PHPNuxBill through 2025.3.20 contains an unauthenticated SQL injection vulnerabi... |
critical | 9.8 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-105278 The published Docker image for openPDC includes a fixed administrative credentia... |
critical | 9.8 | — | — | 2026-10-09 | 2026-10-11 |
| CVE-2026-100730 A service console interface on openPDC and openHistorian deserializes a client-s... |
critical | 9.8 | — | — | 2026-10-09 | 2026-10-11 |
| CVE-2026-86405 Improper verification of cryptographic signature vulnerability in Sipay Electron... |
critical | 9.8 | — | — | 2026-10-09 | 2026-10-12 |
| CVE-2026-85531 Improper verification of cryptographic signature vulnerability in Sipay Electron... |
critical | 9.8 | — | — | 2026-10-09 | 2026-10-12 |
| CVE-2026-97468 Apache CXF's STSTokenValidator and Security Token Service (STS) cached validated... |
critical | 9.1 | — | Apache / cxf | 2026-10-09 | 2026-10-20 |
| CVE-2026-107938 In Apache CXF, the Netty-based HTTP client transport (cxf-rt-transports-http-net... |
critical | 9.1 | — | Apache / cxf | 2026-10-09 | 2026-10-16 |
| CVE-2026-71575 The max_age authentication-freshness check in OidcClientCodeRequestFilter was in... |
critical | 9.1 | — | Apache / cxf | 2026-10-09 | 2026-10-16 |
| CVE-2026-96809 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
critical | 9.3 | — | — | 2026-10-09 | 2026-10-11 |
| CVE-2026-96331 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
critical | 9.3 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-96327 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
critical | 9.3 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-96328 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
critical | 9.3 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-96330 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
critical | 9.3 | — | — | 2026-10-09 | 2026-10-11 |
| CVE-2026-94503 Unrestricted Upload of File with Dangerous Type vulnerability in PX-lab Zombify... |
critical | 10.0 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-93947 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
critical | 9.3 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-107935 A path traversal vulnerability was found in gvproxy, the network forwarder provi... |
critical | 9.3 | — | — | 2026-10-09 | 2026-11-04 |
| CVE-2026-76779 Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16,... |
critical | 9.8 | — | Dell / policy manager for secure connect gateway | 2026-10-09 | 2026-10-13 |
| CVE-2026-107909 A heap-based out-of-bounds write in the ws_read_frame function (src/bolt/ws.c) a... |
critical | 9.1 | — | — | 2026-10-09 | 2026-10-15 |
| CVE-2026-107908 A heap-based out-of-bounds write in the BoltReadHandler function (src/bolt/bolt_... |
critical | 9.8 | — | — | 2026-10-09 | 2026-10-15 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.