October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,481
Critical
1,390
High
6,087
Medium
6,446
Low
659
Severity not reported
2,899
In CISA KEV
21
Most affected vendors (by CPE data where available): microsoft (1359), google (759), oracle (376), apple (282), ibm (149), adobe (138), apache (73), imagemagick (72), broadcom (61), freerdp (60)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-112846 Deserialization of Untrusted Data vulnerability in ThemeREX Group Save Life save... |
critical | 9.8 | — | — | 2026-10-23 | 2026-10-24 |
| CVE-2026-112847 Deserialization of Untrusted Data vulnerability in ThemeREX ZenSoul zensoul allo... |
critical | 9.8 | — | — | 2026-10-23 | 2026-10-24 |
| CVE-2026-112848 Deserialization of Untrusted Data vulnerability in AivahThemes Hostme v2 hostmev... |
critical | 9.8 | — | — | 2026-10-23 | 2026-10-24 |
| CVE-2026-112851 Deserialization of Untrusted Data vulnerability in ThemeREX Group HotLock hotloc... |
critical | 9.8 | — | — | 2026-10-23 | 2026-10-24 |
| CVE-2026-112853 Deserialization of Untrusted Data vulnerability in axiomthemes Hallelujah hallel... |
critical | 9.8 | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-112860 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
critical | 9.3 | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-112862 Deserialization of Untrusted Data vulnerability in xnau webdesign Participants D... |
critical | 9.8 | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-25784 Initialization of a Resource with an Insecure Default vulnerability in Hallo Wel... |
critical | 9.8 | — | — | 2026-10-23 | 2026-11-02 |
| CVE-2026-63244 An authentication
bypass vulnerability in WizLearn Technologies' Learning Manage... |
critical | 9.8 | — | — | 2026-10-23 | 2026-11-02 |
| CVE-2026-55981 A firmware verification vulnerability in Creative Sound
Blaster Katana could all... |
critical | 9.6 | — | — | 2026-10-23 | 2026-11-02 |
| CVE-2026-94267 The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced C... |
critical | 9.0 | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-54630 Part-DB is an open source inventory management system for electronic components. |
critical | 9.6 | — | — | 2026-10-23 | 2026-10-29 |
| CVE-2026-115547 An input validation issue in the Okta Access Gateway (OAG) Admin Console allows... |
critical | 9.1 | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-110243 The network management service on affected Kiloview E3 NDI encoder firmware fail... |
critical | 9.9 | — | — | 2026-10-22 | 2026-10-23 |
| CVE-2026-107861 The system control service on affected Kiloview E3 NDI encoder firmware fails to... |
critical | 9.9 | — | — | 2026-10-22 | 2026-10-23 |
| CVE-2026-97785 Improper authentication in AAD App Proxy allows an unauthorized attacker to elev... |
critical | 10.0 | — | — | 2026-10-22 | 2026-10-26 |
| CVE-2026-83938 Missing authentication for critical function in Azure Kubernetes Configuration S... |
critical | 10.0 | — | — | 2026-10-22 | 2026-10-26 |
| CVE-2026-114615 Authlib is a Python library which builds OAuth and OpenID Connect servers. |
critical | 9.1 | — | Authlib / authlib | 2026-10-22 | 2026-10-29 |
| CVE-2026-114616 Authlib is a Python library which builds OAuth and OpenID Connect servers. |
critical | 9.1 | — | Authlib / authlib | 2026-10-22 | 2026-10-30 |
| CVE-2026-110063 Improper link resolution before file access ('link following') in VM Inspector f... |
critical | 10.0 | — | — | 2026-10-22 | 2026-10-27 |
| CVE-2026-109122 The network management service on affected Kiloview E3 NDI encoder firmware fail... |
critical | 9.1 | — | — | 2026-10-22 | 2026-10-23 |
| CVE-2026-105014 Improper neutralization of special elements used in a command ('command injectio... |
critical | 9.1 | — | — | 2026-10-22 | 2026-10-24 |
| CVE-2026-114625 Arista VeloCloud Orchestrator SQL Injection Vulnerability |
critical | 9.9 | Listed | Arista / VeloCloud Orchestrator | 2026-10-22 | 2026-10-26 |
| CVE-2026-79876 A sensitive information disclosure vulnerability in the Wi-Fi frame processing o... |
critical | 9.3 | — | — | 2026-10-22 | 2026-10-30 |
| CVE-2026-79867 Authentication bypass vulnerabilities in the affected interface of AOS-8 could a... |
critical | 9.6 | — | — | 2026-10-22 | 2026-10-30 |
| CVE-2026-79868 Authentication bypass vulnerabilities in the affected interface of AOS-8 could a... |
critical | 9.6 | — | — | 2026-10-22 | 2026-10-30 |
| CVE-2026-79869 Authentication bypass vulnerabilities in the affected interface of AOS-10 could... |
critical | 9.6 | — | — | 2026-10-22 | 2026-11-02 |
| CVE-2026-79870 An authentication bypass vulnerability in the PAPI protocol of AOS-8 could allow... |
critical | 9.6 | — | — | 2026-10-22 | 2026-11-02 |
| CVE-2026-79871 A sensitive information disclosure vulnerability in the command line interface o... |
critical | 9.6 | — | — | 2026-10-22 | 2026-11-02 |
| CVE-2026-79872 A buffer overflow vulnerability exists in the underlying operating system of AOS... |
critical | 9.4 | — | — | 2026-10-22 | 2026-11-02 |
| CVE-2026-79873 Authentication bypass vulnerabilities in the PAPI protocol of AOS-10 could allow... |
critical | 9.3 | — | — | 2026-10-22 | 2026-11-02 |
| CVE-2026-79874 An authentication bypass in the API of AOS-10 allows an unauthenticated adjacent... |
critical | 9.3 | — | — | 2026-10-22 | 2026-11-02 |
| CVE-2026-79875 A vulnerability has been identified in the PAPI protocol of AOS-8 that could pot... |
critical | 9.3 | — | — | 2026-10-22 | 2026-10-30 |
| CVE-2026-79858 An unauthenticated SQL injection vulnerability exists in the PAPI protocol in AO... |
critical | 9.8 | — | — | 2026-10-22 | 2026-10-30 |
| CVE-2026-79859 Buffer overflow vulnerabilities exist in the affected interface of AOS-8 that co... |
critical | 9.8 | — | — | 2026-10-22 | 2026-10-30 |
| CVE-2026-79860 Buffer overflow vulnerabilities exist in an underlying service of AOS-8 that cou... |
critical | 9.8 | — | — | 2026-10-22 | 2026-10-30 |
| CVE-2026-79861 There is a command injection vulnerability in AOS-10 that could lead to unauthen... |
critical | 9.8 | — | — | 2026-10-22 | 2026-10-30 |
| CVE-2026-79862 Buffer overflow vulnerabilities in the affected interface of AOS-10 or AOS-8 cou... |
critical | 9.6 | — | — | 2026-10-22 | 2026-10-30 |
| CVE-2026-79863 Buffer overflow vulnerabilities in the affected interface of AOS-10 or AOS-8 cou... |
critical | 9.6 | — | — | 2026-10-22 | 2026-10-30 |
| CVE-2026-79864 Command injection vulnerabilities exist in the affected interface of AOS-10 that... |
critical | 9.6 | — | — | 2026-10-22 | 2026-10-30 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.