October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
24,478
Critical
3,285
High
7,907
Medium
7,598
Low
740
Severity not reported
4,948
In CISA KEV
191
Most affected vendors (by CPE data where available): microsoft (1424), google (825), linux (722), ibm (323), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (116), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-65162 NVIDIA AIStore for Linux contains a vulnerability in the legacy ETL Kubernetes P... |
critical | 10.0 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-65173 NVIDIA AIStore for Linux contains a missing authentication vulnerability in the... |
critical | 9.1 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-96012 IBM Db2 Mirror for i 7.4, 7.5, and 7.6 is vulnerable to privilege escalation. |
critical | 9.9 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-90920 IBM Maximo AI Service 9.1.0, and 9.2.0 could allow a remote attacker to execute... |
critical | 9.8 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-108895 A weakness has been identified in Linksys E1700 1.0.0.4.003. |
critical | 9.9 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-104192 Dragonfly is an in-memory data store built for modern application workloads. |
critical | 9.6 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-100828 Mitigation bypass in the Bookmarks & History component. |
critical | 9.6 | — | Mozilla / firefox | 2026-09-29 | 2026-10-13 |
| CVE-2026-100829 Mitigation bypass in the DOM: Security component. |
critical | 9.6 | — | Mozilla / firefox | 2026-09-29 | 2026-10-13 |
| CVE-2026-49243 Webmin is a web-based system administration tool for Unix-like servers. |
critical | 9.6 | — | — | 2026-09-29 | 2026-10-13 |
| CVE-2026-101023 Gitea's OAuth2 token endpoint verified the signature and grant of a token submit... |
critical | 9.1 | — | Gitea / gitea | 2026-10-06 | 2026-10-13 |
| CVE-2026-106501 Backstage is an open framework for building developer portals. |
critical | 9.6 | — | Linuxfoundation / backstage\/plugin-scaffolder-backend | 2026-10-06 | 2026-10-13 |
| CVE-2026-92414 : Session Fixation / Session Reuse across Users vulnerability in Apache Jackrabb... |
critical | 9.1 | — | Apache / jackrabbit | 2026-10-07 | 2026-10-13 |
| CVE-2026-104732 The Advanced IP Blocker plugin for WordPress is vulnerable to Authentication Byp... |
critical | 9.8 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-107645 The Blocksy Companion plugin for WordPress is vulnerable to privilege escalation... |
critical | 9.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-103889 The 3D Product configurator for WooCommerce plugin for WordPress is vulnerable t... |
critical | 9.8 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-104801 The PPOM – Product Addons & Custom Fields for WooCommerce plugin for WordPress i... |
critical | 9.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-104803 The WPCOM Member plugin for WordPress is vulnerable to Authentication Bypass in... |
critical | 9.8 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-94589 The Extensions For CF7 (Contact form 7 Database, Conditional Fields and Redirect... |
critical | 9.8 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-97670 The Avada (Fusion) Builder plugin for WordPress is vulnerable to authorization b... |
critical | 9.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-66569 Unauthenticated PHP Object Injection in Kicker <= 2.2.1 versions. |
critical | 9.8 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-78529 Unauthenticated PHP Object Injection in Alliance <= 3.11 versions. |
critical | 9.8 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-78531 Unauthenticated PHP Object Injection in Jacqueline <= 2.22 versions. |
critical | 9.8 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-78533 Unauthenticated PHP Object Injection in Qwery <= 3.6.1 versions. |
critical | 9.8 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-78535 Unauthenticated PHP Object Injection in Photolia <= 1.0.3 versions. |
critical | 9.8 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-81797 Unauthenticated PHP Object Injection in Buzz Stone | Magazine & Viral Blog WordP... |
critical | 9.8 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-62045 Deserialization of Untrusted Data vulnerability in ThemeREX Group Booklovers boo... |
critical | 9.8 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-62046 Deserialization of Untrusted Data vulnerability in ThemeREX Group Gutentype gute... |
critical | 9.8 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-93927 Deserialization of Untrusted Data vulnerability in Axiomthemes Veto veto allows... |
critical | 9.8 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-93929 Deserialization of Untrusted Data vulnerability in ThemeREX Group Travesia trave... |
critical | 9.8 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-93930 Deserialization of Untrusted Data vulnerability in ThemeREX Group Tantra tantra... |
critical | 9.8 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-93931 Deserialization of Untrusted Data vulnerability in ThemeREX Group Smash smash al... |
critical | 9.8 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-93932 Deserialization of Untrusted Data vulnerability in ThemeREX Group Smart Casa sma... |
critical | 9.8 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-93933 Deserialization of Untrusted Data vulnerability in ThemeREX Group Rosalinda rosa... |
critical | 9.8 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-93934 Deserialization of Untrusted Data vulnerability in ThemeREX Group Partiso partis... |
critical | 9.8 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-93935 Deserialization of Untrusted Data vulnerability in ThemeREX Group Let's Play pla... |
critical | 9.8 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-93936 Deserialization of Untrusted Data vulnerability in ThemeREX Group IPharm ipharm... |
critical | 9.8 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-93937 Deserialization of Untrusted Data vulnerability in ThemeREX Group Hygia hygia al... |
critical | 9.8 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-93938 Deserialization of Untrusted Data vulnerability in ThemeREX Group Hogwords hogwo... |
critical | 9.8 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-93940 Deserialization of Untrusted Data vulnerability in ThemeREX Group Greeny greeny... |
critical | 9.8 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-93941 Deserialization of Untrusted Data vulnerability in ThemeREX Group Edema edema al... |
critical | 9.8 | — | — | 2026-10-10 | 2026-10-13 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.