October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 29, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
16,216
Critical
1,207
High
5,399
Medium
5,736
Low
602
Severity not reported
3,272
In CISA KEV
17
Most affected vendors (by CPE data where available): microsoft (1078), google (711), ibm (140), oracle (117), adobe (110), broadcom (61), apache (45), freerdp (42), linuxfoundation (41), dell (40)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-103635 Out-of-bounds read in the compact Theta sketch deserialization of Apache DataSke... |
critical | 9.1 | — | — | 2026-10-10 | 2026-10-16 |
| CVE-2026-103501 Heap buffer overflow in the HLL sketch deserialization of Apache DataSketches C+... |
critical | 9.8 | — | — | 2026-10-10 | 2026-10-16 |
| CVE-2026-93945 Deserialization of Untrusted Data vulnerability in Axiomthemes Balance balance a... |
critical | 9.8 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-93936 Deserialization of Untrusted Data vulnerability in ThemeREX Group IPharm ipharm... |
critical | 9.8 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-93937 Deserialization of Untrusted Data vulnerability in ThemeREX Group Hygia hygia al... |
critical | 9.8 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-93938 Deserialization of Untrusted Data vulnerability in ThemeREX Group Hogwords hogwo... |
critical | 9.8 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-93940 Deserialization of Untrusted Data vulnerability in ThemeREX Group Greeny greeny... |
critical | 9.8 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-93941 Deserialization of Untrusted Data vulnerability in ThemeREX Group Edema edema al... |
critical | 9.8 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-93942 Deserialization of Untrusted Data vulnerability in ThemeREX Group Dwell dwell al... |
critical | 9.8 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-93943 Deserialization of Untrusted Data vulnerability in ThemeREX Group Convex convex... |
critical | 9.8 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-93944 Deserialization of Untrusted Data vulnerability in ThemeREX Group Camelia cameli... |
critical | 9.8 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-93927 Deserialization of Untrusted Data vulnerability in Axiomthemes Veto veto allows... |
critical | 9.8 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-93929 Deserialization of Untrusted Data vulnerability in ThemeREX Group Travesia trave... |
critical | 9.8 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-93930 Deserialization of Untrusted Data vulnerability in ThemeREX Group Tantra tantra... |
critical | 9.8 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-93931 Deserialization of Untrusted Data vulnerability in ThemeREX Group Smash smash al... |
critical | 9.8 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-93932 Deserialization of Untrusted Data vulnerability in ThemeREX Group Smart Casa sma... |
critical | 9.8 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-93933 Deserialization of Untrusted Data vulnerability in ThemeREX Group Rosalinda rosa... |
critical | 9.8 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-93934 Deserialization of Untrusted Data vulnerability in ThemeREX Group Partiso partis... |
critical | 9.8 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-93935 Deserialization of Untrusted Data vulnerability in ThemeREX Group Let's Play pla... |
critical | 9.8 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-104803 The WPCOM Member plugin for WordPress is vulnerable to Authentication Bypass in... |
critical | 9.8 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-62045 Deserialization of Untrusted Data vulnerability in ThemeREX Group Booklovers boo... |
critical | 9.8 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-62046 Deserialization of Untrusted Data vulnerability in ThemeREX Group Gutentype gute... |
critical | 9.8 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-104801 The PPOM – Product Addons & Custom Fields for WooCommerce plugin for WordPress i... |
critical | 9.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-97670 The Avada (Fusion) Builder plugin for WordPress is vulnerable to authorization b... |
critical | 9.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-103889 The 3D Product configurator for WooCommerce plugin for WordPress is vulnerable t... |
critical | 9.8 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-94589 The Extensions For CF7 (Contact form 7 Database, Conditional Fields and Redirect... |
critical | 9.8 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-107645 The Blocksy Companion plugin for WordPress is vulnerable to privilege escalation... |
critical | 9.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-104732 The Advanced IP Blocker plugin for WordPress is vulnerable to Authentication Byp... |
critical | 9.8 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-108474 In JetBrains Exposed before 1.5.1 sQL injection was possible via unescaped strin... |
critical | 9.8 | — | — | 2026-10-10 | 2026-10-14 |
| CVE-2026-108261 Tina is a headless content management system. |
critical | 9.3 | — | — | 2026-10-09 | 2026-10-16 |
| CVE-2026-108263 Astron Agent is an agentic workflow platform for building and running AI agents. |
critical | 9.9 | — | — | 2026-10-09 | 2026-10-16 |
| CVE-2026-108264 Wizarr is an advanced user invitation and management system for Jellyfin, Plex,... |
critical | 9.1 | — | — | 2026-10-09 | 2026-10-16 |
| CVE-2026-78797 An issue in iStoreOS istoreos-24.10.7 and before allows a remote attacker to exe... |
critical | 9.8 | — | — | 2026-10-09 | 2026-10-16 |
| CVE-2026-107845 Contao is an Open Source CMS. |
critical | 9.3 | — | — | 2026-10-09 | 2026-10-16 |
| CVE-2026-78835 Rocket Software Rocket Remote Desktop 18.0.8583.1 is vulnerable to Insufficientl... |
critical | 9.8 | — | — | 2026-10-09 | 2026-10-16 |
| CVE-2026-78796 An issue in Netcore B11 Enterprise-level full Gigabit 9-port shop wireless route... |
critical | 9.8 | — | — | 2026-10-09 | 2026-10-19 |
| CVE-2026-15340 lwIP SMTP client does not check the size of inputs, potentially allowing a buffe... |
critical | 9.8 | — | — | 2026-10-09 | 2026-10-11 |
| CVE-2026-108109 PHPNuxBill through 2025.3.20 contains an account takeover vulnerability in the c... |
critical | 9.1 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-108107 PHPNuxBill through 2025.3.20 contains an unauthenticated SQL injection vulnerabi... |
critical | 9.8 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-105278 The published Docker image for openPDC includes a fixed administrative credentia... |
critical | 9.8 | — | — | 2026-10-09 | 2026-10-11 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.