October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 29, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
16,204
Critical
1,207
High
5,399
Medium
5,731
Low
600
Severity not reported
3,267
In CISA KEV
17
Most affected vendors (by CPE data where available): microsoft (1078), google (711), ibm (140), oracle (117), adobe (110), broadcom (61), apache (45), freerdp (42), linuxfoundation (41), dell (40)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-55486 The Goobi viewer is a web application that allows digitised material to be displ... |
critical | 9.3 | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-53942 Conda Organization Infrastructure is a centralized location for infrastructure c... |
critical | 9.9 | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-46651 The Goobi viewer is a web application that allows digitised material to be displ... |
critical | 9.8 | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-46652 The Goobi viewer is a web application that allows digitised material to be displ... |
critical | 9.8 | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-53921 odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. |
critical | 9.8 | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-99079 In the Linux kernel, the following vulnerability has been resolved:
net/mlx5e:... |
critical | 9.8 | — | — | 2026-10-23 | 2026-10-24 |
| CVE-2026-99078 In the Linux kernel, the following vulnerability has been resolved:
net/mlx5e:... |
critical | 9.8 | — | — | 2026-10-23 | 2026-10-24 |
| CVE-2026-98959 In the Linux kernel, the following vulnerability has been resolved:
btrfs: fix... |
critical | 9.8 | — | — | 2026-10-23 | 2026-10-24 |
| CVE-2026-57116 PraisonAI is a multi-agent teams system. |
critical | 9.8 | — | — | 2026-10-23 | 2026-10-29 |
| CVE-2026-112854 Deserialization of Untrusted Data vulnerability in axiomthemes Holistic Center h... |
critical | 9.8 | — | — | 2026-10-23 | 2026-10-24 |
| CVE-2026-112855 Deserialization of Untrusted Data vulnerability in axiomthemes Redy redy allows... |
critical | 9.8 | — | — | 2026-10-23 | 2026-10-24 |
| CVE-2026-112856 Deserialization of Untrusted Data vulnerability in ThemeREX Group Vagabonds vaga... |
critical | 9.8 | — | — | 2026-10-23 | 2026-10-24 |
| CVE-2026-112857 Deserialization of Untrusted Data vulnerability in axiomthemes Reprizo reprizo a... |
critical | 9.8 | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-112858 Deserialization of Untrusted Data vulnerability in axiomthemes Rhodos rhodos all... |
critical | 9.8 | — | — | 2026-10-23 | 2026-10-24 |
| CVE-2026-112859 Deserialization of Untrusted Data vulnerability in ThemeREX Group Little Birdies... |
critical | 9.8 | — | — | 2026-10-23 | 2026-10-24 |
| CVE-2026-112846 Deserialization of Untrusted Data vulnerability in ThemeREX Group Save Life save... |
critical | 9.8 | — | — | 2026-10-23 | 2026-10-24 |
| CVE-2026-112847 Deserialization of Untrusted Data vulnerability in ThemeREX ZenSoul zensoul allo... |
critical | 9.8 | — | — | 2026-10-23 | 2026-10-24 |
| CVE-2026-112848 Deserialization of Untrusted Data vulnerability in AivahThemes Hostme v2 hostmev... |
critical | 9.8 | — | — | 2026-10-23 | 2026-10-24 |
| CVE-2026-112851 Deserialization of Untrusted Data vulnerability in ThemeREX Group HotLock hotloc... |
critical | 9.8 | — | — | 2026-10-23 | 2026-10-24 |
| CVE-2026-112853 Deserialization of Untrusted Data vulnerability in axiomthemes Hallelujah hallel... |
critical | 9.8 | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-112860 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
critical | 9.3 | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-112862 Deserialization of Untrusted Data vulnerability in xnau webdesign Participants D... |
critical | 9.8 | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-25784 Initialization of a Resource with an Insecure Default vulnerability in Hallo Wel... |
critical | 9.8 | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-63244 An authentication
bypass vulnerability in WizLearn Technologies' Learning Manage... |
critical | 9.8 | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-55981 A firmware verification vulnerability in Creative Sound
Blaster Katana could all... |
critical | 9.6 | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-94267 The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced C... |
critical | 9.0 | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-54630 Part-DB is an open source inventory management system for electronic components. |
critical | 9.6 | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-115547 An input validation issue in the Okta Access Gateway (OAG) Admin Console allows... |
critical | 9.1 | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-110243 The network management service on affected Kiloview E3 NDI encoder firmware fail... |
critical | 9.9 | — | — | 2026-10-22 | 2026-10-23 |
| CVE-2026-107861 The system control service on affected Kiloview E3 NDI encoder firmware fails to... |
critical | 9.9 | — | — | 2026-10-22 | 2026-10-23 |
| CVE-2026-97785 Improper authentication in AAD App Proxy allows an unauthorized attacker to elev... |
critical | 10.0 | — | — | 2026-10-22 | 2026-10-26 |
| CVE-2026-83938 Missing authentication for critical function in Azure Kubernetes Configuration S... |
critical | 10.0 | — | — | 2026-10-22 | 2026-10-26 |
| CVE-2026-110063 Improper link resolution before file access ('link following') in VM Inspector f... |
critical | 10.0 | — | — | 2026-10-22 | 2026-10-27 |
| CVE-2026-109122 The network management service on affected Kiloview E3 NDI encoder firmware fail... |
critical | 9.1 | — | — | 2026-10-22 | 2026-10-23 |
| CVE-2026-105014 Improper neutralization of special elements used in a command ('command injectio... |
critical | 9.1 | — | — | 2026-10-22 | 2026-10-24 |
| CVE-2026-114625 Arista VeloCloud Orchestrator SQL Injection Vulnerability |
critical | 9.9 | Listed | Arista / VeloCloud Orchestrator | 2026-10-22 | 2026-10-26 |
| CVE-2026-79876 A sensitive information disclosure vulnerability in the Wi-Fi frame processing o... |
critical | 9.3 | — | — | 2026-10-22 | 2026-10-26 |
| CVE-2026-79867 Authentication bypass vulnerabilities in the affected interface of AOS-8 could a... |
critical | 9.6 | — | — | 2026-10-22 | 2026-10-26 |
| CVE-2026-79868 Authentication bypass vulnerabilities in the affected interface of AOS-8 could a... |
critical | 9.6 | — | — | 2026-10-22 | 2026-10-26 |
| CVE-2026-79869 Authentication bypass vulnerabilities in the affected interface of AOS-10 could... |
critical | 9.6 | — | — | 2026-10-22 | 2026-10-26 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.