October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
24,478
Critical
3,285
High
7,907
Medium
7,598
Low
740
Severity not reported
4,948
In CISA KEV
191
Most affected vendors (by CPE data where available): microsoft (1424), google (825), linux (722), ibm (323), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (116), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-93942 Deserialization of Untrusted Data vulnerability in ThemeREX Group Dwell dwell al... |
critical | 9.8 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-93943 Deserialization of Untrusted Data vulnerability in ThemeREX Group Convex convex... |
critical | 9.8 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-93944 Deserialization of Untrusted Data vulnerability in ThemeREX Group Camelia cameli... |
critical | 9.8 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-93945 Deserialization of Untrusted Data vulnerability in Axiomthemes Balance balance a... |
critical | 9.8 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-104398 Deserialization of Untrusted Data vulnerability in VillaTheme AFFI – Affiliate M... |
critical | 9.8 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-105889 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
critical | 9.3 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-105892 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') v... |
critical | 9.8 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-106610 Incorrect Privilege Assignment vulnerability in miniOrange miniorange otp verifi... |
critical | 9.8 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-39801 Subscriber Privilege Escalation in AIWU <= 1.5.9 versions. |
critical | 9.8 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-40800 Subscriber SQL Injection in ELEX WooCommerce Advanced Bulk Edit Products, Prices... |
critical | 9.3 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-42696 Improper Control of Generation of Code ('Code Injection') vulnerability in Royal... |
critical | 10.0 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-42716 Unauthenticated PHP Object Injection in Payever - WooCommerce Gateway <= 4.8.2 v... |
critical | 9.8 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-42718 Unauthenticated PHP Object Injection in Booster for WooCommerce <= 8.4.0 version... |
critical | 9.8 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-42719 Subscriber PHP Object Injection in Dynamic User Directory <= 2.4 versions. |
critical | 9.8 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-42723 Unauthenticated PHP Object Injection in CleanSkin <= 1.5.0 versions. |
critical | 9.8 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-62022 Unauthenticated Privilege Escalation in Tonda Membership <= 1.0.1 versions. |
critical | 9.8 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-62024 Subscriber Arbitrary File Upload in CodeBard Help Desk <= 1.1.2 versions. |
critical | 9.9 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-62025 Unauthenticated Arbitrary File Upload in Tailored Tools <= 3.0.3 versions. |
critical | 9.0 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-62031 Unauthenticated SQL Injection in uListing <= 2.2.0 versions. |
critical | 9.3 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-62032 Unauthenticated Local File Inclusion in DirectoryPress <= 3.6.27 versions. |
critical | 9.8 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-62050 Unauthenticated PHP Object Injection in Splendour <= 1.23 versions. |
critical | 9.8 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-62051 Unauthenticated PHP Object Injection in Stargaze <= 1.10 versions. |
critical | 9.8 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-62052 Unauthenticated PHP Object Injection in Tipsy <= 1.6 versions. |
critical | 9.8 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-62053 Unauthenticated PHP Object Injection in Wine House <= 3.20 versions. |
critical | 9.8 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-62054 Unauthenticated PHP Object Injection in Yacht Rental <= 2.6 versions. |
critical | 9.8 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-62076 Unauthenticated PHP Object Injection in Kalles <= 1.1.7.1 versions. |
critical | 9.8 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-62077 Unauthenticated PHP Object Injection in Avala <= 1.1.4 versions. |
critical | 9.8 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-62086 Unauthenticated PHP Object Injection in Juno <= 2.25 versions. |
critical | 9.8 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-62087 Unauthenticated PHP Object Injection in Equadio <= 1.1.4 versions. |
critical | 9.8 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-62090 Unauthenticated PHP Object Injection in WineShop <= 3.20 versions. |
critical | 9.8 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-62120 Unauthenticated PHP Object Injection in Law Office <= 3.20 versions. |
critical | 9.8 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-62123 Unauthenticated PHP Object Injection in Invetex <= 2.18 versions. |
critical | 9.8 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-62124 Unauthenticated PHP Object Injection in N7 | Golf Club Sports & Events <= 2.21 v... |
critical | 9.8 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-62125 Unauthenticated PHP Object Injection in Asia Garden <= 1.3.1 versions. |
critical | 9.8 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-62129 Contributor Arbitrary File Upload in Creator LMS <= 1.2.21 versions. |
critical | 9.9 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-66482 Unauthenticated PHP Object Injection in Drone Media <= 2.2.0 versions. |
critical | 9.8 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-66483 Unauthenticated PHP Object Injection in Education Center <= 3.6.12 versions. |
critical | 9.8 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-66563 Unauthenticated PHP Object Injection in Windsor <= 2.10 versions. |
critical | 9.8 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-66564 Unauthenticated PHP Object Injection in ShiftCV <= 3.0.14 versions. |
critical | 9.8 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-66565 Unauthenticated PHP Object Injection in FC United <= 1.1.1 versions. |
critical | 9.8 | — | — | 2026-10-10 | 2026-10-13 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.