October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 29, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
16,216
Critical
1,207
High
5,399
Medium
5,736
Low
602
Severity not reported
3,272
In CISA KEV
17
Most affected vendors (by CPE data where available): microsoft (1078), google (711), ibm (140), oracle (117), adobe (110), broadcom (61), apache (45), freerdp (42), linuxfoundation (41), dell (40)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-66482 Unauthenticated PHP Object Injection in Drone Media <= 2.2.0 versions. |
critical | 9.8 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-66483 Unauthenticated PHP Object Injection in Education Center <= 3.6.12 versions. |
critical | 9.8 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-66563 Unauthenticated PHP Object Injection in Windsor <= 2.10 versions. |
critical | 9.8 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-66564 Unauthenticated PHP Object Injection in ShiftCV <= 3.0.14 versions. |
critical | 9.8 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-66565 Unauthenticated PHP Object Injection in FC United <= 1.1.1 versions. |
critical | 9.8 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-62120 Unauthenticated PHP Object Injection in Law Office <= 3.20 versions. |
critical | 9.8 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-62123 Unauthenticated PHP Object Injection in Invetex <= 2.18 versions. |
critical | 9.8 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-62124 Unauthenticated PHP Object Injection in N7 | Golf Club Sports & Events <= 2.21 v... |
critical | 9.8 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-62125 Unauthenticated PHP Object Injection in Asia Garden <= 1.3.1 versions. |
critical | 9.8 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-62129 Contributor Arbitrary File Upload in Creator LMS <= 1.2.21 versions. |
critical | 9.9 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-62076 Unauthenticated PHP Object Injection in Kalles <= 1.1.7.1 versions. |
critical | 9.8 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-62077 Unauthenticated PHP Object Injection in Avala <= 1.1.4 versions. |
critical | 9.8 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-62086 Unauthenticated PHP Object Injection in Juno <= 2.25 versions. |
critical | 9.8 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-62087 Unauthenticated PHP Object Injection in Equadio <= 1.1.4 versions. |
critical | 9.8 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-62090 Unauthenticated PHP Object Injection in WineShop <= 3.20 versions. |
critical | 9.8 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-62050 Unauthenticated PHP Object Injection in Splendour <= 1.23 versions. |
critical | 9.8 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-62051 Unauthenticated PHP Object Injection in Stargaze <= 1.10 versions. |
critical | 9.8 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-62052 Unauthenticated PHP Object Injection in Tipsy <= 1.6 versions. |
critical | 9.8 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-62053 Unauthenticated PHP Object Injection in Wine House <= 3.20 versions. |
critical | 9.8 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-62054 Unauthenticated PHP Object Injection in Yacht Rental <= 2.6 versions. |
critical | 9.8 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-62031 Unauthenticated SQL Injection in uListing <= 2.2.0 versions. |
critical | 9.3 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-62032 Unauthenticated Local File Inclusion in DirectoryPress <= 3.6.27 versions. |
critical | 9.8 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-62022 Unauthenticated Privilege Escalation in Tonda Membership <= 1.0.1 versions. |
critical | 9.8 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-62024 Subscriber Arbitrary File Upload in CodeBard Help Desk <= 1.1.2 versions. |
critical | 9.9 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-62025 Unauthenticated Arbitrary File Upload in Tailored Tools <= 3.0.3 versions. |
critical | 9.0 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-42719 Subscriber PHP Object Injection in Dynamic User Directory <= 2.4 versions. |
critical | 9.8 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-42723 Unauthenticated PHP Object Injection in CleanSkin <= 1.5.0 versions. |
critical | 9.8 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-42716 Unauthenticated PHP Object Injection in Payever - WooCommerce Gateway <= 4.8.2 v... |
critical | 9.8 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-42718 Unauthenticated PHP Object Injection in Booster for WooCommerce <= 8.4.0 version... |
critical | 9.8 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-42696 Improper Control of Generation of Code ('Code Injection') vulnerability in Royal... |
critical | 10.0 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-39801 Subscriber Privilege Escalation in AIWU <= 1.5.9 versions. |
critical | 9.8 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-40800 Subscriber SQL Injection in ELEX WooCommerce Advanced Bulk Edit Products, Prices... |
critical | 9.3 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-108598 Floci 1.1.0 before 2.2.0 contains a code injection vulnerability in VtlTemplateE... |
critical | 9.8 | — | — | 2026-10-10 | 2026-10-16 |
| CVE-2026-106610 Incorrect Privilege Assignment vulnerability in miniOrange miniorange otp verifi... |
critical | 9.8 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-105892 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') v... |
critical | 9.8 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-105889 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
critical | 9.3 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-104398 Deserialization of Untrusted Data vulnerability in VillaTheme AFFI – Affiliate M... |
critical | 9.8 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-108551 openapi-typescript-codegen through 0.31.0 contains a code injection vulnerabilit... |
critical | 9.8 | — | — | 2026-10-10 | 2026-10-16 |
| CVE-2026-107373 ExtUtils::Typemaps::STL::String versions before 1.06 for Perl T_STD_STRING typem... |
critical | 9.1 | — | — | 2026-10-10 | 2026-10-16 |
| CVE-2026-103513 Out-of-bounds read and write in the CPC sketch deserialization of Apache DataSke... |
critical | 9.8 | — | — | 2026-10-10 | 2026-10-16 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.