October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,481
Critical
1,390
High
6,087
Medium
6,446
Low
659
Severity not reported
2,899
In CISA KEV
21
Most affected vendors (by CPE data where available): microsoft (1359), google (759), oracle (376), apple (282), ibm (149), adobe (138), apache (73), imagemagick (72), broadcom (61), freerdp (60)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-108576 A vulnerability was found in TOZED X300 up to 6.01.3. |
critical | 10.0 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-85121 The Insurify WordPress plugin through 1.0 does not have authorisation and nonce... |
critical | 9.1 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-86706 The Quick quotes WordPress plugin through 1.0.0 does not perform any capability... |
critical | 9.1 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-86717 The Insurify WordPress plugin through 1.0 does not have authorisation and nonce... |
critical | 9.1 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-84253 The click5 CRM add-on to Gravity Forms WordPress plugin through 1.0.3 does not h... |
critical | 9.8 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-84254 The click5 CRM add-on to Contact Form 7 WordPress plugin through 1.0.4 does not... |
critical | 9.8 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-84734 The Mindstien Quick Login WordPress plugin through 1.0 does not correctly valida... |
critical | 9.8 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-84737 The Freeton WP WordPress plugin through 1.0.0 does not correctly validate the ac... |
critical | 9.8 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-85118 The AI Content Generator Marketing WordPress plugin through 1.0.0 does not enfor... |
critical | 9.8 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-81649 The Fundiin cho WooCommerce WordPress plugin through 3.4.0 does not have proper... |
critical | 9.1 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-84251 The click5 CRM add-on to Ninja Forms WordPress plugin through 1.0.1 does not hav... |
critical | 9.8 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-84252 The click5 CRM add-on to WPForms WordPress plugin through 1.0.3 does not have au... |
critical | 9.8 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-108540 A flaw has been found in OpenSpug Spug up to 3.4.0/4.0.1. |
critical | 9.9 | — | — | 2026-10-11 | 2026-10-14 |
| CVE-2026-104028 The Anton Extensions WordPress plugin through 1.2.2 does not perform any capabil... |
critical | 9.8 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-108707 Wukong_HRM through commit 186115e contains an authentication bypass vulnerabilit... |
critical | 9.8 | — | — | 2026-10-11 | 2026-10-18 |
| CVE-2026-78533 Unauthenticated PHP Object Injection in Qwery <= 3.6.1 versions. |
critical | 9.8 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-78535 Unauthenticated PHP Object Injection in Photolia <= 1.0.3 versions. |
critical | 9.8 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-81797 Unauthenticated PHP Object Injection in Buzz Stone | Magazine & Viral Blog WordP... |
critical | 9.8 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-66567 Unauthenticated PHP Object Injection in Anesta <= 1.5.3 versions. |
critical | 9.8 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-66568 Unauthenticated PHP Object Injection in Original <= 1.9.0 versions. |
critical | 9.8 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-66569 Unauthenticated PHP Object Injection in Kicker <= 2.2.1 versions. |
critical | 9.8 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-78529 Unauthenticated PHP Object Injection in Alliance <= 3.11 versions. |
critical | 9.8 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-78531 Unauthenticated PHP Object Injection in Jacqueline <= 2.22 versions. |
critical | 9.8 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-66482 Unauthenticated PHP Object Injection in Drone Media <= 2.2.0 versions. |
critical | 9.8 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-66483 Unauthenticated PHP Object Injection in Education Center <= 3.6.12 versions. |
critical | 9.8 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-66563 Unauthenticated PHP Object Injection in Windsor <= 2.10 versions. |
critical | 9.8 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-66564 Unauthenticated PHP Object Injection in ShiftCV <= 3.0.14 versions. |
critical | 9.8 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-66565 Unauthenticated PHP Object Injection in FC United <= 1.1.1 versions. |
critical | 9.8 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-62120 Unauthenticated PHP Object Injection in Law Office <= 3.20 versions. |
critical | 9.8 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-62123 Unauthenticated PHP Object Injection in Invetex <= 2.18 versions. |
critical | 9.8 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-62124 Unauthenticated PHP Object Injection in N7 | Golf Club Sports & Events <= 2.21 v... |
critical | 9.8 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-62125 Unauthenticated PHP Object Injection in Asia Garden <= 1.3.1 versions. |
critical | 9.8 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-62129 Contributor Arbitrary File Upload in Creator LMS <= 1.2.21 versions. |
critical | 9.9 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-62076 Unauthenticated PHP Object Injection in Kalles <= 1.1.7.1 versions. |
critical | 9.8 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-62077 Unauthenticated PHP Object Injection in Avala <= 1.1.4 versions. |
critical | 9.8 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-62086 Unauthenticated PHP Object Injection in Juno <= 2.25 versions. |
critical | 9.8 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-62087 Unauthenticated PHP Object Injection in Equadio <= 1.1.4 versions. |
critical | 9.8 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-62090 Unauthenticated PHP Object Injection in WineShop <= 3.20 versions. |
critical | 9.8 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-62050 Unauthenticated PHP Object Injection in Splendour <= 1.23 versions. |
critical | 9.8 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-62051 Unauthenticated PHP Object Injection in Stargaze <= 1.10 versions. |
critical | 9.8 | — | — | 2026-10-10 | 2026-10-13 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.