October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,481
Critical
1,390
High
6,087
Medium
6,446
Low
659
Severity not reported
2,899
In CISA KEV
21
Most affected vendors (by CPE data where available): microsoft (1359), google (759), oracle (376), apple (282), ibm (149), adobe (138), apache (73), imagemagick (72), broadcom (61), freerdp (60)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-62052 Unauthenticated PHP Object Injection in Tipsy <= 1.6 versions. |
critical | 9.8 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-62053 Unauthenticated PHP Object Injection in Wine House <= 3.20 versions. |
critical | 9.8 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-62054 Unauthenticated PHP Object Injection in Yacht Rental <= 2.6 versions. |
critical | 9.8 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-62031 Unauthenticated SQL Injection in uListing <= 2.2.0 versions. |
critical | 9.3 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-62032 Unauthenticated Local File Inclusion in DirectoryPress <= 3.6.27 versions. |
critical | 9.8 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-62022 Unauthenticated Privilege Escalation in Tonda Membership <= 1.0.1 versions. |
critical | 9.8 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-62024 Subscriber Arbitrary File Upload in CodeBard Help Desk <= 1.1.2 versions. |
critical | 9.9 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-62025 Unauthenticated Arbitrary File Upload in Tailored Tools <= 3.0.3 versions. |
critical | 9.0 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-42719 Subscriber PHP Object Injection in Dynamic User Directory <= 2.4 versions. |
critical | 9.8 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-42723 Unauthenticated PHP Object Injection in CleanSkin <= 1.5.0 versions. |
critical | 9.8 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-42716 Unauthenticated PHP Object Injection in Payever - WooCommerce Gateway <= 4.8.2 v... |
critical | 9.8 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-42718 Unauthenticated PHP Object Injection in Booster for WooCommerce <= 8.4.0 version... |
critical | 9.8 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-42696 Improper Control of Generation of Code ('Code Injection') vulnerability in Royal... |
critical | 10.0 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-39801 Subscriber Privilege Escalation in AIWU <= 1.5.9 versions. |
critical | 9.8 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-40800 Subscriber SQL Injection in ELEX WooCommerce Advanced Bulk Edit Products, Prices... |
critical | 9.3 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-108598 Floci 1.1.0 before 2.2.0 contains a code injection vulnerability in VtlTemplateE... |
critical | 9.8 | — | — | 2026-10-10 | 2026-10-16 |
| CVE-2026-106610 Incorrect Privilege Assignment vulnerability in miniOrange miniorange otp verifi... |
critical | 9.8 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-105892 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') v... |
critical | 9.8 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-105889 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
critical | 9.3 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-104398 Deserialization of Untrusted Data vulnerability in VillaTheme AFFI – Affiliate M... |
critical | 9.8 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-108551 openapi-typescript-codegen through 0.31.0 contains a code injection vulnerabilit... |
critical | 9.8 | — | — | 2026-10-10 | 2026-10-16 |
| CVE-2026-107373 ExtUtils::Typemaps::STL::String versions before 1.06 for Perl T_STD_STRING typem... |
critical | 9.1 | — | — | 2026-10-10 | 2026-10-16 |
| CVE-2026-103513 Out-of-bounds read and write in the CPC sketch deserialization of Apache DataSke... |
critical | 9.8 | — | — | 2026-10-10 | 2026-10-16 |
| CVE-2026-103635 Out-of-bounds read in the compact Theta sketch deserialization of Apache DataSke... |
critical | 9.1 | — | — | 2026-10-10 | 2026-10-16 |
| CVE-2026-103501 Heap buffer overflow in the HLL sketch deserialization of Apache DataSketches C+... |
critical | 9.8 | — | — | 2026-10-10 | 2026-10-16 |
| CVE-2026-93945 Deserialization of Untrusted Data vulnerability in Axiomthemes Balance balance a... |
critical | 9.8 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-93936 Deserialization of Untrusted Data vulnerability in ThemeREX Group IPharm ipharm... |
critical | 9.8 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-93937 Deserialization of Untrusted Data vulnerability in ThemeREX Group Hygia hygia al... |
critical | 9.8 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-93938 Deserialization of Untrusted Data vulnerability in ThemeREX Group Hogwords hogwo... |
critical | 9.8 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-93940 Deserialization of Untrusted Data vulnerability in ThemeREX Group Greeny greeny... |
critical | 9.8 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-93941 Deserialization of Untrusted Data vulnerability in ThemeREX Group Edema edema al... |
critical | 9.8 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-93942 Deserialization of Untrusted Data vulnerability in ThemeREX Group Dwell dwell al... |
critical | 9.8 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-93943 Deserialization of Untrusted Data vulnerability in ThemeREX Group Convex convex... |
critical | 9.8 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-93944 Deserialization of Untrusted Data vulnerability in ThemeREX Group Camelia cameli... |
critical | 9.8 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-93927 Deserialization of Untrusted Data vulnerability in Axiomthemes Veto veto allows... |
critical | 9.8 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-93929 Deserialization of Untrusted Data vulnerability in ThemeREX Group Travesia trave... |
critical | 9.8 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-93930 Deserialization of Untrusted Data vulnerability in ThemeREX Group Tantra tantra... |
critical | 9.8 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-93931 Deserialization of Untrusted Data vulnerability in ThemeREX Group Smash smash al... |
critical | 9.8 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-93932 Deserialization of Untrusted Data vulnerability in ThemeREX Group Smart Casa sma... |
critical | 9.8 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-93933 Deserialization of Untrusted Data vulnerability in ThemeREX Group Rosalinda rosa... |
critical | 9.8 | — | — | 2026-10-10 | 2026-10-13 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.