CVE-2026-42719: WordPress Dynamic User Directory plugin <= 2.4 - PHP Object Injection vulnerability
Subscriber PHP Object Injection in Dynamic User Directory <= 2.4 versions.
Published Oct 10, 2026 · Updated Oct 11, 2026
CVE archive
Critical CVE Archive
Browse critical-severity CVEs with CVSS, affected products, CWE, KEV, remediation priorities, and source-backed Glexia context.
Showing 50 of 24529 matching CVEs · Page 23 of 491.
CVE-2026-62022: WordPress Tonda Membership plugin <= 1.0.1 - Privilege Escalation vulnerability
Unauthenticated Privilege Escalation in Tonda Membership <= 1.0.1 versions.
Published Oct 10, 2026 · Updated Oct 11, 2026
CVE-2026-62024: WordPress CodeBard Help Desk plugin <= 1.1.2 - Arbitrary File Upload vulnerability
Subscriber Arbitrary File Upload in CodeBard Help Desk <= 1.1.2 versions.
Published Oct 10, 2026 · Updated Oct 11, 2026
CVE-2026-62025: WordPress Tailored Tools plugin <= 3.0.3 - Arbitrary File Upload vulnerability
Unauthenticated Arbitrary File Upload in Tailored Tools <= 3.0.3 versions.
Published Oct 10, 2026 · Updated Oct 11, 2026
CVE-2026-62129: WordPress Creator LMS plugin <= 1.2.21 - Arbitrary File Upload vulnerability
Contributor Arbitrary File Upload in Creator LMS <= 1.2.21 versions.
Published Oct 10, 2026 · Updated Oct 11, 2026
CVE-2026-96330: WordPress tagDiv Opt-In Builder plugin <= 1.7.6 - SQL Injection vulnerability
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in tagDiv tagDiv Opt-In Builder td-subscription allows Blind SQL Injection.This issue affects tagDiv Opt-In Builder: from n/a through 1.7.6.
Published Oct 9, 2026 · Updated Oct 11, 2026
CVE-2026-96809: WordPress EduAdmin Booking plugin < 6.0.0 - SQL Injection vulnerability
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in MultiNet Interactive AB EduAdmin Booking eduadmin-booking allows Blind SQL Injection.This issue affects EduAdmin Booking: from n/a before 6.0.0.
Published Oct 9, 2026 · Updated Oct 11, 2026
CVE-2026-105889: WordPress Tickera plugin <= 3.6.0.6 - SQL Injection vulnerability
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Tickera Tickera tickera-event-ticketing-system allows Blind SQL Injection.This issue affects Tickera: from n/a through 3.6.0.6.
Published Oct 10, 2026 · Updated Oct 11, 2026
CVE-2026-40800: WordPress ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes plugin <= 1.5.3 - SQL Injection vulnerability
Subscriber SQL Injection in ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes <= 1.5.3 versions.
Published Oct 10, 2026 · Updated Oct 11, 2026
CVE-2026-62031: WordPress uListing plugin <= 2.2.0 - SQL Injection vulnerability
Unauthenticated SQL Injection in uListing <= 2.2.0 versions.
Published Oct 10, 2026 · Updated Oct 11, 2026
CVE-2026-42716: WordPress Payever - WooCommerce Gateway plugin <= 4.8.2 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Payever - WooCommerce Gateway <= 4.8.2 versions.
Published Oct 10, 2026 · Updated Oct 11, 2026
CVE-2026-42718: WordPress Booster for WooCommerce plugin <= 8.4.0 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Booster for WooCommerce <= 8.4.0 versions.
Published Oct 10, 2026 · Updated Oct 11, 2026
CVE-2026-42723: WordPress CleanSkin theme <= 1.5.0 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in CleanSkin <= 1.5.0 versions.
Published Oct 10, 2026 · Updated Oct 11, 2026
CVE-2026-62050: WordPress Splendour theme <= 1.23 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Splendour <= 1.23 versions.
Published Oct 10, 2026 · Updated Oct 11, 2026
CVE-2026-62051: WordPress Stargaze theme <= 1.10 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Stargaze <= 1.10 versions.
Published Oct 10, 2026 · Updated Oct 11, 2026
CVE-2026-62052: WordPress Tipsy theme <= 1.6 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Tipsy <= 1.6 versions.
Published Oct 10, 2026 · Updated Oct 11, 2026
CVE-2026-62053: WordPress Wine House theme <= 3.20 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Wine House <= 3.20 versions.
Published Oct 10, 2026 · Updated Oct 11, 2026
CVE-2026-62054: WordPress Yacht Rental theme <= 2.6 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Yacht Rental <= 2.6 versions.
Published Oct 10, 2026 · Updated Oct 11, 2026
CVE-2026-62076: WordPress Kalles theme <= 1.1.7.1 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Kalles <= 1.1.7.1 versions.
Published Oct 10, 2026 · Updated Oct 11, 2026
CVE-2026-62077: WordPress Avala theme <= 1.1.4 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Avala <= 1.1.4 versions.
Published Oct 10, 2026 · Updated Oct 11, 2026
CVE-2026-62086: WordPress Juno theme <= 2.25 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Juno <= 2.25 versions.
Published Oct 10, 2026 · Updated Oct 11, 2026
CVE-2026-62087: WordPress Equadio theme <= 1.1.4 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Equadio <= 1.1.4 versions.
Published Oct 10, 2026 · Updated Oct 11, 2026
CVE-2026-62090: WordPress WineShop theme <= 3.20 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in WineShop <= 3.20 versions.
Published Oct 10, 2026 · Updated Oct 11, 2026
CVE-2026-62120: WordPress Law Office theme <= 3.20 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Law Office <= 3.20 versions.
Published Oct 10, 2026 · Updated Oct 11, 2026
CVE-2026-62123: WordPress Invetex theme <= 2.18 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Invetex <= 2.18 versions.
Published Oct 10, 2026 · Updated Oct 11, 2026
CVE-2026-62124: WordPress N7 | Golf Club Sports & Events theme <= 2.21 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in N7 | Golf Club Sports & Events <= 2.21 versions.
Published Oct 10, 2026 · Updated Oct 11, 2026
CVE-2026-62125: WordPress Asia Garden theme <= 1.3.1 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Asia Garden <= 1.3.1 versions.
Published Oct 10, 2026 · Updated Oct 11, 2026
CVE-2026-66482: WordPress Drone Media theme <= 2.2.0 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Drone Media <= 2.2.0 versions.
Published Oct 10, 2026 · Updated Oct 11, 2026
CVE-2026-66483: WordPress Education Center theme <= 3.6.12 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Education Center <= 3.6.12 versions.
Published Oct 10, 2026 · Updated Oct 11, 2026
CVE-2026-66563: WordPress Windsor theme <= 2.10 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Windsor <= 2.10 versions.
Published Oct 10, 2026 · Updated Oct 11, 2026
CVE-2026-66564: WordPress ShiftCV theme <= 3.0.14 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in ShiftCV <= 3.0.14 versions.
Published Oct 10, 2026 · Updated Oct 11, 2026
CVE-2026-66565: WordPress FC United theme <= 1.1.1 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in FC United <= 1.1.1 versions.
Published Oct 10, 2026 · Updated Oct 11, 2026
CVE-2026-66567: WordPress Anesta theme <= 1.5.3 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Anesta <= 1.5.3 versions.
Published Oct 10, 2026 · Updated Oct 11, 2026
CVE-2026-66568: WordPress Original theme <= 1.9.0 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Original <= 1.9.0 versions.
Published Oct 10, 2026 · Updated Oct 11, 2026
CVE-2026-66569: WordPress Kicker theme <= 2.2.1 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Kicker <= 2.2.1 versions.
Published Oct 10, 2026 · Updated Oct 11, 2026
CVE-2026-78529: WordPress Alliance theme <= 3.11 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Alliance <= 3.11 versions.
Published Oct 10, 2026 · Updated Oct 11, 2026
CVE-2026-78531: WordPress Jacqueline theme <= 2.22 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Jacqueline <= 2.22 versions.
Published Oct 10, 2026 · Updated Oct 11, 2026
CVE-2026-78533: WordPress Qwery theme <= 3.6.1 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Qwery <= 3.6.1 versions.
Published Oct 10, 2026 · Updated Oct 11, 2026
CVE-2026-78535: WordPress Photolia theme <= 1.0.3 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Photolia <= 1.0.3 versions.
Published Oct 10, 2026 · Updated Oct 11, 2026
CVE-2026-81797: WordPress Buzz Stone | Magazine & Viral Blog WordPress Theme theme <= 1.0.2 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Buzz Stone | Magazine & Viral Blog WordPress Theme <= 1.0.2 versions.
Published Oct 10, 2026 · Updated Oct 11, 2026
CVE-2026-62032: WordPress DirectoryPress plugin <= 3.6.27 - Local File Inclusion vulnerability
Unauthenticated Local File Inclusion in DirectoryPress <= 3.6.27 versions.
Published Oct 10, 2026 · Updated Oct 10, 2026
CVE-2026-84272: IBM Guardium Data Protection Missing Authentication
IBM Guardium Data Protection 12.1 and 12.2.2 are vulnerable to missing authentication in the edge-controller component. An unauthenticated remote attacker could exploit this vulnerability to execute arbitrary container images and gain control of managed edge clusters.
Published Oct 8, 2026 · Updated Oct 10, 2026
CVE-2026-78401: Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access
IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote unauthenticated attacker to execute arbitrary code on the system due to the deserialization of untrusted data.
Published Oct 8, 2026 · Updated Oct 10, 2026
CVE-2026-19491: Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access
IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote attacker to bypass authentication due to improper authentication.
Published Oct 8, 2026 · Updated Oct 10, 2026
CVE-2026-16916: Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access
IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote authenticated attacker to execute arbitrary code due to a protection mechanism failure.
Published Oct 8, 2026 · Updated Oct 10, 2026
CVE-2026-14991: IBM DataPower Gateway Out-of-bounds Write
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 is vulnerable to a buffer overflow, caused by improper bounds checking. A local user could overflow the buffer and execute arbitrary code on the system.
Published Oct 8, 2026 · Updated Oct 10, 2026
CVE-2026-79842: An authentication bypass vulnerability exists in HPE Intelligent Management Center (iMC) prior to v7.3 E0713
An authentication bypass vulnerability exists in HPE Intelligent Management Center (iMC) prior to v7.3 E0713
Published Oct 8, 2026 · Updated Oct 10, 2026
CVE-2026-78406: Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access
IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote unauthenticated attacker to execute arbitrary code on the system due to the deserialization of untrusted data.
Published Oct 8, 2026 · Updated Oct 10, 2026
CVE-2026-16823: Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access
IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote attacker to bypass security restrictions due to improper authentication.
Published Oct 8, 2026 · Updated Oct 10, 2026
CVE-2026-84249: IBM Guardium Data Protection is affected by vulnerability
IBM Guardium Data Protection 12.2, and 12.2.2 could allow a remote attacker to execute arbitrary management operations due to missing authentication for critical function.
Published Oct 8, 2026 · Updated Oct 10, 2026