CVE archive

Critical CVE Archive

Browse critical-severity CVEs with CVSS, affected products, CWE, KEV, remediation priorities, and source-backed Glexia context.

Search all CVEs Known exploited

Showing 50 of 24849 matching CVEs · Page 31 of 497.

Critical · CVSS 9.8

CVE-2026-93942: WordPress Dwell theme <= 1.16.0 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in ThemeREX Group Dwell dwell allows Object Injection.This issue affects Dwell: from n/a through 1.16.0.

Published Oct 10, 2026 · Updated Oct 11, 2026

Critical · CVSS 9.8

CVE-2026-93943: WordPress Convex theme <= 1.16.0 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in ThemeREX Group Convex convex allows Object Injection.This issue affects Convex: from n/a through 1.16.0.

Published Oct 10, 2026 · Updated Oct 11, 2026

Critical · CVSS 9.8

CVE-2026-62046: WordPress Gutentype theme <= 2.1.12 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in ThemeREX Group Gutentype gutentype allows Object Injection.This issue affects Gutentype: from n/a through 2.1.12.

Published Oct 10, 2026 · Updated Oct 11, 2026

Critical · CVSS 9.8

CVE-2026-62045: WordPress Booklovers theme <= 2.13.0 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in ThemeREX Group Booklovers booklovers allows Object Injection.This issue affects Booklovers: from n/a through 2.13.0.

Published Oct 10, 2026 · Updated Oct 11, 2026

Critical · CVSS 9.8

CVE-2026-106610: WordPress miniorange otp verification plugin <= 5.5.7 - Privilege Escalation vulnerability

Incorrect Privilege Assignment vulnerability in miniOrange miniorange otp verification miniorange-otp-verification allows Privilege Escalation.This issue affects miniorange otp verification: from n/a through 5.5.7.

Published Oct 10, 2026 · Updated Oct 11, 2026

Critical · CVSS 9.8

CVE-2026-39801: WordPress AIWU plugin <= 1.5.9 - Privilege Escalation vulnerability

Subscriber Privilege Escalation in AIWU <= 1.5.9 versions.

Published Oct 10, 2026 · Updated Oct 11, 2026

Critical · CVSS 9.8

CVE-2026-42719: WordPress Dynamic User Directory plugin <= 2.4 - PHP Object Injection vulnerability

Subscriber PHP Object Injection in Dynamic User Directory <= 2.4 versions.

Published Oct 10, 2026 · Updated Oct 11, 2026

Critical · CVSS 9.8

CVE-2026-62022: WordPress Tonda Membership plugin <= 1.0.1 - Privilege Escalation vulnerability

Unauthenticated Privilege Escalation in Tonda Membership <= 1.0.1 versions.

Published Oct 10, 2026 · Updated Oct 11, 2026

Critical · CVSS 9.9

CVE-2026-62024: WordPress CodeBard Help Desk plugin <= 1.1.2 - Arbitrary File Upload vulnerability

Subscriber Arbitrary File Upload in CodeBard Help Desk <= 1.1.2 versions.

Published Oct 10, 2026 · Updated Oct 11, 2026

Critical · CVSS 9

CVE-2026-62025: WordPress Tailored Tools plugin <= 3.0.3 - Arbitrary File Upload vulnerability

Unauthenticated Arbitrary File Upload in Tailored Tools <= 3.0.3 versions.

Published Oct 10, 2026 · Updated Oct 11, 2026

Critical · CVSS 9.9

CVE-2026-62129: WordPress Creator LMS plugin <= 1.2.21 - Arbitrary File Upload vulnerability

Contributor Arbitrary File Upload in Creator LMS <= 1.2.21 versions.

Published Oct 10, 2026 · Updated Oct 11, 2026

Critical · CVSS 9.3

CVE-2026-96330: WordPress tagDiv Opt-In Builder plugin <= 1.7.6 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in tagDiv tagDiv Opt-In Builder td-subscription allows Blind SQL Injection.This issue affects tagDiv Opt-In Builder: from n/a through 1.7.6.

Published Oct 9, 2026 · Updated Oct 11, 2026

Critical · CVSS 9.3

CVE-2026-96809: WordPress EduAdmin Booking plugin < 6.0.0 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in MultiNet Interactive AB EduAdmin Booking eduadmin-booking allows Blind SQL Injection.This issue affects EduAdmin Booking: from n/a before 6.0.0.

Published Oct 9, 2026 · Updated Oct 11, 2026

Critical · CVSS 9.3

CVE-2026-105889: WordPress Tickera plugin <= 3.6.0.6 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Tickera Tickera tickera-event-ticketing-system allows Blind SQL Injection.This issue affects Tickera: from n/a through 3.6.0.6.

Published Oct 10, 2026 · Updated Oct 11, 2026

Critical · CVSS 9.3

CVE-2026-40800: WordPress ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes plugin <= 1.5.3 - SQL Injection vulnerability

Subscriber SQL Injection in ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes <= 1.5.3 versions.

Published Oct 10, 2026 · Updated Oct 11, 2026

Critical · CVSS 9.3

CVE-2026-62031: WordPress uListing plugin <= 2.2.0 - SQL Injection vulnerability

Unauthenticated SQL Injection in uListing <= 2.2.0 versions.

Published Oct 10, 2026 · Updated Oct 11, 2026

Critical · CVSS 9.8

CVE-2026-42716: WordPress Payever - WooCommerce Gateway plugin <= 4.8.2 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Payever - WooCommerce Gateway <= 4.8.2 versions.

Published Oct 10, 2026 · Updated Oct 11, 2026

Critical · CVSS 9.8

CVE-2026-42718: WordPress Booster for WooCommerce plugin <= 8.4.0 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Booster for WooCommerce <= 8.4.0 versions.

Published Oct 10, 2026 · Updated Oct 11, 2026

Critical · CVSS 9.8

CVE-2026-42723: WordPress CleanSkin theme <= 1.5.0 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in CleanSkin <= 1.5.0 versions.

Published Oct 10, 2026 · Updated Oct 11, 2026

Critical · CVSS 9.8

CVE-2026-62050: WordPress Splendour theme <= 1.23 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Splendour <= 1.23 versions.

Published Oct 10, 2026 · Updated Oct 11, 2026

Critical · CVSS 9.8

CVE-2026-62051: WordPress Stargaze theme <= 1.10 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Stargaze <= 1.10 versions.

Published Oct 10, 2026 · Updated Oct 11, 2026

Critical · CVSS 9.8

CVE-2026-62052: WordPress Tipsy theme <= 1.6 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Tipsy <= 1.6 versions.

Published Oct 10, 2026 · Updated Oct 11, 2026

Critical · CVSS 9.8

CVE-2026-62053: WordPress Wine House theme <= 3.20 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Wine House <= 3.20 versions.

Published Oct 10, 2026 · Updated Oct 11, 2026

Critical · CVSS 9.8

CVE-2026-62054: WordPress Yacht Rental theme <= 2.6 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Yacht Rental <= 2.6 versions.

Published Oct 10, 2026 · Updated Oct 11, 2026

Critical · CVSS 9.8

CVE-2026-62076: WordPress Kalles theme <= 1.1.7.1 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Kalles <= 1.1.7.1 versions.

Published Oct 10, 2026 · Updated Oct 11, 2026

Critical · CVSS 9.8

CVE-2026-62077: WordPress Avala theme <= 1.1.4 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Avala <= 1.1.4 versions.

Published Oct 10, 2026 · Updated Oct 11, 2026

Critical · CVSS 9.8

CVE-2026-62086: WordPress Juno theme <= 2.25 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Juno <= 2.25 versions.

Published Oct 10, 2026 · Updated Oct 11, 2026

Critical · CVSS 9.8

CVE-2026-62087: WordPress Equadio theme <= 1.1.4 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Equadio <= 1.1.4 versions.

Published Oct 10, 2026 · Updated Oct 11, 2026

Critical · CVSS 9.8

CVE-2026-62090: WordPress WineShop theme <= 3.20 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in WineShop <= 3.20 versions.

Published Oct 10, 2026 · Updated Oct 11, 2026

Critical · CVSS 9.8

CVE-2026-62120: WordPress Law Office theme <= 3.20 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Law Office <= 3.20 versions.

Published Oct 10, 2026 · Updated Oct 11, 2026

Critical · CVSS 9.8

CVE-2026-62123: WordPress Invetex theme <= 2.18 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Invetex <= 2.18 versions.

Published Oct 10, 2026 · Updated Oct 11, 2026

Critical · CVSS 9.8

CVE-2026-62124: WordPress N7 | Golf Club Sports & Events theme <= 2.21 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in N7 | Golf Club Sports & Events <= 2.21 versions.

Published Oct 10, 2026 · Updated Oct 11, 2026

Critical · CVSS 9.8

CVE-2026-62125: WordPress Asia Garden theme <= 1.3.1 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Asia Garden <= 1.3.1 versions.

Published Oct 10, 2026 · Updated Oct 11, 2026

Critical · CVSS 9.8

CVE-2026-66482: WordPress Drone Media theme <= 2.2.0 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Drone Media <= 2.2.0 versions.

Published Oct 10, 2026 · Updated Oct 11, 2026

Critical · CVSS 9.8

CVE-2026-66483: WordPress Education Center theme <= 3.6.12 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Education Center <= 3.6.12 versions.

Published Oct 10, 2026 · Updated Oct 11, 2026

Critical · CVSS 9.8

CVE-2026-66563: WordPress Windsor theme <= 2.10 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Windsor <= 2.10 versions.

Published Oct 10, 2026 · Updated Oct 11, 2026

Critical · CVSS 9.8

CVE-2026-66564: WordPress ShiftCV theme <= 3.0.14 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in ShiftCV <= 3.0.14 versions.

Published Oct 10, 2026 · Updated Oct 11, 2026

Critical · CVSS 9.8

CVE-2026-66565: WordPress FC United theme <= 1.1.1 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in FC United <= 1.1.1 versions.

Published Oct 10, 2026 · Updated Oct 11, 2026

Critical · CVSS 9.8

CVE-2026-66567: WordPress Anesta theme <= 1.5.3 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Anesta <= 1.5.3 versions.

Published Oct 10, 2026 · Updated Oct 11, 2026

Critical · CVSS 9.8

CVE-2026-66568: WordPress Original theme <= 1.9.0 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Original <= 1.9.0 versions.

Published Oct 10, 2026 · Updated Oct 11, 2026

Critical · CVSS 9.8

CVE-2026-66569: WordPress Kicker theme <= 2.2.1 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Kicker <= 2.2.1 versions.

Published Oct 10, 2026 · Updated Oct 11, 2026

Critical · CVSS 9.8

CVE-2026-78529: WordPress Alliance theme <= 3.11 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Alliance <= 3.11 versions.

Published Oct 10, 2026 · Updated Oct 11, 2026

Critical · CVSS 9.8

CVE-2026-78531: WordPress Jacqueline theme <= 2.22 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Jacqueline <= 2.22 versions.

Published Oct 10, 2026 · Updated Oct 11, 2026

Critical · CVSS 9.8

CVE-2026-78533: WordPress Qwery theme <= 3.6.1 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Qwery <= 3.6.1 versions.

Published Oct 10, 2026 · Updated Oct 11, 2026

Critical · CVSS 9.8

CVE-2026-78535: WordPress Photolia theme <= 1.0.3 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Photolia <= 1.0.3 versions.

Published Oct 10, 2026 · Updated Oct 11, 2026

Critical · CVSS 9.8

CVE-2026-81797: WordPress Buzz Stone | Magazine & Viral Blog WordPress Theme theme <= 1.0.2 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Buzz Stone | Magazine & Viral Blog WordPress Theme <= 1.0.2 versions.

Published Oct 10, 2026 · Updated Oct 11, 2026

Critical · CVSS 9.8

CVE-2026-62032: WordPress DirectoryPress plugin <= 3.6.27 - Local File Inclusion vulnerability

Unauthenticated Local File Inclusion in DirectoryPress <= 3.6.27 versions.

Published Oct 10, 2026 · Updated Oct 10, 2026

Critical · CVSS 9.8

CVE-2026-84272: IBM Guardium Data Protection Missing Authentication

IBM Guardium Data Protection 12.1 and 12.2.2 are vulnerable to missing authentication in the edge-controller component. An unauthenticated remote attacker could exploit this vulnerability to execute arbitrary container images and gain control of managed edge clusters.

Published Oct 8, 2026 · Updated Oct 10, 2026

Critical · CVSS 9.8

CVE-2026-78401: Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access

IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote unauthenticated attacker to execute arbitrary code on the system due to the deserialization of untrusted data.

Published Oct 8, 2026 · Updated Oct 10, 2026

Critical · CVSS 9.1

CVE-2026-19491: Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access

IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote attacker to bypass authentication due to improper authentication.

Published Oct 8, 2026 · Updated Oct 10, 2026