October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
21,894
Critical
3,119
High
7,046
Medium
6,884
Low
606
Severity not reported
4,239
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (722), google (413), ibm (321), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-106708 XXL-JOB 3.5.0-SNAPSHOT and earlier contains a Cross-Site Request Forgery (CSRF)... |
high | 8.8 | — | — | 2026-10-15 | 2026-10-19 |
| CVE-2026-107436 Deserialization of Untrusted Data vulnerability in WP Chill Strong Testimonials... |
high | 8.8 | — | — | 2026-10-18 | 2026-10-19 |
| CVE-2026-110913 Memory corruption in DOM in Google Chrome prior to 155.0.8059.84 allowed a remot... |
high | 8.8 | — | Google / chrome | 2026-10-15 | 2026-10-19 |
| CVE-2026-110914 Memory corruption in Workers in Google Chrome prior to 155.0.8059.84 allowed a r... |
high | 8.8 | — | Google / chrome | 2026-10-15 | 2026-10-19 |
| CVE-2026-110915 Use after free in Compositing in Google Chrome prior to 155.0.8059.84 allowed a... |
high | 8.8 | — | Google / chrome | 2026-10-15 | 2026-10-19 |
| CVE-2026-112305 Semaphore UI through 2.19.16 contains a remote code execution vulnerability that... |
high | 8.8 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-112146 A vulnerability was detected in D-Link E15, M32, R15 and R32. |
high | 7.4 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-111990 A weakness has been identified in kishan0725 Hospital Management System up to 77... |
high | 7.3 | — | — | 2026-10-18 | 2026-10-19 |
| CVE-2026-112025 A weakness has been identified in light0011 cms c774dce31c6df0055568a8d5c53d964d... |
high | 7.3 | — | — | 2026-10-18 | 2026-10-19 |
| CVE-2026-111398 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') v... |
high | 7.7 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-111408 Deserialization of Untrusted Data vulnerability in ExpressTech Quiz And Survey M... |
high | 8.8 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-100798 Cryptography misuse in Storage: Quota Manager component. |
high | 8.1 | — | Mozilla / firefox | 2026-09-29 | 2026-10-19 |
| CVE-2026-100803 Same-origin policy bypass in the WebExtensions component. |
high | 8.1 | — | Mozilla / firefox | 2026-09-29 | 2026-10-19 |
| CVE-2026-100805 Race condition, use-after-free in the Audio/Video component. |
high | 7.5 | — | Mozilla / firefox | 2026-09-29 | 2026-10-19 |
| CVE-2026-100807 Privilege escalation in the DOM: Service Workers component. |
high | 8.8 | — | Mozilla / firefox | 2026-09-29 | 2026-10-19 |
| CVE-2026-100789 Use-after-free in the Graphics: Canvas2D component. |
high | 8.8 | — | Mozilla / firefox | 2026-09-29 | 2026-10-19 |
| CVE-2026-112306 NocoBase @nocobase/plugin-collection-sql through 2.2.28 contains an SQL injectio... |
high | 7.2 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-112307 sqlparse through 0.6.0 contains a PHP code injection vulnerability that allows a... |
high | 7.3 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-112143 A security flaw has been discovered in satya-vinay Events-Management-System up t... |
high | 7.3 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-112139 A vulnerability has been found in subhajitkhan online-clinic-management-system u... |
high | 7.3 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-112082 A vulnerability was identified in sgl-project SGLang up to 0.5.19. |
high | 7.5 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-112044 A security vulnerability has been detected in dotnet eShop up to 913acea66708a59... |
high | 7.3 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-111907 phpMyFAQ 4.0.0 before 4.1.9 contains a cross-site request forgery vulnerability... |
high | 7.1 | — | — | 2026-10-17 | 2026-10-19 |
| CVE-2026-111866 A weakness has been identified in nemoTyrant manong up to 7c9e5228e133b9267ad3a4... |
high | 7.3 | — | — | 2026-10-18 | 2026-10-19 |
| CVE-2026-111871 A weakness has been identified in itsmeravitejak Online-Examination-System up to... |
high | 7.3 | — | — | 2026-10-18 | 2026-10-19 |
| CVE-2026-100790 Use-after-free in the XSLT component. |
high | 8.8 | — | Mozilla / firefox | 2026-09-29 | 2026-10-19 |
| CVE-2026-112001 ProjectSend 2.0.0 before 2.7.0 contains an incorrect authorization vulnerability... |
high | 7.2 | — | — | 2026-10-18 | 2026-10-19 |
| CVE-2026-110897 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-18 | 2026-10-19 |
| CVE-2026-108485 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-18 | 2026-10-19 |
| CVE-2026-110382 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-18 | 2026-10-19 |
| CVE-2026-100791 Use-after-free in the DOM: Core & HTML component. |
high | 8.8 | — | Mozilla / firefox | 2026-09-29 | 2026-10-19 |
| CVE-2026-100792 JIT miscompilation in the JavaScript: WebAssembly component. |
high | 7.1 | — | Mozilla / firefox | 2026-09-29 | 2026-10-19 |
| CVE-2026-100796 Use-after-free in the JavaScript: WebAssembly component. |
high | 8.8 | — | Mozilla / firefox | 2026-09-29 | 2026-10-19 |
| CVE-2026-100797 Privilege escalation due to use-after-free in the Graphics: WebRender component. |
high | 8.8 | — | Mozilla / firefox | 2026-09-29 | 2026-10-19 |
| CVE-2026-96627 Arcane is an interface for managing Docker containers, images, networks, and vol... |
high | 8.8 | — | — | 2026-10-16 | 2026-10-19 |
| CVE-2026-111901 phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an uncontrolled resource consump... |
high | 7.5 | — | — | 2026-10-17 | 2026-10-19 |
| CVE-2026-111710 Netcore NR256CN through 1.5.140116 contains a NULL pointer dereference vulnerabi... |
high | 7.5 | — | — | 2026-10-16 | 2026-10-19 |
| CVE-2026-108374 ERPNext is a free and open source Enterprise Resource Planning tool. |
high | 7.7 | — | — | 2026-10-16 | 2026-10-19 |
| CVE-2026-101952 An Improper Validation of Consistency within Input vulnerability in the routing... |
high | 7.5 | — | — | 2026-10-14 | 2026-10-19 |
| CVE-2026-102607 ZoneMinder is a free, open source closed-circuit television software application... |
high | 8.8 | — | — | 2026-10-16 | 2026-10-19 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.