October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
21,663
Critical
3,114
High
7,016
Medium
6,792
Low
599
Severity not reported
4,142
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (722), google (413), ibm (321), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (113), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-110163 Use after free in DOM in Google Chrome prior to 155.0.8059.79 allowed a remote a... |
high | 8.8 | — | Google / chrome | 2026-10-13 | 2026-10-15 |
| CVE-2026-110164 Use after free in DOM in Google Chrome prior to 155.0.8059.79 allowed a remote a... |
high | 8.8 | — | Google / chrome | 2026-10-13 | 2026-10-15 |
| CVE-2026-110166 Buffer overflow in Animation in Google Chrome prior to 155.0.8059.79 allowed a r... |
high | 8.8 | — | Google / chrome | 2026-10-13 | 2026-10-15 |
| CVE-2026-110167 Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote... |
high | 8.8 | — | Google / chrome | 2026-10-13 | 2026-10-15 |
| CVE-2026-110156 Incorrect reference resolution in Extensions in Google Chrome on on Mac prior to... |
high | 8.3 | — | Google / chrome | 2026-10-13 | 2026-10-15 |
| CVE-2026-110157 Use after free in SVG in Google Chrome prior to 155.0.8059.79 allowed a remote a... |
high | 8.8 | — | Google / chrome | 2026-10-13 | 2026-10-15 |
| CVE-2026-110162 Use after free in Desktop in Google Chrome prior to 155.0.8059.79 allowed a remo... |
high | 8.8 | — | Google / chrome | 2026-10-13 | 2026-10-15 |
| CVE-2026-110151 Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote... |
high | 8.8 | — | Google / chrome | 2026-10-13 | 2026-10-15 |
| CVE-2026-110153 Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote... |
high | 8.8 | — | Google / chrome | 2026-10-13 | 2026-10-15 |
| CVE-2026-110154 Use after free in Canvas in Google Chrome prior to 155.0.8059.79 allowed a remot... |
high | 8.8 | — | Google / chrome | 2026-10-13 | 2026-10-15 |
| CVE-2026-110155 Buffer overflow in PDFium in Google Chrome prior to 155.0.8059.79 allowed a remo... |
high | 8.8 | — | Google / chrome | 2026-10-13 | 2026-10-15 |
| CVE-2026-110145 Use after free in Passwords in Google Chrome prior to 155.0.8059.79 allowed a re... |
high | 8.3 | — | Google / chrome | 2026-10-13 | 2026-10-15 |
| CVE-2026-110147 Use after free in PDF in Google Chrome prior to 155.0.8059.79 allowed a remote a... |
high | 8.8 | — | Google / chrome | 2026-10-13 | 2026-10-15 |
| CVE-2026-110148 Use after free in SVG in Google Chrome prior to 155.0.8059.79 allowed a remote a... |
high | 8.8 | — | Google / chrome | 2026-10-13 | 2026-10-15 |
| CVE-2026-110137 Use after free in WebRTC in Google Chrome prior to 155.0.8059.79 allowed a remot... |
high | 8.8 | — | Google / chrome | 2026-10-13 | 2026-10-15 |
| CVE-2026-110138 Use after free in ShapeDetection in Google Chrome prior to 155.0.8059.79 allowed... |
high | 8.3 | — | Google / chrome | 2026-10-13 | 2026-10-15 |
| CVE-2026-110140 Type confusion in V8 in Google Chrome prior to 155.0.8059.79 allowed a remote at... |
high | 8.8 | — | Google / chrome | 2026-10-13 | 2026-10-15 |
| CVE-2026-110144 Incorrect authorization in Mojo in Google Chrome on on Windows prior to 155.0.80... |
high | 8.6 | — | Google / chrome | 2026-10-13 | 2026-10-15 |
| CVE-2026-103851 Substance3D - Stager is affected by a Stack-based Buffer Overflow vulnerability... |
high | 7.8 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-78309 SQL Injection vulnerability in DIAEnergie. |
high | 8.8 | — | — | 2026-09-24 | 2026-10-15 |
| CVE-2026-109371 ZITADEL 3.0.0 before 4.18.0 contains a missing authentication vulnerability in t... |
high | 8.2 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-108906 A vulnerability has been found in Netcore NR268 1.7.121109. |
high | 7.2 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-96940 Weak authentication in Microsoft Exchange Server allows an authorized attacker t... |
high | 8.8 | — | Microsoft / exchange server | 2026-10-02 | 2026-10-15 |
| CVE-2026-101027 When `[migrations] ALLOWED_DOMAINS` was configured, a hostname matching the allo... |
high | 7.7 | — | Gitea / gitea | 2026-10-06 | 2026-10-15 |
| CVE-2026-103670 When a Gitea Actions run was inserted, older runs in the same workflow-level con... |
high | 7.5 | — | Gitea / gitea | 2026-10-06 | 2026-10-15 |
| CVE-2026-84393 A improper validation of certificate with host mismatch vulnerability in Fortine... |
high | 8.1 | — | — | 2026-09-08 | 2026-10-15 |
| CVE-2026-84854 In the WibuKey driver for Windows below Version 6.72, insufficient validation of... |
high | 7.0 | — | — | 2026-10-06 | 2026-10-15 |
| CVE-2026-33388 An access control vulnerability was discovered in the Credentials Manager functi... |
high | 7.4 | — | — | 2026-09-08 | 2026-10-15 |
| CVE-2026-33389 An improper certificate/host key validation vulnerability was discovered in the... |
high | 7.5 | — | — | 2026-09-08 | 2026-10-15 |
| CVE-2026-14905 IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.... |
high | 8.2 | — | Ibm / datapower gateway | 2026-10-08 | 2026-10-15 |
| CVE-2026-97287 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
high | 8.5 | — | — | 2026-09-30 | 2026-10-15 |
| CVE-2026-78457 Use after free in Windows Security App allows an authorized attacker to elevate... |
high | 7.0 | — | Microsoft / windows 11 24h2 | 2026-09-08 | 2026-10-15 |
| CVE-2026-105868 Payload is a free and open source headless content management system. |
high | 7.1 | — | Payloadcms / payload | 2026-10-06 | 2026-10-15 |
| CVE-2026-105849 Payload is a free and open source headless content management system. |
high | 8.3 | — | Payloadcms / payload | 2026-10-06 | 2026-10-15 |
| CVE-2026-105850 Payload is a free and open source headless content management system. |
high | 8.2 | — | Payloadcms / payload | 2026-10-06 | 2026-10-15 |
| CVE-2026-105851 Payload is a free and open source headless content management system. |
high | 8.1 | — | Payloadcms / payload | 2026-10-06 | 2026-10-15 |
| CVE-2026-105852 Payload is a free and open source headless content management system. |
high | 7.5 | — | Payloadcms / payload | 2026-10-06 | 2026-10-15 |
| CVE-2026-105854 Payload is a free and open source headless content management system. |
high | 7.5 | — | Payloadcms / payload | 2026-10-06 | 2026-10-15 |
| CVE-2026-105855 Payload is a free and open source headless content management system. |
high | 7.1 | — | Payloadcms / payload | 2026-10-06 | 2026-10-15 |
| CVE-2026-105856 Payload is a free and open source headless content management system. |
high | 8.3 | — | Payloadcms / payload | 2026-10-06 | 2026-10-15 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.