October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
21,639
Critical
3,114
High
7,009
Medium
6,780
Low
599
Severity not reported
4,137
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (722), google (413), ibm (321), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (113), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-103316 The macOS version of the DigiD app is not signed with Hardened Runtime. |
high | 7.1 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-103297 CAI Content Credentials is affected by an Improper Verification of Cryptographic... |
high | 7.5 | — | Adobe / c2pa | 2026-10-13 | 2026-10-14 |
| CVE-2026-103423 The Booking Package plugin for WordPress is vulnerable to authorization bypass i... |
high | 7.5 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-102007 The Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email... |
high | 7.2 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-101924 The NewStatPress plugin for WordPress is vulnerable to Stored Cross-Site Scripti... |
high | 7.2 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-87660 An improper file permission and missing authorization vulnerability exists in th... |
high | 7.1 | — | Broadcom / fabric operating system | 2026-10-08 | 2026-10-14 |
| CVE-2026-87666 An OS command injection vulnerability exists in the time and zone management sub... |
high | 8.0 | — | Broadcom / fabric operating system | 2026-10-08 | 2026-10-14 |
| CVE-2026-87673 An OS command injection vulnerability exists in maintenance command-line diagnos... |
high | 7.2 | — | Broadcom / fabric operating system | 2026-10-08 | 2026-10-14 |
| CVE-2026-87674 A local privilege escalation vulnerability exists in the system logging daemon o... |
high | 7.8 | — | Broadcom / fabric operating system | 2026-10-08 | 2026-10-14 |
| CVE-2026-87687 An authorization and input validation vulnerability exists in Brocade Fabric OS... |
high | 7.3 | — | Broadcom / fabric operating system | 2026-10-08 | 2026-10-14 |
| CVE-2025-14871 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.4.... |
high | 7.5 | — | Gitlab / gitlab | 2026-09-16 | 2026-10-14 |
| CVE-2025-59607 Memory Corruption when copying large input data exceeds normal allocation limits... |
high | 7.8 | — | Qualcomm / cologne firmware | 2026-09-17 | 2026-10-14 |
| CVE-2025-15697 The Dictionary WordPress plugin through 1.0 does not escape user input before re... |
high | 7.1 | — | — | 2026-09-17 | 2026-10-14 |
| CVE-2026-17507 In Bouncy Castle for Java before 1.86, the MLS implementation (org.bouncycastle.... |
high | 7.5 | — | Bouncycastle / bc-java | 2026-10-02 | 2026-10-14 |
| CVE-2026-100138 CAI Content Credentials is affected by an Uncontrolled Resource Consumption vuln... |
high | 7.5 | — | Adobe / c2pa | 2026-10-13 | 2026-10-14 |
| CVE-2026-100139 CAI Content Credentials is affected by an Uncontrolled Resource Consumption vuln... |
high | 7.5 | — | Adobe / c2pa | 2026-10-13 | 2026-10-14 |
| CVE-2026-105902 CAI Content Credentials is affected by an Uncontrolled Resource Consumption vuln... |
high | 7.5 | — | Adobe / c2pa | 2026-10-13 | 2026-10-14 |
| CVE-2026-106627 CAI Content Credentials is affected by an Uncontrolled Resource Consumption vuln... |
high | 7.5 | — | Adobe / c2pa | 2026-10-13 | 2026-10-14 |
| CVE-2026-103296 CAI Content Credentials is affected by an Improper Verification of Cryptographic... |
high | 7.5 | — | Adobe / c2pa | 2026-10-13 | 2026-10-14 |
| CVE-2026-106341 Type confusion in V8 in Google Chrome prior to 155.0.8059.39 allowed a remote at... |
high | 8.8 | — | Google / chrome | 2026-10-06 | 2026-10-14 |
| CVE-2026-106342 Information leak in Autofill in Google Chrome prior to 155.0.8059.39 allowed a r... |
high | 8.8 | — | Google / chrome | 2026-10-06 | 2026-10-14 |
| CVE-2026-87428 In Brocade ASCG before 3.5.0, a local unauthorized user on the ASCG VM who can i... |
high | 7.8 | — | Broadcom / brocade active support connectivity gateway | 2026-10-08 | 2026-10-14 |
| CVE-2026-102775 Joomla Extension - phoca.cz - Authorisation bypass through user-controlled key (... |
high | 7.5 | — | Phoca / phoca cart | 2026-10-05 | 2026-10-14 |
| CVE-2026-106346 Improper state validation in DevTools in Google Chrome prior to 155.0.8059.39 al... |
high | 8.8 | — | Google / chrome | 2026-10-06 | 2026-10-14 |
| CVE-2026-106347 Use after free in Track in Google Chrome prior to 155.0.8059.39 allowed a remote... |
high | 8.8 | — | Google / chrome | 2026-10-06 | 2026-10-14 |
| CVE-2026-106349 Use after free in V8 in Google Chrome prior to 155.0.8059.39 allowed a remote at... |
high | 8.8 | — | Google / chrome | 2026-10-06 | 2026-10-14 |
| CVE-2026-106350 Incorrect authorization in Browser in Google Chrome prior to 155.0.8059.39 allow... |
high | 8.8 | — | Google / chrome | 2026-10-06 | 2026-10-14 |
| CVE-2026-87424 A vulnerability in the SupportLink API authentication component of Brocade ASCG... |
high | 8.8 | — | Broadcom / brocade active support connectivity gateway | 2026-10-08 | 2026-10-14 |
| CVE-2026-85490 When Brocade ASCG before 3.5.0 processes support bundle archives ingested from r... |
high | 8.8 | — | Broadcom / brocade active support connectivity gateway | 2026-10-08 | 2026-10-14 |
| CVE-2026-85489 An authentication flaw exists in the Brocade ASCG administrative management serv... |
high | 8.8 | — | Broadcom / brocade active support connectivity gateway | 2026-10-08 | 2026-10-14 |
| CVE-2026-85488 Brocade ASCG before 3.5.0 has a well-known Brocade default password embedded in... |
high | 7.8 | — | Broadcom / brocade active support connectivity gateway | 2026-10-08 | 2026-10-14 |
| CVE-2026-106352 Incorrect authorization in WebProtect in Google Chrome prior to 155.0.8059.39 al... |
high | 8.8 | — | Google / chrome | 2026-10-06 | 2026-10-14 |
| CVE-2026-85487 A path traversal vulnerability exists in the HTTP service component of Brocade A... |
high | 8.8 | — | Broadcom / brocade active support connectivity gateway | 2026-10-08 | 2026-10-14 |
| CVE-2026-85486 Brocade ASCG before 3.5.0 improperly processes user input by evaluating form dat... |
high | 8.0 | — | Broadcom / brocade active support connectivity gateway | 2026-10-08 | 2026-10-14 |
| CVE-2026-85423 A vulnerability has been identified in the data collection service of Brocade AS... |
high | 8.8 | — | Broadcom / brocade active support connectivity gateway | 2026-10-08 | 2026-10-14 |
| CVE-2026-85422 A vulnerability in Brocade ASCG version before 3.5.0 could allow an attacker to... |
high | 7.8 | — | Broadcom / brocade active support connectivity gateway | 2026-10-08 | 2026-10-14 |
| CVE-2026-85421 A critical security vulnerability has been identified in Brocade ASCG versions b... |
high | 8.8 | — | Broadcom / brocade active support connectivity gateway | 2026-10-08 | 2026-10-14 |
| CVE-2026-106357 Use after free in WebRTC in Google Chrome prior to 155.0.8059.39 allowed a remot... |
high | 8.8 | — | Google / chrome | 2026-10-06 | 2026-10-14 |
| CVE-2026-106363 Missing authorization in FullScreen in Google Chrome prior to 155.0.8059.39 allo... |
high | 8.3 | — | Google / chrome | 2026-10-06 | 2026-10-14 |
| CVE-2026-62906 Improper neutralization of special elements in data query logic in Microsoft Dis... |
high | 7.4 | — | Microsoft / discovery studio | 2026-09-03 | 2026-10-14 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.