October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
21,956
Critical
3,122
High
7,073
Medium
6,906
Low
609
Severity not reported
4,246
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (722), google (413), ibm (321), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-7910 Use after free in Views in Google Chrome prior to 148.0.7778.96 allowed a remote... |
critical | 9.6 | — | Google / chrome | 2026-05-06 | 2026-10-26 |
| CVE-2026-11717 An authentication bypass vulnerability exists in the generic opaque token valida... |
critical | 9.1 | — | Google / mcp toolbox for databases | 2026-06-18 | 2026-10-26 |
| CVE-2026-11718 An authentication bypass vulnerability exists in the generic opaque token valida... |
critical | 9.1 | — | Google / mcp toolbox for databases | 2026-06-18 | 2026-10-26 |
| CVE-2026-0126 In WC-Radio, there is a possible out of bounds write due to a missing bounds che... |
critical | 9.8 | — | Google / android | 2026-06-16 | 2026-10-25 |
| CVE-2026-11720 A path traversal vulnerability exists in the HTTP tool URL builder of googleapis... |
critical | 9.1 | — | Google / mcp toolbox for databases | 2026-06-29 | 2026-10-25 |
| CVE-2026-13775 Use after free in GPU in Google Chrome prior to 150.0.7871.47 allowed a remote a... |
critical | 9.8 | — | Google / chrome | 2026-06-30 | 2026-10-25 |
| CVE-2026-13776 Type Confusion in Dawn in Google Chrome prior to 150.0.7871.47 allowed a remote... |
critical | 9.8 | — | Google / chrome | 2026-06-30 | 2026-10-25 |
| CVE-2026-13780 Insufficient validation of untrusted input in ANGLE in Google Chrome prior to 15... |
critical | 9.6 | — | Google / chrome | 2026-06-30 | 2026-10-25 |
| CVE-2026-13781 Insufficient validation of untrusted input in Skia in Google Chrome prior to 150... |
critical | 9.6 | — | Google / chrome | 2026-06-30 | 2026-10-25 |
| CVE-2026-13782 Use after free in Browser in Google Chrome prior to 150.0.7871.47 allowed a remo... |
critical | 10.0 | — | Google / chrome | 2026-06-30 | 2026-10-25 |
| CVE-2026-13785 Use after free in Bluetooth in Google Chrome on Mac prior to 150.0.7871.47 allow... |
critical | 9.6 | — | Google / chrome | 2026-06-30 | 2026-10-25 |
| CVE-2026-14101 Insufficient policy enforcement in Sandbox in Google Chrome on Mac prior to 150.... |
critical | 9.6 | — | Google / chrome | 2026-06-30 | 2026-10-25 |
| CVE-2026-14104 Insufficient validation of untrusted input in WebAppInstalls in Google Chrome pr... |
critical | 9.8 | — | Google / chrome | 2026-06-30 | 2026-10-25 |
| CVE-2026-14106 Insufficient validation of untrusted input in Text in Google Chrome on Android p... |
critical | 9.6 | — | Google / chrome | 2026-06-30 | 2026-10-25 |
| CVE-2026-14109 Insufficient policy enforcement in Mojo in Google Chrome prior to 150.0.7871.47... |
critical | 9.6 | — | Google / chrome | 2026-06-30 | 2026-10-25 |
| CVE-2026-14120 Inappropriate implementation in DevTools in Google Chrome prior to 150.0.7871.47... |
critical | 9.6 | — | Google / chrome | 2026-06-30 | 2026-10-25 |
| CVE-2026-14537 Incorrect Authorization in the direct HTTP API tool invocation endpoint in Googl... |
critical | 9.8 | — | Google / mcp toolbox for databases | 2026-07-31 | 2026-10-23 |
| CVE-2026-110916 Improper input validation in Desktop in Google Chrome prior to 155.0.8059.84 all... |
critical | 9.6 | — | Google / chrome | 2026-10-15 | 2026-10-19 |
| CVE-2026-110165 Use after free in Core in Google Chrome on on Android prior to 155.0.8059.79 all... |
critical | 9.6 | — | Google / chrome | 2026-10-13 | 2026-10-15 |
| CVE-2026-110159 Incorrect authorization in Updater in Google Chrome prior to 155.0.8059.79 allow... |
critical | 9.6 | — | Google / chrome | 2026-10-13 | 2026-10-15 |
| CVE-2026-110161 Use after free in Network in Google Chrome prior to 155.0.8059.79 allowed a remo... |
critical | 9.6 | — | Google / chrome | 2026-10-13 | 2026-10-15 |
| CVE-2026-110152 Buffer overflow in ANGLE in Google Chrome on on Android prior to 155.0.8059.79 a... |
critical | 9.6 | — | Google / chrome | 2026-10-13 | 2026-10-15 |
| CVE-2026-110149 Use after free in Browser in Google Chrome prior to 155.0.8059.79 allowed a remo... |
critical | 9.6 | — | Google / chrome | 2026-10-13 | 2026-10-15 |
| CVE-2026-110136 Use after free in PDF in Google Chrome prior to 155.0.8059.79 allowed a remote a... |
critical | 9.6 | — | Google / chrome | 2026-10-13 | 2026-10-15 |
| CVE-2026-110142 Use after free in FileSystem in Google Chrome prior to 155.0.8059.79 allowed a r... |
critical | 9.6 | — | Google / chrome | 2026-10-13 | 2026-10-15 |
| CVE-2026-106358 Use after free in Navigation in Google Chrome prior to 155.0.8059.39 allowed a r... |
critical | 9.6 | — | Google / chrome | 2026-10-06 | 2026-10-14 |
| CVE-2026-106294 Incomplete cleanup in Chromoting in Google Chrome on on Mac prior to 155.0.8059.... |
critical | 9.1 | — | Google / chrome | 2026-10-06 | 2026-10-13 |
| CVE-2026-106195 Incorrect authorization in Chromoting in Google Chrome on on Mac prior to 155.0.... |
critical | 9.1 | — | Google / chrome | 2026-10-06 | 2026-10-09 |
| CVE-2026-106237 Information leak in Permissions in Google Chrome prior to 155.0.8059.39 allowed... |
critical | 9.6 | — | Google / chrome | 2026-10-06 | 2026-10-09 |
| CVE-2026-106211 Use after free in TabStrip in Google Chrome prior to 155.0.8059.39 allowed a rem... |
critical | 9.6 | — | Google / chrome | 2026-10-06 | 2026-10-08 |
| CVE-2026-102322 Incorrect Authorization in SiteIsolation in Google Chrome prior to 155.0.8059.39... |
critical | 9.6 | — | Google / chrome | 2026-10-06 | 2026-10-08 |
| CVE-2026-106197 Use after free in Browser in Google Chrome prior to 155.0.8059.39 allowed a remo... |
critical | 9.6 | — | Google / chrome | 2026-10-06 | 2026-10-08 |
| CVE-2025-48626 In multiple locations, there is a possible way to launch an application from the... |
critical | 9.8 | — | Google / android | 2025-12-08 | 2026-10-07 |
| CVE-2025-36937 In AudioDecoder::HandleProduceRequest of audio_decoder.cc, there is a possible o... |
critical | 9.8 | — | Google / android | 2025-12-11 | 2026-10-07 |
| CVE-2026-106227 Use after free in Core in Google Chrome prior to 155.0.8059.39 allowed a remote... |
critical | 9.6 | — | Google / chrome | 2026-10-06 | 2026-10-07 |
| CVE-2026-106234 Use after free in Network in Google Chrome prior to 155.0.8059.39 allowed a remo... |
critical | 9.6 | — | Google / chrome | 2026-10-06 | 2026-10-07 |
| CVE-2026-106239 Integer overflow in WebGL in Google Chrome on on Android prior to 155.0.8059.39... |
critical | 9.6 | — | Google / chrome | 2026-10-06 | 2026-10-07 |
| CVE-2026-106241 Incorrect authorization in Search in Google Chrome on on Android prior to 155.0.... |
critical | 9.6 | — | Google / chrome | 2026-10-06 | 2026-10-07 |
| CVE-2026-106372 Incorrect authorization in UI in Google Chrome prior to 155.0.8059.39 allowed a... |
critical | 9.6 | — | Google / chrome | 2026-10-06 | 2026-10-07 |
| CVE-2026-106375 Incomplete cleanup in Dawn in Google Chrome prior to 155.0.8059.39 allowed a rem... |
critical | 9.6 | — | Google / chrome | 2026-10-06 | 2026-10-07 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.