October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,481
Critical
1,390
High
6,087
Medium
6,447
Low
659
Severity not reported
2,898
In CISA KEV
21
Most affected vendors (by CPE data where available): microsoft (1359), google (759), oracle (403), apple (294), ibm (149), adobe (138), apache (73), imagemagick (72), broadcom (61), freerdp (60)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-101152 Insufficient validation in the Single Sign-On (SSO) login flow could allow a rem... |
high | 8.0 | — | — | 2026-10-06 | 2026-10-07 |
| CVE-2026-101153 On affected versions of CloudVision Portal (on-premises) or CloudVision Sensor,... |
high | 8.0 | — | — | 2026-10-06 | 2026-10-07 |
| CVE-2026-101154 An authenticated remote attacker with specific permissions can read or write fil... |
high | 7.2 | — | — | 2026-10-06 | 2026-10-07 |
| CVE-2026-101156 A stored cross-site scripting (XSS) vulnerability may allow an authenticated, hi... |
high | 8.4 | — | — | 2026-10-06 | 2026-10-07 |
| CVE-2026-101157 A stored cross-site scripting (XSS) vulnerability may allow an unauthenticated a... |
high | 8.7 | — | — | 2026-10-06 | 2026-10-07 |
| CVE-2026-101027 When `[migrations] ALLOWED_DOMAINS` was configured, a hostname matching the allo... |
high | 7.7 | — | Gitea / gitea | 2026-10-06 | 2026-10-15 |
| CVE-2026-96890 A Server-Side Request Forgery (SSRF) vulnerability was identified in GitHub Ente... |
high | 8.8 | — | Github / enterprise server | 2026-10-06 | 2026-10-09 |
| CVE-2026-83550 A flaw was found in postgres-exporter. |
high | 7.1 | — | — | 2026-10-06 | 2026-10-07 |
| CVE-2026-86361 Dell System Update, versions prior to 2.3.0.0, contains an Incorrect Permission... |
high | 8.2 | — | Dell / system update | 2026-10-06 | 2026-10-14 |
| CVE-2026-86362 Dell System Update, versions prior to 2.3.0.0, contains an Improper Access Contr... |
high | 8.2 | — | Dell / system update | 2026-10-06 | 2026-10-14 |
| CVE-2026-63697 Dell System Update, versions prior to 2.3.0.0, contains an Improper Certificate... |
high | 7.2 | — | Dell / system update | 2026-10-06 | 2026-10-13 |
| CVE-2026-71168 Dell System Update, versions prior to 2.3.0.0, contains an Improper Limitation o... |
high | 7.8 | — | Dell / system update | 2026-10-06 | 2026-10-13 |
| CVE-2026-56906 In ep_free of eventpoll.c, there is a possible use-after-free due to a race cond... |
high | 7.0 | — | — | 2026-10-06 | 2026-10-07 |
| CVE-2026-106441 Hydra is a framework for elegantly configuring complex applications. |
high | 7.8 | — | — | 2026-10-06 | 2026-10-07 |
| CVE-2026-106442 Hydra is a framework for elegantly configuring complex applications. |
high | 7.8 | — | — | 2026-10-06 | 2026-10-07 |
| CVE-2026-106443 WeasyPrint helps web developers to create PDF documents. |
high | 8.8 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-106423 Use after free in Media in Google Chrome prior to 155.0.8059.39 allowed a remote... |
high | 8.8 | — | Google / chrome | 2026-10-06 | 2026-10-07 |
| CVE-2026-106426 Race condition in Fonts in Google Chrome prior to 155.0.8059.39 allowed a remote... |
high | 8.3 | — | Google / chrome | 2026-10-06 | 2026-10-07 |
| CVE-2026-106440 Hydra is a framework for elegantly configuring complex applications. |
high | 7.8 | — | — | 2026-10-06 | 2026-10-09 |
| CVE-2026-106421 Use after free in PDF in Google Chrome prior to 155.0.8059.39 allowed a remote a... |
high | 8.8 | — | Google / chrome | 2026-10-06 | 2026-10-07 |
| CVE-2026-106409 Incorrect reference resolution in WebAppInstalls in Google Chrome on on Mac prio... |
high | 8.3 | — | Google / chrome | 2026-10-06 | 2026-10-07 |
| CVE-2026-106411 Use after free in Parser in Google Chrome prior to 155.0.8059.39 allowed a remot... |
high | 8.8 | — | Google / chrome | 2026-10-06 | 2026-10-07 |
| CVE-2026-106412 Race condition in Core in Google Chrome on on Mac prior to 155.0.8059.39 allowed... |
high | 8.3 | — | Google / chrome | 2026-10-06 | 2026-10-07 |
| CVE-2026-106403 Incorrect authorization in Accessibility in Google Chrome prior to 155.0.8059.39... |
high | 8.1 | — | Google / chrome | 2026-10-06 | 2026-10-09 |
| CVE-2026-106393 Use after free in Storage in Google Chrome prior to 155.0.8059.39 allowed a remo... |
high | 8.3 | — | Google / chrome | 2026-10-06 | 2026-10-07 |
| CVE-2026-106383 Use after free in Media in Google Chrome prior to 155.0.8059.39 allowed a remote... |
high | 8.8 | — | Google / chrome | 2026-10-06 | 2026-10-07 |
| CVE-2026-106387 Missing authorization in Mobile in Google Chrome on on iOS prior to 155.0.8059.3... |
high | 8.8 | — | Google / chrome | 2026-10-06 | 2026-10-08 |
| CVE-2026-106371 Incorrect authorization in Transactions Platform in Google Chrome on on Android... |
high | 8.8 | — | Google / chrome | 2026-10-06 | 2026-10-07 |
| CVE-2026-106373 Use after free in Fonts in Google Chrome on on Windows prior to 155.0.8059.39 al... |
high | 8.8 | — | Google / chrome | 2026-10-06 | 2026-10-07 |
| CVE-2026-106374 Type confusion in V8 in Google Chrome prior to 155.0.8059.39 allowed a remote at... |
high | 8.8 | — | Google / chrome | 2026-10-06 | 2026-10-07 |
| CVE-2026-106377 Race condition in Fonts in Google Chrome prior to 155.0.8059.39 allowed a remote... |
high | 8.3 | — | Google / chrome | 2026-10-06 | 2026-10-07 |
| CVE-2026-106378 Privilege elevation in Sandbox in Google Chrome on on Mac prior to 155.0.8059.39... |
high | 8.3 | — | Google / chrome | 2026-10-06 | 2026-10-07 |
| CVE-2026-106363 Missing authorization in FullScreen in Google Chrome prior to 155.0.8059.39 allo... |
high | 8.3 | — | Google / chrome | 2026-10-06 | 2026-10-14 |
| CVE-2026-106367 Missing authorization in Mobile in Google Chrome on on Android prior to 155.0.80... |
high | 8.4 | — | Google / chrome | 2026-10-06 | 2026-10-14 |
| CVE-2026-106352 Incorrect authorization in WebProtect in Google Chrome prior to 155.0.8059.39 al... |
high | 8.8 | — | Google / chrome | 2026-10-06 | 2026-10-14 |
| CVE-2026-106357 Use after free in WebRTC in Google Chrome prior to 155.0.8059.39 allowed a remot... |
high | 8.8 | — | Google / chrome | 2026-10-06 | 2026-10-14 |
| CVE-2026-106346 Improper state validation in DevTools in Google Chrome prior to 155.0.8059.39 al... |
high | 8.8 | — | Google / chrome | 2026-10-06 | 2026-10-14 |
| CVE-2026-106347 Use after free in Track in Google Chrome prior to 155.0.8059.39 allowed a remote... |
high | 8.8 | — | Google / chrome | 2026-10-06 | 2026-10-14 |
| CVE-2026-106349 Use after free in V8 in Google Chrome prior to 155.0.8059.39 allowed a remote at... |
high | 8.8 | — | Google / chrome | 2026-10-06 | 2026-10-14 |
| CVE-2026-106350 Incorrect authorization in Browser in Google Chrome prior to 155.0.8059.39 allow... |
high | 8.8 | — | Google / chrome | 2026-10-06 | 2026-10-14 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.