October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,481
Critical
1,401
High
6,159
Medium
6,457
Low
659
Severity not reported
2,805
In CISA KEV
21
Most affected vendors (by CPE data where available): microsoft (1359), google (759), oracle (403), apple (325), ibm (149), adobe (138), apache (73), imagemagick (72), broadcom (61), freerdp (60)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-117506 A weakness has been identified in a2aproject a2a-java up to 1.2.0.Final. |
medium | 4.3 | — | — | 2026-10-27 | 2026-11-02 |
| CVE-2026-117507 A security vulnerability has been detected in a2aproject a2a-java up to 1.2.0.Fi... |
medium | 5.4 | — | — | 2026-10-27 | 2026-11-02 |
| CVE-2026-90725 Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS... |
medium | 4.9 | — | — | 2026-10-27 | 2026-10-29 |
| CVE-2026-90726 Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS... |
medium | 6.0 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-68866 PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.7, LTS2024... |
medium | 6.5 | — | — | 2026-10-27 | 2026-10-29 |
| CVE-2026-16307 Authorization bypass through User-Controlled key vulnerability in Netiket Inform... |
medium | 4.3 | — | — | 2026-10-27 | 2026-11-04 |
| CVE-2026-117992 Information disclosure in the CSS Parsing and Computation component. |
medium | 6.5 | — | — | 2026-10-27 | 2026-11-05 |
| CVE-2026-117960 Spoofing issue in the DOM: Core & HTML component. |
medium | 4.7 | — | — | 2026-10-27 | 2026-11-05 |
| CVE-2026-117944 Use-after-free in the Layout component. |
medium | 6.3 | — | — | 2026-10-27 | 2026-11-05 |
| CVE-2026-117947 Use-after-free in the XML component. |
medium | 6.3 | — | — | 2026-10-27 | 2026-11-05 |
| CVE-2026-117948 Use-after-free in the SVG component. |
medium | 6.3 | — | — | 2026-10-27 | 2026-11-05 |
| CVE-2026-117934 Use-after-free in the Layout component. |
medium | 6.3 | — | — | 2026-10-27 | 2026-11-05 |
| CVE-2026-117935 Use-after-free in the DOM: Bindings (WebIDL) component. |
medium | 6.3 | — | — | 2026-10-27 | 2026-11-05 |
| CVE-2026-117938 Use-after-free in the Layout component. |
medium | 6.3 | — | — | 2026-10-27 | 2026-11-04 |
| CVE-2026-117939 Use-after-free in the XML component. |
medium | 6.3 | — | — | 2026-10-27 | 2026-11-04 |
| CVE-2026-117924 Use-after-free in the XSLT component. |
medium | 6.3 | — | — | 2026-10-27 | 2026-11-04 |
| CVE-2026-117927 Use-after-free in the SVG component. |
medium | 6.3 | — | — | 2026-10-27 | 2026-11-04 |
| CVE-2026-117933 Frame poisoning in the CSS Parsing and Computation component. |
medium | 5.4 | — | — | 2026-10-27 | 2026-11-05 |
| CVE-2026-117916 Use-after-free in the XSLT component. |
medium | 6.3 | — | — | 2026-10-27 | 2026-11-04 |
| CVE-2026-117923 Use-after-free in the Audio/Video component. |
medium | 6.3 | — | — | 2026-10-27 | 2026-11-04 |
| CVE-2026-117906 Use-after-free in the CSS Parsing and Computation component. |
medium | 6.3 | — | — | 2026-10-27 | 2026-11-04 |
| CVE-2026-117907 Use-after-free in the Networking component. |
medium | 6.3 | — | — | 2026-10-27 | 2026-11-04 |
| CVE-2026-117908 Use-after-free in the Graphics: ImageLib component. |
medium | 6.3 | — | — | 2026-10-27 | 2026-11-04 |
| CVE-2026-117909 Use-after-free in the JavaScript: GC component. |
medium | 6.3 | — | — | 2026-10-27 | 2026-11-04 |
| CVE-2026-117911 Use-after-free in the Audio/Video: Playback component. |
medium | 6.3 | — | — | 2026-10-27 | 2026-11-04 |
| CVE-2026-117913 Use-after-free in the SVG component. |
medium | 6.3 | — | — | 2026-10-27 | 2026-11-04 |
| CVE-2026-117914 Use-after-free in the SVG component. |
medium | 6.3 | — | — | 2026-10-27 | 2026-11-04 |
| CVE-2026-117896 Use-after-free in the DOM: Core & HTML component. |
medium | 6.3 | — | — | 2026-10-27 | 2026-11-04 |
| CVE-2026-117898 Use-after-free in the JavaScript Engine: JIT component. |
medium | 6.3 | — | — | 2026-10-27 | 2026-11-04 |
| CVE-2026-117902 Use-after-free in the Layout: Text and Fonts component. |
medium | 6.3 | — | — | 2026-10-27 | 2026-11-04 |
| CVE-2026-117903 Use-after-free in the Audio/Video component. |
medium | 6.3 | — | — | 2026-10-27 | 2026-11-04 |
| CVE-2026-117905 Use-after-free in the Audio/Video: Playback component. |
medium | 6.3 | — | — | 2026-10-27 | 2026-11-04 |
| CVE-2026-117888 Uninitialized memory in the Graphics: Canvas2D component. |
medium | 5.4 | — | — | 2026-10-27 | 2026-11-04 |
| CVE-2026-117893 Incorrect boundary conditions in the Security: PSM component. |
medium | 5.4 | — | — | 2026-10-27 | 2026-11-04 |
| CVE-2026-117894 Incorrect boundary conditions in the WebRTC: Signaling component. |
medium | 5.4 | — | — | 2026-10-27 | 2026-11-04 |
| CVE-2026-117895 Use-after-free in the DOM: Core & HTML component. |
medium | 6.3 | — | — | 2026-10-27 | 2026-11-04 |
| CVE-2026-117877 Use-after-free in the Layout: Text and Fonts component. |
medium | 6.3 | — | — | 2026-10-27 | 2026-11-04 |
| CVE-2026-117878 Other issue, use-after-free in the Storage: IndexedDB component. |
medium | 6.3 | — | — | 2026-10-27 | 2026-11-04 |
| CVE-2026-117880 Use-after-free in the XML component. |
medium | 6.3 | — | — | 2026-10-27 | 2026-11-04 |
| CVE-2026-117882 Use-after-free in the Layout component. |
medium | 6.3 | — | — | 2026-10-27 | 2026-11-04 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.