October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,481
Critical
1,390
High
6,087
Medium
6,446
Low
659
Severity not reported
2,899
In CISA KEV
21
Most affected vendors (by CPE data where available): microsoft (1359), google (759), oracle (376), apple (282), ibm (149), adobe (138), apache (73), imagemagick (72), broadcom (61), freerdp (60)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-76742 Authentication bypass vulnerabilities exist in the web management interface of A... |
critical | 9.8 | — | — | 2026-10-06 | 2026-10-08 |
| CVE-2026-76743 A vulnerability have been identified in the management interface of AOS-S that c... |
critical | 9.8 | — | — | 2026-10-06 | 2026-10-08 |
| CVE-2026-76744 Buffer overflow vulnerabilities exist in the affected interface of AOS-S. |
critical | 9.8 | — | — | 2026-10-06 | 2026-10-08 |
| CVE-2026-76745 Memory corruption vulnerabilities exist in AOS-S that are reachable by an unauth... |
critical | 9.6 | — | — | 2026-10-06 | 2026-10-08 |
| CVE-2026-76746 An unauthenticated buffer overflow vulnerability exists in AOS-S. |
critical | 9.3 | — | — | 2026-10-06 | 2026-10-07 |
| CVE-2026-106446 Handlebars provides the power necessary to let users build semantic templates. |
critical | 9.8 | — | — | 2026-10-06 | 2026-10-07 |
| CVE-2026-103059 When Gitea's built-in SSH server is enabled (`START_SSH_SERVER = true`), the pre... |
critical | 9.1 | — | Gitea / gitea | 2026-10-06 | 2026-10-15 |
| CVE-2026-102159 An access-control flaw in the CV-CUE backend may allow an unauthenticated networ... |
critical | 9.8 | — | — | 2026-10-06 | 2026-10-07 |
| CVE-2026-101155 An authenticated remote attacker with specific permissions can read or write fil... |
critical | 9.1 | — | — | 2026-10-06 | 2026-10-07 |
| CVE-2026-82162 Dell Command | Configure (DCC), versions prior to 5.2.3.35, contain an Improper... |
critical | 9.8 | — | Dell / command\|configure | 2026-10-06 | 2026-10-13 |
| CVE-2026-86360 Dell System Update, versions prior to 2.3.0.0, contains an Improper Limitation o... |
critical | 9.6 | — | Dell / system update | 2026-10-06 | 2026-10-13 |
| CVE-2026-55330 In BluetoothCccHandlerCallbackImpl of bluetooth_ccc.cc, there is a possible use-... |
critical | 9.8 | — | — | 2026-10-06 | 2026-10-07 |
| CVE-2026-106511 MultiversX's multisig-improved (repository: mx-multisig-and-modules) reference i... |
critical | 9.8 | — | — | 2026-10-06 | 2026-10-07 |
| CVE-2026-106414 Improper input validation in Mobile in Google Chrome on on iOS prior to 155.0.80... |
critical | 9.6 | — | Google / chrome | 2026-10-06 | 2026-10-07 |
| CVE-2026-106417 Integer overflow in Media in Google Chrome prior to 155.0.8059.39 allowed a remo... |
critical | 9.6 | — | Google / chrome | 2026-10-06 | 2026-10-07 |
| CVE-2026-106419 Use after free in ANGLE in Google Chrome on on Android prior to 155.0.8059.39 al... |
critical | 9.6 | — | Google / chrome | 2026-10-06 | 2026-10-07 |
| CVE-2026-106401 Out of bounds write in Media in Google Chrome prior to 155.0.8059.39 allowed a r... |
critical | 9.6 | — | Google / chrome | 2026-10-06 | 2026-10-07 |
| CVE-2026-106382 Use after free in Chromecast in Google Chrome prior to 155.0.8059.39 allowed a r... |
critical | 9.6 | — | Google / chrome | 2026-10-06 | 2026-10-07 |
| CVE-2026-106372 Incorrect authorization in UI in Google Chrome prior to 155.0.8059.39 allowed a... |
critical | 9.6 | — | Google / chrome | 2026-10-06 | 2026-10-07 |
| CVE-2026-106375 Incomplete cleanup in Dawn in Google Chrome prior to 155.0.8059.39 allowed a rem... |
critical | 9.6 | — | Google / chrome | 2026-10-06 | 2026-10-07 |
| CVE-2026-106358 Use after free in Navigation in Google Chrome prior to 155.0.8059.39 allowed a r... |
critical | 9.6 | — | Google / chrome | 2026-10-06 | 2026-10-14 |
| CVE-2026-106329 Incorrect authorization in FileSystem in Google Chrome prior to 155.0.8059.39 al... |
critical | 9.6 | — | Google / chrome | 2026-10-06 | 2026-10-07 |
| CVE-2026-106323 Missing authorization in Chrome for iOS in Google Chrome on on iOS prior to 155.... |
critical | 9.6 | — | Google / chrome | 2026-10-06 | 2026-10-07 |
| CVE-2026-106294 Incomplete cleanup in Chromoting in Google Chrome on on Mac prior to 155.0.8059.... |
critical | 9.1 | — | Google / chrome | 2026-10-06 | 2026-10-13 |
| CVE-2026-106298 Use after free in Chrome Tabs in Google Chrome on on Mac prior to 155.0.8059.39... |
critical | 9.6 | — | Google / chrome | 2026-10-06 | 2026-10-07 |
| CVE-2026-106281 Use after free in Tint in Google Chrome prior to 155.0.8059.39 allowed a remote... |
critical | 9.6 | — | Google / chrome | 2026-10-06 | 2026-10-07 |
| CVE-2026-106241 Incorrect authorization in Search in Google Chrome on on Android prior to 155.0.... |
critical | 9.6 | — | Google / chrome | 2026-10-06 | 2026-10-07 |
| CVE-2026-106234 Use after free in Network in Google Chrome prior to 155.0.8059.39 allowed a remo... |
critical | 9.6 | — | Google / chrome | 2026-10-06 | 2026-10-07 |
| CVE-2026-106237 Information leak in Permissions in Google Chrome prior to 155.0.8059.39 allowed... |
critical | 9.6 | — | Google / chrome | 2026-10-06 | 2026-10-09 |
| CVE-2026-106239 Integer overflow in WebGL in Google Chrome on on Android prior to 155.0.8059.39... |
critical | 9.6 | — | Google / chrome | 2026-10-06 | 2026-10-07 |
| CVE-2026-106227 Use after free in Core in Google Chrome prior to 155.0.8059.39 allowed a remote... |
critical | 9.6 | — | Google / chrome | 2026-10-06 | 2026-10-07 |
| CVE-2026-106211 Use after free in TabStrip in Google Chrome prior to 155.0.8059.39 allowed a rem... |
critical | 9.6 | — | Google / chrome | 2026-10-06 | 2026-10-08 |
| CVE-2026-106195 Incorrect authorization in Chromoting in Google Chrome on on Mac prior to 155.0.... |
critical | 9.1 | — | Google / chrome | 2026-10-06 | 2026-10-09 |
| CVE-2026-106197 Use after free in Browser in Google Chrome prior to 155.0.8059.39 allowed a remo... |
critical | 9.6 | — | Google / chrome | 2026-10-06 | 2026-10-08 |
| CVE-2026-102322 Incorrect Authorization in SiteIsolation in Google Chrome prior to 155.0.8059.39... |
critical | 9.6 | — | Google / chrome | 2026-10-06 | 2026-10-08 |
| CVE-2026-106102 Quasar Framework is a framework for building high-performance Vue.js user interf... |
critical | 10.0 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-106218 In JetBrains TeamCity before 2026.1.3
2025.11.7 kotlin DSL sandbox escape leadin... |
critical | 10.0 | — | Jetbrains / teamcity | 2026-10-06 | 2026-10-08 |
| CVE-2026-105863 Payload is a free and open source headless content management system. |
critical | 9.4 | — | Payloadcms / payload | 2026-10-06 | 2026-10-15 |
| CVE-2026-105857 Payload is a free and open source headless content management system. |
critical | 10.0 | — | Payloadcms / payload | 2026-10-06 | 2026-10-15 |
| CVE-2026-105859 Payload is a free and open source headless content management system. |
critical | 9.8 | — | Payloadcms / payload | 2026-10-06 | 2026-10-15 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.