October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,481
Critical
1,390
High
6,087
Medium
6,446
Low
659
Severity not reported
2,899
In CISA KEV
21
Most affected vendors (by CPE data where available): microsoft (1359), google (759), oracle (376), apple (282), ibm (149), adobe (138), apache (73), imagemagick (72), broadcom (61), freerdp (60)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-118308 Use after free in SVG in Google Chrome prior to 156.0.8078.73 allowed a remote a... |
critical | 9.6 | — | Google / chrome | 2026-10-27 | 2026-11-03 |
| CVE-2026-118309 Improper input validation in UI in Google Chrome on on Android prior to 156.0.80... |
critical | 9.6 | — | Google / chrome | 2026-10-27 | 2026-11-03 |
| CVE-2026-118310 Improper input validation in Views in Google Chrome on on Windows prior to 156.0... |
critical | 9.6 | — | Google / chrome | 2026-10-27 | 2026-11-03 |
| CVE-2026-118312 Memory corruption in Paint in Google Chrome prior to 156.0.8078.73 allowed a rem... |
critical | 9.6 | — | Google / chrome | 2026-10-27 | 2026-11-03 |
| CVE-2026-118305 Memory corruption in Turbolev in Google Chrome prior to 156.0.8078.73 allowed a... |
critical | 9.6 | — | Google / chrome | 2026-10-27 | 2026-11-03 |
| CVE-2026-116692 MLflow is an open source AI engineering platform for agents, large language mode... |
critical | 9.8 | — | — | 2026-10-27 | 2026-11-02 |
| CVE-2026-112352 Sunhillo SureLine before 9.1.5 contains an authentication bypass vulnerability t... |
critical | 9.8 | — | Sunhillo / sureline | 2026-10-27 | 2026-11-03 |
| CVE-2026-118177 When looking for calendars in a directory on a server, during account setup or w... |
critical | 9.1 | — | — | 2026-10-27 | 2026-11-04 |
| CVE-2026-118170 The strapi/review-workflows package is vulnerable to a broken access control vul... |
critical | 9.1 | — | — | 2026-10-27 | 2026-11-04 |
| CVE-2026-118131 GnuPG (version 2.5.21) for Windows contains a vulnerability where default Discre... |
critical | 9.8 | — | — | 2026-10-27 | 2026-11-04 |
| CVE-2026-48360 Adobe Connect is affected by an Improper Control of Generation of Code ('Code In... |
critical | 9.6 | — | — | 2026-10-27 | 2026-10-29 |
| CVE-2026-114595 In EPICS Base release 7.0.10 and prior, an integer overflow in network request p... |
critical | 9.8 | — | — | 2026-10-27 | 2026-11-04 |
| CVE-2026-105489 Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Specia... |
critical | 9.9 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-105779 Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Specia... |
critical | 9.1 | — | — | 2026-10-27 | 2026-11-02 |
| CVE-2026-105780 Adobe Campaign Classic (ACC) is affected by an Incorrect Authorization vulnerabi... |
critical | 9.9 | — | — | 2026-10-27 | 2026-11-02 |
| CVE-2026-105781 Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Specia... |
critical | 10.0 | — | — | 2026-10-27 | 2026-11-02 |
| CVE-2026-104350 Adobe Campaign Classic (ACC) is affected by a reflected Cross-Site Scripting (XS... |
critical | 9.3 | — | — | 2026-10-27 | 2026-11-02 |
| CVE-2026-104351 Adobe Campaign Classic (ACC) is affected by an Improper Control of Generation of... |
critical | 9.9 | — | — | 2026-10-27 | 2026-11-02 |
| CVE-2026-104353 Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Specia... |
critical | 9.9 | — | — | 2026-10-27 | 2026-11-02 |
| CVE-2026-104354 Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Specia... |
critical | 9.1 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-116863 Cross-Site Request Forgery (CSRF) vulnerability in Tribulant Software Newsletter... |
critical | 9.6 | — | — | 2026-10-27 | 2026-10-29 |
| CVE-2026-78845 Aidot products Linkind Matter Smart Plug 1.01.32, OREiN Matter Smart Light Bulb... |
critical | 9.8 | — | — | 2026-10-27 | 2026-10-31 |
| CVE-2026-118027 Frame poisoning in the Layout component. |
critical | 9.1 | — | — | 2026-10-27 | 2026-11-04 |
| CVE-2026-117917 Invalid pointer in the Graphics: WebRender component. |
critical | 9.8 | — | — | 2026-10-27 | 2026-11-04 |
| CVE-2026-117920 Use-after-free in the DOM: HTML Parser component. |
critical | 9.6 | — | — | 2026-10-27 | 2026-11-04 |
| CVE-2026-117868 Sandbox escape in the DOM: Networking component. |
critical | 9.6 | — | — | 2026-10-27 | 2026-11-04 |
| CVE-2026-117861 Sandbox escape in the DOM: Navigation component. |
critical | 9.6 | — | — | 2026-10-27 | 2026-11-04 |
| CVE-2026-117862 Privilege escalation due to incorrect boundary conditions in the Networking comp... |
critical | 9.8 | — | — | 2026-10-27 | 2026-11-04 |
| CVE-2026-117564 nest-admin before 1.0.1 contains an authentication bypass vulnerability that all... |
critical | 9.8 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-65145 NVIDIA NeMo Agent Toolkit contains a vulnerability where a attacker could cause... |
critical | 10.0 | — | — | 2026-10-27 | 2026-11-04 |
| CVE-2026-112362 @fastify/express is a Fastify plugin that runs Express middleware inside Fastify... |
critical | 9.1 | — | — | 2026-10-27 | 2026-11-04 |
| CVE-2026-117532 REDAXO core from 5.3.0 before 5.21.4 contains an authentication bypass vulnerabi... |
critical | 9.8 | — | — | 2026-10-27 | 2026-11-02 |
| CVE-2026-82119 OS Command Injection Vulnerability in HiRDB. |
critical | 9.8 | — | — | 2026-10-27 | 2026-11-04 |
| CVE-2026-82120 Heap-based Buffer Overflow Vulnerability in HiRDB. |
critical | 9.8 | — | — | 2026-10-27 | 2026-11-04 |
| CVE-2026-82122 Stack-based Buffer Overflow Vulnerability in HiRDB. |
critical | 9.4 | — | — | 2026-10-27 | 2026-11-04 |
| CVE-2026-86574 Heap-based Buffer Overflow Vulnerability in JP1/Base. |
critical | 9.8 | — | — | 2026-10-27 | 2026-11-04 |
| CVE-2026-86575 Stack-based Buffer Overflow Vulnerability in JP1 Products. |
critical | 9.4 | — | — | 2026-10-27 | 2026-11-04 |
| CVE-2026-86576 Heap-based Buffer Overflow Vulnerability in JP1 Products. |
critical | 9.4 | — | — | 2026-10-27 | 2026-11-04 |
| CVE-2026-86577 Out-of-bounds Write Vulnerability in JP1 Products. |
critical | 9.4 | — | — | 2026-10-27 | 2026-11-04 |
| CVE-2026-76935 Stack-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System... |
critical | 9.4 | — | — | 2026-10-27 | 2026-11-04 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.