October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,481
Critical
1,390
High
6,087
Medium
6,446
Low
659
Severity not reported
2,899
In CISA KEV
21
Most affected vendors (by CPE data where available): microsoft (1359), google (759), oracle (376), apple (282), ibm (149), adobe (138), apache (73), imagemagick (72), broadcom (61), freerdp (60)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-118327 Memory corruption in Media in Google Chrome prior to 156.0.8078.73 allowed a rem... |
high | 8.8 | — | Google / chrome | 2026-10-27 | 2026-11-03 |
| CVE-2026-118307 Use after free in Paint in Google Chrome prior to 156.0.8078.73 allowed a remote... |
high | 8.8 | — | Google / chrome | 2026-10-27 | 2026-11-03 |
| CVE-2026-118311 Memory corruption in Media in Google Chrome prior to 156.0.8078.73 allowed a rem... |
high | 8.8 | — | Google / chrome | 2026-10-27 | 2026-11-03 |
| CVE-2026-118313 Use after free in Video in Google Chrome prior to 156.0.8078.73 allowed a remote... |
high | 8.8 | — | Google / chrome | 2026-10-27 | 2026-11-03 |
| CVE-2026-118314 Improper input validation in UI in Google Chrome on on Android prior to 156.0.80... |
high | 8.8 | — | Google / chrome | 2026-10-27 | 2026-11-03 |
| CVE-2026-118304 Improper input validation in SVG in Google Chrome prior to 156.0.8078.73 allowed... |
high | 8.8 | — | Google / chrome | 2026-10-27 | 2026-11-03 |
| CVE-2026-78661 When coalescing adjacent text nodes in addText and fosterParent, appending to an... |
high | 7.5 | — | — | 2026-10-27 | 2026-11-04 |
| CVE-2026-62765 Access of resource using incompatible type ('type confusion') in Microsoft Edge... |
high | 8.1 | — | Microsoft / edge | 2026-10-27 | 2026-11-03 |
| CVE-2026-57186 Asterisk is an open source private branch exchange and telephony toolkit. |
high | 7.5 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-85898 Access of resource using incompatible type ('type confusion') in Microsoft Edge... |
high | 8.8 | — | Microsoft / edge | 2026-10-27 | 2026-11-03 |
| CVE-2026-83831 Double free in Microsoft Edge (Chromium-based) allows an unauthorized attacker t... |
high | 8.8 | — | Microsoft / edge | 2026-10-27 | 2026-11-03 |
| CVE-2026-57195 Asterisk is an open source private branch exchange and telephony toolkit. |
high | 7.5 | — | — | 2026-10-27 | 2026-11-02 |
| CVE-2026-57200 Asterisk is an open source private branch exchange and telephony toolkit. |
high | 7.5 | — | — | 2026-10-27 | 2026-10-30 |
| CVE-2026-116688 CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture. |
high | 8.1 | — | — | 2026-10-27 | 2026-11-02 |
| CVE-2026-116690 MLflow is an open source AI engineering platform for agents, large language mode... |
high | 7.5 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-112355 The MembershipWorks plugin for WordPress before 6.17 contains an information dis... |
high | 7.5 | — | — | 2026-10-27 | 2026-11-04 |
| CVE-2026-112350 Sunhillo SureLine before 9.1.5 contains a path traversal vulnerability in the ra... |
high | 7.5 | — | Sunhillo / sureline | 2026-10-27 | 2026-11-03 |
| CVE-2026-112351 Sunhillo SureLine before 9.1.5 contains an OS command injection vulnerability in... |
high | 8.8 | — | Sunhillo / sureline | 2026-10-27 | 2026-11-03 |
| CVE-2026-118175 When replying to, forwarding, or editing a crafted email message as new, Thunder... |
high | 7.5 | — | — | 2026-10-27 | 2026-11-04 |
| CVE-2026-118176 Thunderbird's check that prevents mailbox: URLs from accessing files on remote W... |
high | 8.1 | — | — | 2026-10-27 | 2026-11-04 |
| CVE-2026-118179 Clicking a news: or snews: link that referenced a message-ID made Thunderbird co... |
high | 8.8 | — | — | 2026-10-27 | 2026-11-04 |
| CVE-2026-118180 When logging in to a Matrix account, Thunderbird used the homeserver address pro... |
high | 7.5 | — | — | 2026-10-27 | 2026-11-04 |
| CVE-2026-115413 Missing token audience validation in the OAuth authentication mode of AWS API MC... |
high | 7.8 | — | — | 2026-10-27 | 2026-11-04 |
| CVE-2026-87086 Tanium addressed a denial of service vulnerability in Provision. |
high | 7.5 | — | — | 2026-10-27 | 2026-11-04 |
| CVE-2026-88812 A double free in XKB SetGeometryin X.Org X Server before 21.1.25 and X Wayland b... |
high | 7.8 | — | — | 2026-10-27 | 2026-11-04 |
| CVE-2026-57202 Asterisk is an open source private branch exchange and telephony toolkit. |
high | 8.1 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-116682 FileBrowser Quantum is a free, self-hosted, web-based file manager. |
high | 8.6 | — | — | 2026-10-27 | 2026-11-02 |
| CVE-2026-117515 A security flaw has been discovered in oretnom23 php-travel-agency-system 4e28b8... |
high | 7.3 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-117516 A weakness has been identified in oretnom23 php-travel-agency-system. |
high | 7.3 | — | — | 2026-10-27 | 2026-11-02 |
| CVE-2026-116662 Tanium addressed a compression bomb vulnerability in Enforce. |
high | 7.5 | — | — | 2026-10-27 | 2026-11-04 |
| CVE-2026-116676 Atlantis is a self-hosted golang application that listens for Terraform pull req... |
high | 8.8 | — | — | 2026-10-27 | 2026-11-03 |
| CVE-2026-116647 Tanium addressed an improper output sanitization vulnerability in Comply. |
high | 7.1 | — | — | 2026-10-27 | 2026-11-04 |
| CVE-2026-116649 Tanium addressed an improper output sanitization vulnerability in Enforce. |
high | 7.1 | — | — | 2026-10-27 | 2026-11-04 |
| CVE-2026-116656 Tanium addressed an uncontrolled resource consumption vulnerability in Enforce. |
high | 7.5 | — | — | 2026-10-27 | 2026-11-04 |
| CVE-2026-108329 Tanium addressed an unauthorized code execution vulnerability in Threat Response... |
high | 8.8 | — | — | 2026-10-27 | 2026-11-04 |
| CVE-2026-108305 Tanium addressed a local privilege escalation vulnerability in End-User Notifica... |
high | 7.8 | — | — | 2026-10-27 | 2026-11-04 |
| CVE-2026-108306 Tanium addressed a local privilege escalation vulnerability in End-User Notifica... |
high | 7.8 | — | — | 2026-10-27 | 2026-11-04 |
| CVE-2026-108307 Tanium addressed a heap-based buffer overflow vulnerability in Index. |
high | 7.8 | — | — | 2026-10-27 | 2026-11-04 |
| CVE-2026-108303 Tanium addressed an unauthorized code execution vulnerability in Certificate Man... |
high | 8.8 | — | — | 2026-10-27 | 2026-11-04 |
| CVE-2026-108304 Tanium addressed a local privilege escalation vulnerability in End-User Notifica... |
high | 7.8 | — | — | 2026-10-27 | 2026-11-04 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.