October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,481
Critical
1,390
High
6,087
Medium
6,446
Low
659
Severity not reported
2,899
In CISA KEV
21
Most affected vendors (by CPE data where available): microsoft (1359), google (759), oracle (376), apple (282), ibm (149), adobe (138), apache (73), imagemagick (72), broadcom (61), freerdp (60)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-117929 Use-after-free in the DOM: Core & HTML component. |
high | 8.8 | — | — | 2026-10-27 | 2026-11-04 |
| CVE-2026-117918 Use-after-free in the Graphics: Canvas2D component. |
high | 8.8 | — | — | 2026-10-27 | 2026-11-04 |
| CVE-2026-117919 Use-after-free in the DOM: Core & HTML component. |
high | 8.8 | — | — | 2026-10-27 | 2026-11-04 |
| CVE-2026-117921 Use-after-free in the CSS Parsing and Computation component. |
high | 8.8 | — | — | 2026-10-27 | 2026-11-04 |
| CVE-2026-117922 Use-after-free in the Networking: WebSockets component. |
high | 8.8 | — | — | 2026-10-27 | 2026-11-04 |
| CVE-2026-117910 Invalid pointer in the JavaScript Engine component. |
high | 7.3 | — | — | 2026-10-27 | 2026-11-04 |
| CVE-2026-117912 Same-origin policy bypass in the CSS Parsing and Computation component. |
high | 8.1 | — | — | 2026-10-27 | 2026-11-04 |
| CVE-2026-117915 Incorrect boundary conditions in the Layout: Block and Inline component. |
high | 7.3 | — | — | 2026-10-27 | 2026-11-04 |
| CVE-2026-117897 Incorrect boundary conditions in the Layout: Tables component. |
high | 7.3 | — | — | 2026-10-27 | 2026-11-04 |
| CVE-2026-117899 Use-after-free in the Networking: HTTP component. |
high | 8.8 | — | — | 2026-10-27 | 2026-11-04 |
| CVE-2026-117900 Use-after-free in the DOM: Editor component. |
high | 8.8 | — | — | 2026-10-27 | 2026-11-04 |
| CVE-2026-117901 Use-after-free in the DOM: Core & HTML component. |
high | 8.8 | — | — | 2026-10-27 | 2026-11-04 |
| CVE-2026-117904 Use-after-free in the JavaScript: GC component. |
high | 8.8 | — | — | 2026-10-27 | 2026-11-04 |
| CVE-2026-117887 Use-after-free in the DOM: Core & HTML component. |
high | 8.8 | — | — | 2026-10-27 | 2026-11-04 |
| CVE-2026-117889 Incorrect boundary conditions in the JavaScript Engine component. |
high | 7.3 | — | — | 2026-10-27 | 2026-11-04 |
| CVE-2026-117890 JIT miscompilation in the JavaScript Engine: JIT component. |
high | 7.3 | — | — | 2026-10-27 | 2026-11-04 |
| CVE-2026-117891 Use-after-free in the JavaScript Engine: JIT component. |
high | 7.3 | — | — | 2026-10-27 | 2026-11-04 |
| CVE-2026-117892 Privilege escalation due to use-after-free in the WebRTC: Networking component. |
high | 7.3 | — | — | 2026-10-27 | 2026-11-04 |
| CVE-2026-117879 Incorrect boundary conditions in the Layout: Tables component. |
high | 7.3 | — | — | 2026-10-27 | 2026-11-04 |
| CVE-2026-117881 Use-after-free in the DOM: Core & HTML component. |
high | 8.8 | — | — | 2026-10-27 | 2026-11-04 |
| CVE-2026-117883 Use-after-free in the DOM: HTML Parser component. |
high | 8.8 | — | — | 2026-10-27 | 2026-11-04 |
| CVE-2026-117884 Use-after-free in the Networking component. |
high | 8.8 | — | — | 2026-10-27 | 2026-11-04 |
| CVE-2026-117886 Incorrect boundary conditions in the Graphics: Text component. |
high | 8.1 | — | — | 2026-10-27 | 2026-11-04 |
| CVE-2026-117866 Privilege escalation due to use-after-free in the Graphics: Canvas2D component. |
high | 7.3 | — | — | 2026-10-27 | 2026-11-04 |
| CVE-2026-117867 Use-after-free in the Layout component. |
high | 7.3 | — | — | 2026-10-27 | 2026-11-04 |
| CVE-2026-117869 Use-after-free in the DOM: Core & HTML component. |
high | 8.8 | — | — | 2026-10-27 | 2026-11-04 |
| CVE-2026-117870 Use-after-free in the JavaScript Engine component. |
high | 7.3 | — | — | 2026-10-27 | 2026-11-04 |
| CVE-2026-117871 Invalid pointer in the Graphics component. |
high | 7.3 | — | — | 2026-10-27 | 2026-11-04 |
| CVE-2026-117872 Use-after-free in the JavaScript: Standard Library component. |
high | 8.8 | — | — | 2026-10-27 | 2026-11-04 |
| CVE-2026-117873 Incorrect boundary conditions in the Audio/Video: Playback component. |
high | 8.1 | — | — | 2026-10-27 | 2026-11-04 |
| CVE-2026-117602 Electrum 4.6.0 before 4.7.2 contains an authorization bypass in the external plu... |
high | 8.4 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117860 Same-origin policy bypass in the DOM: Navigation component. |
high | 8.1 | — | — | 2026-10-27 | 2026-11-04 |
| CVE-2026-117864 Sandbox escape in the Form Manager component. |
high | 8.8 | — | — | 2026-10-27 | 2026-11-04 |
| CVE-2026-117567 esp-mcp through commit 28afddf contains an OS command injection vulnerability th... |
high | 7.8 | — | — | 2026-10-27 | 2026-11-02 |
| CVE-2026-117568 mcp-ffmpeg through 1.0.5 contains an OS command injection vulnerability that all... |
high | 7.0 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-117569 Kali-GPT through commit a608c74 contains an OS command injection vulnerability i... |
high | 7.8 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117573 hagent through commit 761eec6 contains an OS command injection vulnerability tha... |
high | 7.8 | — | — | 2026-10-27 | 2026-11-02 |
| CVE-2026-117601 Electrum before 4.8.3 fails to verify signatures of wallet-owned inputs in uncon... |
high | 7.5 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-117560 ATXP Gemini CLI extension through 1.0.0 contains an OS command injection vulnera... |
high | 7.8 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-117561 Codefriar sf-mcp through 1.3.2 contains an OS command injection vulnerability th... |
high | 7.8 | — | — | 2026-10-27 | 2026-10-27 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.