October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 29, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
22,229
Critical
3,102
High
7,094
Medium
6,630
Low
674
Severity not reported
4,729
In CISA KEV
188
Most affected vendors (by CPE data where available): microsoft (1176), google (780), ibm (323), mozilla (182), oracle (154), adobe (137), linux (126), apache (116), broadcom (113), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-106186 Uncontrolled search path element in CredentialProvider in Google Chrome on on Wi... |
high | 8.6 | — | Google / chrome | 2026-10-06 | 2026-10-08 |
| CVE-2026-106193 Use after free in Parser in Google Chrome prior to 155.0.8059.39 allowed a remot... |
high | 8.8 | — | Google / chrome | 2026-10-06 | 2026-10-08 |
| CVE-2026-106194 Missing authorization in WebAppInstalls in Google Chrome prior to 155.0.8059.39... |
high | 8.3 | — | Google / chrome | 2026-10-06 | 2026-10-08 |
| CVE-2026-106200 Use after free in Track in Google Chrome prior to 155.0.8059.39 allowed a remote... |
high | 8.8 | — | Google / chrome | 2026-10-06 | 2026-10-08 |
| CVE-2026-106301 Confused deputy in Contextual Tasks in Google Chrome prior to 155.0.8059.39 allo... |
high | 8.1 | — | Google / chrome | 2026-10-06 | 2026-10-08 |
| CVE-2026-106201 Race condition in V8 in Google Chrome prior to 155.0.8059.39 allowed a remote at... |
high | 8.8 | — | Google / chrome | 2026-10-06 | 2026-10-08 |
| CVE-2026-106203 Incomplete cleanup in Autofill in Google Chrome on on iOS prior to 155.0.8059.39... |
high | 8.8 | — | Google / chrome | 2026-10-06 | 2026-10-08 |
| CVE-2026-106204 Use after free in PDF in Google Chrome prior to 155.0.8059.39 allowed a remote a... |
high | 8.8 | — | Google / chrome | 2026-10-06 | 2026-10-08 |
| CVE-2026-106205 Missing authorization in Passwords in Google Chrome on on Android prior to 155.0... |
high | 8.1 | — | Google / chrome | 2026-10-06 | 2026-10-08 |
| CVE-2026-106207 Race condition in V8 in Google Chrome prior to 155.0.8059.39 allowed a remote at... |
high | 8.8 | — | Google / chrome | 2026-10-06 | 2026-10-08 |
| CVE-2026-106220 Information leak in Passwords in Google Chrome prior to 155.0.8059.39 allowed a... |
high | 8.8 | — | Google / chrome | 2026-10-06 | 2026-10-08 |
| CVE-2026-106225 Missing authorization in Autofill in Google Chrome prior to 155.0.8059.39 allowe... |
high | 8.8 | — | Google / chrome | 2026-10-06 | 2026-10-08 |
| CVE-2026-106228 Confused deputy in Google Lens in Google Chrome prior to 155.0.8059.39 allowed a... |
high | 8.3 | — | Google / chrome | 2026-10-06 | 2026-10-07 |
| CVE-2026-106233 Use after free in Metrics in Google Chrome prior to 155.0.8059.39 allowed a remo... |
high | 8.3 | — | Google / chrome | 2026-10-06 | 2026-10-07 |
| CVE-2026-55270 In dialInternal in multiple locations, there is a possible permission bypass due... |
high | 7.8 | — | Google / android | 2026-10-05 | 2026-10-07 |
| CVE-2026-58880 In handle_app_val_response of btif_rc.cc, there is a possible way to achieve cod... |
high | 7.0 | — | Google / android | 2026-10-05 | 2026-10-07 |
| CVE-2026-58865 In multiple functions of PduParser.java, there is a possible persistent denial o... |
high | 7.5 | — | Google / android | 2026-10-05 | 2026-10-07 |
| CVE-2026-58859 In multiple places, there is a possible denial of service due to an uncaught exc... |
high | 7.8 | — | Google / android | 2026-10-05 | 2026-10-07 |
| CVE-2026-58854 In multiple locations, there is a possible memory corruption due to type confusi... |
high | 7.8 | — | Google / android | 2026-10-05 | 2026-10-07 |
| CVE-2026-58841 In multiple functions of VirtualAudioControllerTest.java, there is a possible pe... |
high | 7.8 | — | Google / android | 2026-10-05 | 2026-10-07 |
| CVE-2026-106235 Use after free in WebAudio in Google Chrome prior to 155.0.8059.39 allowed a rem... |
high | 8.8 | — | Google / chrome | 2026-10-06 | 2026-10-07 |
| CVE-2026-58835 In cfg2prop of btif_storage.cc, there is a possible out-of-bounds write due to a... |
high | 8.8 | — | Google / android | 2026-10-05 | 2026-10-07 |
| CVE-2026-49937 In multiple functions of MessageQueueBase.h, there is a possible out of bounds r... |
high | 7.8 | — | Google / android | 2026-10-05 | 2026-10-07 |
| CVE-2026-55269 In FilterCapturedPacket of snoop_logger.cc, there is a possible memory safety is... |
high | 7.8 | — | Google / android | 2026-10-05 | 2026-10-07 |
| CVE-2026-55266 In qsort of libufdt_sysdeps_vendor.c, there is a possible out-of-bounds write du... |
high | 7.8 | — | Google / android | 2026-10-05 | 2026-10-07 |
| CVE-2026-58815 In multiple locations, there is a possible out of bounds write due to an incorre... |
high | 7.8 | — | Google / android | 2026-10-05 | 2026-10-07 |
| CVE-2026-55280 In multiple locations, there is a possible out-of-bounds write due to uninitiali... |
high | 8.8 | — | Google / android | 2026-10-05 | 2026-10-07 |
| CVE-2026-55286 In stpropnci_process of stpropnci.cc, there is a possible out of bounds write du... |
high | 7.8 | — | Google / android | 2026-10-05 | 2026-10-07 |
| CVE-2026-106238 Race condition in Fonts in Google Chrome prior to 155.0.8059.39 allowed a remote... |
high | 8.3 | — | Google / chrome | 2026-10-06 | 2026-10-07 |
| CVE-2026-106240 Type confusion in V8 in Google Chrome prior to 155.0.8059.39 allowed a remote at... |
high | 8.8 | — | Google / chrome | 2026-10-06 | 2026-10-07 |
| CVE-2026-106268 Use after free in WebRTC in Google Chrome prior to 155.0.8059.39 allowed a remot... |
high | 8.8 | — | Google / chrome | 2026-10-06 | 2026-10-07 |
| CVE-2026-106269 Use after free in CSS in Google Chrome prior to 155.0.8059.39 allowed a remote a... |
high | 8.8 | — | Google / chrome | 2026-10-06 | 2026-10-07 |
| CVE-2026-106335 Use after free in Media in Google Chrome prior to 155.0.8059.39 allowed a remote... |
high | 8.8 | — | Google / chrome | 2026-10-06 | 2026-10-07 |
| CVE-2026-106371 Incorrect authorization in Transactions Platform in Google Chrome on on Android... |
high | 8.8 | — | Google / chrome | 2026-10-06 | 2026-10-07 |
| CVE-2026-106373 Use after free in Fonts in Google Chrome on on Windows prior to 155.0.8059.39 al... |
high | 8.8 | — | Google / chrome | 2026-10-06 | 2026-10-07 |
| CVE-2026-106374 Type confusion in V8 in Google Chrome prior to 155.0.8059.39 allowed a remote at... |
high | 8.8 | — | Google / chrome | 2026-10-06 | 2026-10-07 |
| CVE-2026-106377 Race condition in Fonts in Google Chrome prior to 155.0.8059.39 allowed a remote... |
high | 8.3 | — | Google / chrome | 2026-10-06 | 2026-10-07 |
| CVE-2026-106378 Privilege elevation in Sandbox in Google Chrome on on Mac prior to 155.0.8059.39... |
high | 8.3 | — | Google / chrome | 2026-10-06 | 2026-10-07 |
| CVE-2026-106383 Use after free in Media in Google Chrome prior to 155.0.8059.39 allowed a remote... |
high | 8.8 | — | Google / chrome | 2026-10-06 | 2026-10-07 |
| CVE-2026-106278 Use after free in Select in Google Chrome prior to 155.0.8059.39 allowed a remot... |
high | 8.8 | — | Google / chrome | 2026-10-06 | 2026-10-07 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.