October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 29, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
22,229
Critical
3,102
High
7,094
Medium
6,630
Low
674
Severity not reported
4,729
In CISA KEV
188
Most affected vendors (by CPE data where available): microsoft (1176), google (780), ibm (323), mozilla (182), oracle (154), adobe (137), linux (126), apache (116), broadcom (113), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-106279 Incorrect reference resolution in Passwords in Google Chrome on on iOS prior to... |
high | 7.4 | — | Google / chrome | 2026-10-06 | 2026-10-07 |
| CVE-2026-106283 Use after free in Streaming in Google Chrome prior to 155.0.8059.39 allowed a re... |
high | 8.8 | — | Google / chrome | 2026-10-06 | 2026-10-07 |
| CVE-2026-106291 Use after free in GarbageCollection in Google Chrome prior to 155.0.8059.39 allo... |
high | 8.8 | — | Google / chrome | 2026-10-06 | 2026-10-07 |
| CVE-2026-106292 Buffer overflow in Fonts in Google Chrome prior to 155.0.8059.39 allowed a remot... |
high | 8.3 | — | Google / chrome | 2026-10-06 | 2026-10-07 |
| CVE-2026-106293 Type confusion in ANGLE in Google Chrome prior to 155.0.8059.39 allowed a remote... |
high | 8.3 | — | Google / chrome | 2026-10-06 | 2026-10-07 |
| CVE-2026-106308 Incorrect reference resolution in Autofill in Google Chrome on on Android prior... |
high | 8.8 | — | Google / chrome | 2026-10-06 | 2026-10-07 |
| CVE-2026-106309 Incorrect authorization in Selection in Google Chrome on on iOS prior to 155.0.8... |
high | 8.8 | — | Google / chrome | 2026-10-06 | 2026-10-07 |
| CVE-2026-106314 Incorrect authorization in Bluetooth in Google Chrome prior to 155.0.8059.39 all... |
high | 8.8 | — | Google / chrome | 2026-10-06 | 2026-10-07 |
| CVE-2026-106315 Use after free in Modularization in Google Chrome prior to 155.0.8059.39 allowed... |
high | 8.8 | — | Google / chrome | 2026-10-06 | 2026-10-07 |
| CVE-2026-106318 Use after free in Media in Google Chrome prior to 155.0.8059.39 allowed a remote... |
high | 8.8 | — | Google / chrome | 2026-10-06 | 2026-10-07 |
| CVE-2026-106393 Use after free in Storage in Google Chrome prior to 155.0.8059.39 allowed a remo... |
high | 8.3 | — | Google / chrome | 2026-10-06 | 2026-10-07 |
| CVE-2026-106409 Incorrect reference resolution in WebAppInstalls in Google Chrome on on Mac prio... |
high | 8.3 | — | Google / chrome | 2026-10-06 | 2026-10-07 |
| CVE-2026-106411 Use after free in Parser in Google Chrome prior to 155.0.8059.39 allowed a remot... |
high | 8.8 | — | Google / chrome | 2026-10-06 | 2026-10-07 |
| CVE-2026-106247 Buffer overflow in ANGLE in Google Chrome prior to 155.0.8059.39 allowed a remot... |
high | 8.3 | — | Google / chrome | 2026-10-06 | 2026-10-07 |
| CVE-2026-106248 Use after free in Bindings in Google Chrome prior to 155.0.8059.39 allowed a rem... |
high | 8.8 | — | Google / chrome | 2026-10-06 | 2026-10-07 |
| CVE-2026-106249 Incorrect authorization in Autofill in Google Chrome on on Android prior to 155.... |
high | 8.8 | — | Google / chrome | 2026-10-06 | 2026-10-07 |
| CVE-2026-106412 Race condition in Core in Google Chrome on on Mac prior to 155.0.8059.39 allowed... |
high | 8.3 | — | Google / chrome | 2026-10-06 | 2026-10-07 |
| CVE-2026-106423 Use after free in Media in Google Chrome prior to 155.0.8059.39 allowed a remote... |
high | 8.8 | — | Google / chrome | 2026-10-06 | 2026-10-07 |
| CVE-2026-106426 Race condition in Fonts in Google Chrome prior to 155.0.8059.39 allowed a remote... |
high | 8.3 | — | Google / chrome | 2026-10-06 | 2026-10-07 |
| CVE-2026-49933 In handle_le_monitor_device_event of msft.cc, there is a possible control-flow h... |
high | 7.8 | — | Google / android | 2026-10-05 | 2026-10-07 |
| CVE-2026-106255 Race condition in V8 in Google Chrome prior to 155.0.8059.39 allowed a remote at... |
high | 8.8 | — | Google / chrome | 2026-10-06 | 2026-10-07 |
| CVE-2026-106256 Information leak in Passwords in Google Chrome on on Android prior to 155.0.8059... |
high | 8.8 | — | Google / chrome | 2026-10-06 | 2026-10-07 |
| CVE-2026-106252 Incorrect comparison in Fonts in Google Chrome prior to 155.0.8059.39 allowed a... |
high | 8.8 | — | Google / chrome | 2026-10-06 | 2026-10-07 |
| CVE-2026-106257 Use after free in HTML in Google Chrome prior to 155.0.8059.39 allowed a remote... |
high | 8.8 | — | Google / chrome | 2026-10-06 | 2026-10-07 |
| CVE-2026-106421 Use after free in PDF in Google Chrome prior to 155.0.8059.39 allowed a remote a... |
high | 8.8 | — | Google / chrome | 2026-10-06 | 2026-10-07 |
| CVE-2026-28625 In multiple locations, there is a possible permission bypass due to a logic erro... |
high | 7.8 | — | Google / android | 2026-10-05 | 2026-10-07 |
| CVE-2026-28640 In checkCallerIsCertInstallerOrSelfInProfile of CredentialStorageActivity.java,... |
high | 7.8 | — | Google / android | 2026-10-05 | 2026-10-07 |
| CVE-2026-28641 In shouldDisableUninstallButton of ApplicationActionButtonsPreferenceController.... |
high | 7.8 | — | Google / android | 2026-10-05 | 2026-10-07 |
| CVE-2026-28647 In updateState of DeviceAdminAppsPreferenceController.java, there is a possible... |
high | 7.8 | — | Google / android | 2026-10-05 | 2026-10-07 |
| CVE-2026-28648 In Settings, there is a possible permission bypass due to a confused deputy. |
high | 7.8 | — | Google / android | 2026-10-05 | 2026-10-07 |
| CVE-2026-45524 In isSystem of WifiPermissionsUtil.java, there is a possible sandbox escape due... |
high | 8.8 | — | Google / android | 2026-10-05 | 2026-10-07 |
| CVE-2026-49878 In wpas_handle_robust_av_scs_recv_action of robust_av.c, there is a possible out... |
high | 7.2 | — | Google / android | 2026-10-05 | 2026-10-07 |
| CVE-2026-49880 In multiple functions of nfa_nfcee_act.cc, there is a possible out-of-bounds wri... |
high | 7.8 | — | Google / android | 2026-10-05 | 2026-10-07 |
| CVE-2026-49885 In rw_t4t_update_file of rw_t4t.cc, there is a possible out-of-bounds write due... |
high | 7.8 | — | Google / android | 2026-10-05 | 2026-10-07 |
| CVE-2026-103623 Use after free in MediaStream in Google Chrome prior to 154.0.8037.97 allowed a... |
high | 8.8 | — | Google / chrome | 2026-10-02 | 2026-10-06 |
| CVE-2026-103631 Buffer overflow in WebRTC in Google Chrome prior to 154.0.8037.97 allowed a remo... |
high | 8.8 | — | Google / chrome | 2026-10-02 | 2026-10-06 |
| CVE-2026-28659 In MicroXR Blobstore, there is a possible way to access other app's files due to... |
high | 7.8 | — | Google / android xr | 2026-09-08 | 2026-10-05 |
| CVE-2026-103624 Use after free in Contextual Tasks in Google Chrome on on Windows prior to 154.0... |
high | 8.3 | — | Google / chrome | 2026-10-02 | 2026-10-05 |
| CVE-2026-103625 Type confusion in V8 in Google Chrome prior to 154.0.8037.97 allowed a remote at... |
high | 8.8 | — | Google / chrome | 2026-10-02 | 2026-10-05 |
| CVE-2026-103622 Use after free in SVG in Google Chrome prior to 154.0.8037.97 allowed a remote a... |
high | 8.8 | — | Google / chrome | 2026-10-02 | 2026-10-05 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.