October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
24,594
Critical
3,297
High
7,976
Medium
7,646
Low
740
Severity not reported
4,935
In CISA KEV
191
Most affected vendors (by CPE data where available): microsoft (1424), google (825), linux (722), ibm (323), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (116), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-113191 Use after free in Internals in Google Chrome on on Mac prior to 156.0.8078.47 al... |
high | 8.8 | — | Google / chrome | 2026-10-20 | 2026-10-22 |
| CVE-2026-113192 Memory corruption in V8 in Google Chrome prior to 156.0.8078.47 allowed a remote... |
high | 8.8 | — | Google / chrome | 2026-10-20 | 2026-10-22 |
| CVE-2026-113194 Memory corruption in Core in Google Chrome prior to 156.0.8078.47 allowed a remo... |
high | 8.8 | — | Google / chrome | 2026-10-20 | 2026-10-22 |
| CVE-2026-113195 Improper input validation in Downloads in Google Chrome prior to 156.0.8078.47 a... |
high | 8.8 | — | Google / chrome | 2026-10-20 | 2026-10-22 |
| CVE-2026-113197 Use after free in Forms in Google Chrome prior to 156.0.8078.47 allowed a remote... |
high | 8.8 | — | Google / chrome | 2026-10-20 | 2026-10-22 |
| CVE-2026-113198 Use after free in Extensions in Google Chrome prior to 156.0.8078.47 allowed a r... |
high | 8.8 | — | Google / chrome | 2026-10-20 | 2026-10-22 |
| CVE-2026-113200 Use after free in ANGLE in Google Chrome prior to 156.0.8078.47 allowed a remote... |
high | 8.8 | — | Google / chrome | 2026-10-20 | 2026-10-22 |
| CVE-2026-113202 Use after free in BrowserTag in Google Chrome prior to 156.0.8078.47 allowed a r... |
high | 8.8 | — | Google / chrome | 2026-10-20 | 2026-10-22 |
| CVE-2026-113203 Use after free in CSS in Google Chrome prior to 156.0.8078.47 allowed a remote a... |
high | 8.8 | — | Google / chrome | 2026-10-20 | 2026-10-22 |
| CVE-2026-113204 Use after free in TrustedWebActivities in Google Chrome on on Android prior to 1... |
high | 8.8 | — | Google / chrome | 2026-10-20 | 2026-10-22 |
| CVE-2026-109927 The HIPAA Forms WordPress plugin before 3.3.2 does not perform a capability chec... |
high | 7.2 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-109987 The PixelYourSite WordPress plugin before 11.4.3, PixelYourSite Pro WordPress pl... |
high | 7.2 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-111958 The Royal MCP WordPress plugin before 1.5.7 does not limit a preview-link token... |
high | 7.5 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-97328 The WebP Express WordPress plugin before 0.25.16 does not escape values that its... |
high | 7.5 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-114177 Cross-Site Request Forgery (CSRF) vulnerability in Xpro Xpro Elementor Addons xp... |
high | 8.8 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-111830 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-112242 Incorrect Privilege Assignment vulnerability in Cozmoslabs Profile Builder profi... |
high | 8.8 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-112312 Missing Authorization vulnerability in ACF Extended ACF Extended acf-extended al... |
high | 7.5 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-112379 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-112313 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-112820 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP... |
high | 8.1 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-112822 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
high | 8.5 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-106488 Backstage is an open framework for building developer portals. |
high | 8.1 | — | Linuxfoundation / backstage\/plugin-auth-backend-module-oidc-provider | 2026-10-06 | 2026-10-22 |
| CVE-2026-76505 A vulnerability in the IPv4 packet processing functionality of Cisco IOS XR Soft... |
high | 7.5 | — | — | 2026-10-21 | 2026-10-22 |
| CVE-2026-76524 A vulnerability in the control channel socket implementation of Open Source Snor... |
high | 7.8 | — | — | 2026-10-21 | 2026-10-22 |
| CVE-2026-76490 As part of Cisco's ongoing commitment to proactive security and product quality,... |
high | 8.6 | — | — | 2026-10-21 | 2026-10-22 |
| CVE-2026-76491 As part of Cisco's ongoing commitment to proactive security and product quality,... |
high | 7.5 | — | — | 2026-10-21 | 2026-10-22 |
| CVE-2026-76492 As part of Cisco's ongoing commitment to proactive security and product quality,... |
high | 7.5 | — | — | 2026-10-21 | 2026-10-22 |
| CVE-2026-76493 As part of Cisco's ongoing commitment to proactive security and product quality,... |
high | 7.5 | — | — | 2026-10-21 | 2026-10-22 |
| CVE-2026-20356 As part of Cisco's ongoing commitment to proactive security and product quality,... |
high | 7.5 | — | — | 2026-10-21 | 2026-10-22 |
| CVE-2026-113205 Use after free in Variations in Google Chrome prior to 156.0.8078.47 allowed a r... |
high | 8.8 | — | Google / chrome | 2026-10-20 | 2026-10-22 |
| CVE-2026-113206 Memory corruption in Omnibox in Google Chrome prior to 156.0.8078.47 allowed a r... |
high | 8.8 | — | Google / chrome | 2026-10-20 | 2026-10-22 |
| CVE-2026-113208 Use after free in ContextualSearch in Google Chrome prior to 156.0.8078.47 allow... |
high | 8.8 | — | Google / chrome | 2026-10-20 | 2026-10-22 |
| CVE-2026-113213 Memory corruption in DevTools in Google Chrome prior to 156.0.8078.47 allowed a... |
high | 8.8 | — | Google / chrome | 2026-10-20 | 2026-10-22 |
| CVE-2026-113214 Improper input validation in FullScreen in Google Chrome prior to 156.0.8078.47... |
high | 8.8 | — | Google / chrome | 2026-10-20 | 2026-10-22 |
| CVE-2026-113215 Use after free in Extensions in Google Chrome prior to 156.0.8078.47 allowed a r... |
high | 8.8 | — | Google / chrome | 2026-10-20 | 2026-10-22 |
| CVE-2026-113216 Use after free in Navigation in Google Chrome prior to 156.0.8078.47 allowed a r... |
high | 8.8 | — | Google / chrome | 2026-10-20 | 2026-10-22 |
| CVE-2026-113218 Use after free in DataTransfer in Google Chrome prior to 156.0.8078.47 allowed a... |
high | 8.8 | — | Google / chrome | 2026-10-20 | 2026-10-22 |
| CVE-2026-113219 Memory corruption in Contacts in Google Chrome prior to 156.0.8078.47 allowed a... |
high | 8.8 | — | Google / chrome | 2026-10-20 | 2026-10-22 |
| CVE-2026-113221 Use after free in Google Lens in Google Chrome prior to 156.0.8078.47 allowed a... |
high | 8.8 | — | Google / chrome | 2026-10-20 | 2026-10-22 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.