October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
24,591
Critical
3,297
High
7,976
Medium
7,646
Low
740
Severity not reported
4,932
In CISA KEV
191
Most affected vendors (by CPE data where available): microsoft (1424), google (825), linux (722), ibm (323), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (116), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-113282 Use after free in Views in Google Chrome on on Mac prior to 156.0.8078.47 allowe... |
high | 8.8 | — | Google / chrome | 2026-10-20 | 2026-10-22 |
| CVE-2026-113285 Memory corruption in ANGLE in Google Chrome on on Windows prior to 156.0.8078.47... |
high | 8.8 | — | Google / chrome | 2026-10-20 | 2026-10-22 |
| CVE-2026-113253 Use after free in Canvas in Google Chrome prior to 156.0.8078.47 allowed a remot... |
high | 8.8 | — | Google / chrome | 2026-10-20 | 2026-10-22 |
| CVE-2026-113254 Memory corruption in DevTools in Google Chrome prior to 156.0.8078.47 allowed a... |
high | 8.8 | — | Google / chrome | 2026-10-20 | 2026-10-22 |
| CVE-2026-113255 Use after free in CustomTabs in Google Chrome on on Android prior to 156.0.8078.... |
high | 8.8 | — | Google / chrome | 2026-10-20 | 2026-10-22 |
| CVE-2026-113256 Use after free in Permissions in Google Chrome prior to 156.0.8078.47 allowed a... |
high | 8.8 | — | Google / chrome | 2026-10-20 | 2026-10-22 |
| CVE-2026-113257 Memory corruption in Media in Google Chrome prior to 156.0.8078.47 allowed a rem... |
high | 8.8 | — | Google / chrome | 2026-10-20 | 2026-10-22 |
| CVE-2026-113334 Improper input validation in ANGLE in Google Chrome on on Windows prior to 156.0... |
high | 8.8 | — | Google / chrome | 2026-10-20 | 2026-10-22 |
| CVE-2026-113330 Memory corruption in CustomTabs in Google Chrome on on Android prior to 156.0.80... |
high | 8.8 | — | Google / chrome | 2026-10-20 | 2026-10-22 |
| CVE-2026-113323 Use after free in Chrome for iOS in Google Chrome on on iOS prior to 156.0.8078.... |
high | 8.8 | — | Google / chrome | 2026-10-20 | 2026-10-22 |
| CVE-2026-113320 Memory corruption in Navigation in Google Chrome on on iOS prior to 156.0.8078.4... |
high | 8.8 | — | Google / chrome | 2026-10-20 | 2026-10-22 |
| CVE-2026-113317 Memory corruption in Accessibility in Google Chrome on on Mac prior to 156.0.807... |
high | 8.8 | — | Google / chrome | 2026-10-20 | 2026-10-22 |
| CVE-2026-113312 Memory corruption in Autofill in Google Chrome on on Mac prior to 156.0.8078.47... |
high | 8.8 | — | Google / chrome | 2026-10-20 | 2026-10-22 |
| CVE-2026-113293 Use after free in ANGLE in Google Chrome on on Windows prior to 156.0.8078.47 al... |
high | 8.8 | — | Google / chrome | 2026-10-20 | 2026-10-22 |
| CVE-2026-113292 Improper input validation in Omnibox in Google Chrome on on Android prior to 156... |
high | 8.8 | — | Google / chrome | 2026-10-20 | 2026-10-22 |
| CVE-2026-111851 Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection... |
high | 7.6 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-112304 docTR through 1.1.0 contains an unsafe deserialization vulnerability in load_pre... |
high | 7.5 | — | — | 2026-10-19 | 2026-10-22 |
| CVE-2026-112309 @rvf/set-get before 7.0.4 contains a prototype pollution vulnerability in setPat... |
high | 7.5 | — | — | 2026-10-19 | 2026-10-22 |
| CVE-2026-113405 BA-Workflow developed by YS-infoware has a SQL Injection vulnerability. |
high | 8.8 | — | — | 2026-10-20 | 2026-10-22 |
| CVE-2026-113406 BA-Workflow developed by YS-infoware has a SQL Injection vulnerability. |
high | 8.8 | — | — | 2026-10-20 | 2026-10-22 |
| CVE-2026-112145 A security vulnerability has been detected in speaches-ai speaches up to 0.9.0-r... |
high | 7.3 | — | — | 2026-10-19 | 2026-10-22 |
| CVE-2026-112263 Television (tv) 0.15.0 through 0.15.9 contains an OS command injection vulnerabi... |
high | 7.8 | — | — | 2026-10-19 | 2026-10-22 |
| CVE-2026-112150 A security flaw has been discovered in vraj404 Criminal-Management-System up to... |
high | 7.3 | — | — | 2026-10-19 | 2026-10-22 |
| CVE-2026-112104 A flaw has been found in eremef bandcamp-player up to 1.8.33-beta. |
high | 7.3 | — | — | 2026-10-19 | 2026-10-22 |
| CVE-2026-112141 A vulnerability was determined in satya-vinay Events-Management-System up to 437... |
high | 7.3 | — | — | 2026-10-19 | 2026-10-22 |
| CVE-2026-112000 Vanus 0.8.0 through 0.9.0 contains a missing authorization vulnerability in the... |
high | 7.6 | — | — | 2026-10-18 | 2026-10-22 |
| CVE-2026-112005 WhoDB 0.104.0 before 0.135.0 contains a path traversal vulnerability that allows... |
high | 7.7 | — | — | 2026-10-18 | 2026-10-22 |
| CVE-2026-111873 A vulnerability was detected in itsmeravitejak Online-Examination-System up to e... |
high | 7.3 | — | — | 2026-10-18 | 2026-10-22 |
| CVE-2026-114664 Frappe Framework before 16.33.0 contains a blind SQL injection vulnerability in... |
high | 7.1 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-59970 Tandoor Recipes is an application for managing recipes, planning meals, and buil... |
high | 7.7 | — | — | 2026-10-16 | 2026-10-21 |
| CVE-2026-111927 Coder before 2.29.20, 2.33.0 before 2.33.12, 2.34.0 before 2.34.8, and 2.35.0 be... |
high | 7.7 | — | — | 2026-10-17 | 2026-10-21 |
| CVE-2026-111855 An issue was discovered on Tektronix 3 Series MDO devices before 1.21.1. |
high | 7.5 | — | — | 2026-10-17 | 2026-10-21 |
| CVE-2026-81665 A heap-based buffer overflow was found in Corosync's Totem Process Group (totemp... |
high | 7.5 | — | — | 2026-09-04 | 2026-10-21 |
| CVE-2026-112258 A flaw was found in GIMP. |
high | 7.8 | — | — | 2026-10-19 | 2026-10-21 |
| CVE-2026-111684 Magistrala through 1.0.0 contains an authorization bypass vulnerability that all... |
high | 8.3 | — | — | 2026-10-16 | 2026-10-21 |
| CVE-2026-111634 Helical Insight through 7.0.0 contains an sql injection vulnerability that allow... |
high | 8.1 | — | — | 2026-10-16 | 2026-10-21 |
| CVE-2026-111639 bbs-go through 4.4.6 contains an authentication bypass vulnerability in the /api... |
high | 8.1 | — | — | 2026-10-16 | 2026-10-21 |
| CVE-2026-111644 Misaka Danmu Server through 2.8.9 contains a missing authentication vulnerabilit... |
high | 7.3 | — | — | 2026-10-16 | 2026-10-21 |
| CVE-2026-105311 The StreamsHub Console operator acts as a confused deputy: a Kubernetes tenant w... |
high | 7.7 | — | — | 2026-10-20 | 2026-10-21 |
| CVE-2026-101683 Vulnerability in the Applications DBA product of Oracle E-Business Suite (compon... |
high | 7.0 | — | — | 2026-10-20 | 2026-10-21 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.