October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 29, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
22,229
Critical
3,102
High
7,094
Medium
6,630
Low
674
Severity not reported
4,729
In CISA KEV
188
Most affected vendors (by CPE data where available): microsoft (1176), google (780), ibm (323), mozilla (182), oracle (154), adobe (137), linux (126), apache (116), broadcom (113), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-92066 Sandbox escape in the Profile Backup component. |
critical | 9.8 | — | Mozilla / firefox | 2026-09-15 | 2026-10-05 |
| CVE-2026-92048 Sandbox escape due to incorrect boundary conditions in the Widget: Win32 compone... |
critical | 9.0 | — | Mozilla / firefox | 2026-09-15 | 2026-10-05 |
| CVE-2026-92050 Sandbox escape due to race condition in the XPConnect component. |
critical | 9.1 | — | Mozilla / firefox | 2026-09-15 | 2026-10-05 |
| CVE-2026-92051 Spoofing issue due to invalid pointer in the Graphics component. |
critical | 9.1 | — | Mozilla / firefox | 2026-09-15 | 2026-10-05 |
| CVE-2026-92032 Sandbox escape due to invalid pointer in the Graphics component. |
critical | 9.6 | — | Mozilla / firefox | 2026-09-15 | 2026-10-05 |
| CVE-2026-92034 Site isolation issue in the Graphics component. |
critical | 9.1 | — | Mozilla / firefox | 2026-09-15 | 2026-10-05 |
| CVE-2026-92035 Sandbox escape due to incorrect boundary conditions in the Graphics component. |
critical | 9.6 | — | Mozilla / firefox | 2026-09-15 | 2026-10-05 |
| CVE-2026-92036 Incorrect boundary conditions in the Networking: HTTP component. |
critical | 9.8 | — | Mozilla / firefox | 2026-09-15 | 2026-10-05 |
| CVE-2026-92037 Incorrect boundary conditions in the DOM: Animation component. |
critical | 9.8 | — | Mozilla / firefox | 2026-09-15 | 2026-10-05 |
| CVE-2026-92038 Mitigation bypass in the Remote Settings Client component. |
critical | 9.1 | — | Mozilla / firefox | 2026-09-15 | 2026-10-05 |
| CVE-2026-92041 Mitigation bypass in the DOM: Networking component. |
critical | 9.1 | — | Mozilla / firefox | 2026-09-15 | 2026-10-05 |
| CVE-2026-92045 Sandbox escape due to incorrect boundary conditions in the WebRTC component. |
critical | 9.6 | — | Mozilla / firefox | 2026-09-15 | 2026-10-05 |
| CVE-2026-100810 Other issue in the DevTools component. |
critical | 9.8 | — | Mozilla / firefox | 2026-09-29 | 2026-10-05 |
| CVE-2026-100811 Sandbox escape due to use-after-free in the DOM: Core & HTML component. |
critical | 9.6 | — | Mozilla / firefox | 2026-09-29 | 2026-10-05 |
| CVE-2026-100818 Sandbox escape due to use-after-free in the Widget: Gtk component. |
critical | 9.6 | — | Mozilla / firefox | 2026-09-29 | 2026-10-05 |
| CVE-2026-100778 Sandbox escape due to use-after-free in the DOM: Core & HTML component. |
critical | 9.6 | — | Mozilla / firefox | 2026-09-29 | 2026-10-05 |
| CVE-2025-1009 An attacker could have caused a use-after-free via crafted XSLT data, leading to... |
critical | 9.8 | — | Mozilla / firefox | 2025-02-04 | 2026-10-05 |
| CVE-2025-1016 Memory safety bugs present in Firefox 134, Thunderbird 134, Firefox ESR 115.19,... |
critical | 9.8 | — | Mozilla / firefox | 2025-02-04 | 2026-10-05 |
| CVE-2025-1017 Memory safety bugs present in Firefox 134, Thunderbird 134, Firefox ESR 128.6, a... |
critical | 9.8 | — | Mozilla / firefox | 2025-02-04 | 2026-10-05 |
| CVE-2025-1020 Memory safety bugs present in Firefox 134 and Thunderbird 134. |
critical | 9.8 | — | Mozilla / firefox | 2025-02-04 | 2026-10-05 |
| CVE-2026-100781 Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender c... |
critical | 9.6 | — | Mozilla / firefox | 2026-09-29 | 2026-10-05 |
| CVE-2026-100819 Sandbox escape due to incorrect boundary conditions in the XPCOM component. |
critical | 9.6 | — | Mozilla / firefox | 2026-09-29 | 2026-10-05 |
| CVE-2026-100786 Sandbox escape due to use-after-free in the Graphics component. |
critical | 9.6 | — | Mozilla / firefox | 2026-09-29 | 2026-10-05 |
| CVE-2026-100787 Sandbox escape in the XUL component. |
critical | 9.6 | — | Mozilla / firefox | 2026-09-29 | 2026-10-05 |
| CVE-2026-74969 Race condition, use-after-free in the Layout: Text and Fonts component. |
high | 8.8 | — | Mozilla / firefox | 2026-08-18 | 2026-10-28 |
| CVE-2026-74949 Use-after-free in the Graphics: Canvas2D component. |
high | 8.8 | — | Mozilla / firefox | 2026-08-18 | 2026-10-28 |
| CVE-2026-74946 Information disclosure due to incorrect boundary conditions in the Graphics: Can... |
high | 8.8 | — | Mozilla / firefox | 2026-08-18 | 2026-10-28 |
| CVE-2026-100801 Privilege escalation in the DLL Services component. |
high | 8.8 | — | Mozilla / firefox | 2026-09-29 | 2026-10-27 |
| CVE-2026-100798 Cryptography misuse in Storage: Quota Manager component. |
high | 8.1 | — | Mozilla / firefox | 2026-09-29 | 2026-10-19 |
| CVE-2026-100803 Same-origin policy bypass in the WebExtensions component. |
high | 8.1 | — | Mozilla / firefox | 2026-09-29 | 2026-10-19 |
| CVE-2026-100805 Race condition, use-after-free in the Audio/Video component. |
high | 7.5 | — | Mozilla / firefox | 2026-09-29 | 2026-10-19 |
| CVE-2026-100807 Privilege escalation in the DOM: Service Workers component. |
high | 8.8 | — | Mozilla / firefox | 2026-09-29 | 2026-10-19 |
| CVE-2026-100789 Use-after-free in the Graphics: Canvas2D component. |
high | 8.8 | — | Mozilla / firefox | 2026-09-29 | 2026-10-19 |
| CVE-2026-100790 Use-after-free in the XSLT component. |
high | 8.8 | — | Mozilla / firefox | 2026-09-29 | 2026-10-19 |
| CVE-2026-100791 Use-after-free in the DOM: Core & HTML component. |
high | 8.8 | — | Mozilla / firefox | 2026-09-29 | 2026-10-19 |
| CVE-2026-100792 JIT miscompilation in the JavaScript: WebAssembly component. |
high | 7.1 | — | Mozilla / firefox | 2026-09-29 | 2026-10-19 |
| CVE-2026-100796 Use-after-free in the JavaScript: WebAssembly component. |
high | 8.8 | — | Mozilla / firefox | 2026-09-29 | 2026-10-19 |
| CVE-2026-100797 Privilege escalation due to use-after-free in the Graphics: WebRender component. |
high | 8.8 | — | Mozilla / firefox | 2026-09-29 | 2026-10-19 |
| CVE-2026-100757 Use-after-free in the Widget component. |
high | 8.8 | — | Mozilla / firefox | 2026-09-29 | 2026-10-13 |
| CVE-2026-100759 Uninitialized memory in the Storage: Quota Manager component. |
high | 8.1 | — | Mozilla / firefox | 2026-09-29 | 2026-10-13 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.