October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
23,090
Critical
3,183
High
7,364
Medium
6,922
Low
714
Severity not reported
4,907
In CISA KEV
190
Most affected vendors (by CPE data where available): microsoft (1394), google (802), ibm (323), mozilla (182), oracle (157), adobe (147), linux (129), apache (116), broadcom (113), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-58856 In returnOutputBufferLocked of DeprecatedCamera3StreamSplitter.cpp, there is a p... |
low | 3.3 | — | Google / android | 2026-10-05 | 2026-10-07 |
| CVE-2026-106339 Use of released resource in Core in Google Chrome prior to 155.0.8059.39 allowed... |
low | 3.1 | — | Google / chrome | 2026-10-06 | 2026-10-07 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.