October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
24,515
Critical
3,295
High
7,936
Medium
7,624
Low
739
Severity not reported
4,921
In CISA KEV
191
Most affected vendors (by CPE data where available): microsoft (1424), google (825), linux (722), ibm (323), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (116), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-91811 A heap-based out-of-bounds write vulnerability exists in Foxit PDF Editor/Reader... |
high | 7.8 | — | Foxit / pdf editor | 2026-09-23 | 2026-10-15 |
| CVE-2026-0322 Palo Alto Networks PAN-OS Code Injection Vulnerability |
high | 7.2 | Listed | Palo Alto Networks / PAN-OS | 2026-10-14 | 2026-10-15 |
| CVE-2026-53362 Linux Kernel Unspecified Vulnerability |
high | 7.8 | Listed | Linux / Kernel | 2026-07-04 | 2026-10-15 |
| CVE-2025-46773 An Improper Neutralization of Special Elements used in an SQL Command ('SQL Inje... |
high | 8.8 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-95631 Adobe Commerce is affected by an Improper Input Validation vulnerability that co... |
high | 8.7 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-93479 A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive... |
high | 8.1 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-97205 NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_core_modul... |
high | 8.1 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-91184 Description
NGINX Gateway Fabric has a vulnerability when it renders the spec.b... |
high | 8.8 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-89288 The Fast Courier WordPress plugin before 5.2.4 does not sanitize and escape a va... |
high | 8.6 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-15176 A vulnerability exists in NGINX Plus and NGINX Open Source when a location is co... |
high | 8.1 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-39781 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-06 | 2026-10-15 |
| CVE-2026-92908 Adobe Commerce is affected by an Incorrect Authorization vulnerability that coul... |
high | 8.3 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-66877 Gitea enforces first-time fork contributor approval by blocking jobs, but some j... |
high | 8.1 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-71184 Gitea's pull request review notifier does not attach the pull request to the Act... |
high | 8.8 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-110168 Use after free in V8 in Google Chrome prior to 155.0.8059.79 allowed a remote at... |
high | 8.8 | — | Google / chrome | 2026-10-13 | 2026-10-15 |
| CVE-2026-110169 Use after free in V8 in Google Chrome prior to 155.0.8059.79 allowed a remote at... |
high | 8.8 | — | Google / chrome | 2026-10-13 | 2026-10-15 |
| CVE-2026-110171 Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote... |
high | 8.8 | — | Google / chrome | 2026-10-13 | 2026-10-15 |
| CVE-2026-110172 Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote... |
high | 8.8 | — | Google / chrome | 2026-10-13 | 2026-10-15 |
| CVE-2026-110163 Use after free in DOM in Google Chrome prior to 155.0.8059.79 allowed a remote a... |
high | 8.8 | — | Google / chrome | 2026-10-13 | 2026-10-15 |
| CVE-2026-110164 Use after free in DOM in Google Chrome prior to 155.0.8059.79 allowed a remote a... |
high | 8.8 | — | Google / chrome | 2026-10-13 | 2026-10-15 |
| CVE-2026-110166 Buffer overflow in Animation in Google Chrome prior to 155.0.8059.79 allowed a r... |
high | 8.8 | — | Google / chrome | 2026-10-13 | 2026-10-15 |
| CVE-2026-110167 Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote... |
high | 8.8 | — | Google / chrome | 2026-10-13 | 2026-10-15 |
| CVE-2026-110156 Incorrect reference resolution in Extensions in Google Chrome on on Mac prior to... |
high | 8.3 | — | Google / chrome | 2026-10-13 | 2026-10-15 |
| CVE-2026-110157 Use after free in SVG in Google Chrome prior to 155.0.8059.79 allowed a remote a... |
high | 8.8 | — | Google / chrome | 2026-10-13 | 2026-10-15 |
| CVE-2026-110162 Use after free in Desktop in Google Chrome prior to 155.0.8059.79 allowed a remo... |
high | 8.8 | — | Google / chrome | 2026-10-13 | 2026-10-15 |
| CVE-2026-110151 Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote... |
high | 8.8 | — | Google / chrome | 2026-10-13 | 2026-10-15 |
| CVE-2026-110153 Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote... |
high | 8.8 | — | Google / chrome | 2026-10-13 | 2026-10-15 |
| CVE-2026-110154 Use after free in Canvas in Google Chrome prior to 155.0.8059.79 allowed a remot... |
high | 8.8 | — | Google / chrome | 2026-10-13 | 2026-10-15 |
| CVE-2026-110155 Buffer overflow in PDFium in Google Chrome prior to 155.0.8059.79 allowed a remo... |
high | 8.8 | — | Google / chrome | 2026-10-13 | 2026-10-15 |
| CVE-2026-110145 Use after free in Passwords in Google Chrome prior to 155.0.8059.79 allowed a re... |
high | 8.3 | — | Google / chrome | 2026-10-13 | 2026-10-15 |
| CVE-2026-110147 Use after free in PDF in Google Chrome prior to 155.0.8059.79 allowed a remote a... |
high | 8.8 | — | Google / chrome | 2026-10-13 | 2026-10-15 |
| CVE-2026-110148 Use after free in SVG in Google Chrome prior to 155.0.8059.79 allowed a remote a... |
high | 8.8 | — | Google / chrome | 2026-10-13 | 2026-10-15 |
| CVE-2026-110137 Use after free in WebRTC in Google Chrome prior to 155.0.8059.79 allowed a remot... |
high | 8.8 | — | Google / chrome | 2026-10-13 | 2026-10-15 |
| CVE-2026-110138 Use after free in ShapeDetection in Google Chrome prior to 155.0.8059.79 allowed... |
high | 8.3 | — | Google / chrome | 2026-10-13 | 2026-10-15 |
| CVE-2026-110140 Type confusion in V8 in Google Chrome prior to 155.0.8059.79 allowed a remote at... |
high | 8.8 | — | Google / chrome | 2026-10-13 | 2026-10-15 |
| CVE-2026-110144 Incorrect authorization in Mojo in Google Chrome on on Windows prior to 155.0.80... |
high | 8.6 | — | Google / chrome | 2026-10-13 | 2026-10-15 |
| CVE-2026-103851 Substance3D - Stager is affected by a Stack-based Buffer Overflow vulnerability... |
high | 7.8 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-78309 SQL Injection vulnerability in DIAEnergie. |
high | 8.8 | — | — | 2026-09-24 | 2026-10-15 |
| CVE-2026-109371 ZITADEL 3.0.0 before 4.18.0 contains a missing authentication vulnerability in t... |
high | 8.2 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-109242 FreeRDP before 3.0.0 and 3.6.0 before 3.32.0 renders uninitialized heap memory f... |
high | 7.1 | — | — | 2026-10-12 | 2026-10-15 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.