October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
24,515
Critical
3,295
High
7,936
Medium
7,624
Low
739
Severity not reported
4,921
In CISA KEV
191
Most affected vendors (by CPE data where available): microsoft (1424), google (825), linux (722), ibm (323), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (116), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-87687 An authorization and input validation vulnerability exists in Brocade Fabric OS... |
high | 7.3 | — | Broadcom / fabric operating system | 2026-10-08 | 2026-10-14 |
| CVE-2025-14871 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.4.... |
high | 7.5 | — | Gitlab / gitlab | 2026-09-16 | 2026-10-14 |
| CVE-2025-59607 Memory Corruption when copying large input data exceeds normal allocation limits... |
high | 7.8 | — | Qualcomm / cologne firmware | 2026-09-17 | 2026-10-14 |
| CVE-2025-15697 The Dictionary WordPress plugin through 1.0 does not escape user input before re... |
high | 7.1 | — | — | 2026-09-17 | 2026-10-14 |
| CVE-2026-17507 In Bouncy Castle for Java before 1.86, the MLS implementation (org.bouncycastle.... |
high | 7.5 | — | Bouncycastle / bc-java | 2026-10-02 | 2026-10-14 |
| CVE-2026-100138 CAI Content Credentials is affected by an Uncontrolled Resource Consumption vuln... |
high | 7.5 | — | Adobe / c2pa | 2026-10-13 | 2026-10-14 |
| CVE-2026-100139 CAI Content Credentials is affected by an Uncontrolled Resource Consumption vuln... |
high | 7.5 | — | Adobe / c2pa | 2026-10-13 | 2026-10-14 |
| CVE-2026-105902 CAI Content Credentials is affected by an Uncontrolled Resource Consumption vuln... |
high | 7.5 | — | Adobe / c2pa | 2026-10-13 | 2026-10-14 |
| CVE-2026-106627 CAI Content Credentials is affected by an Uncontrolled Resource Consumption vuln... |
high | 7.5 | — | Adobe / c2pa | 2026-10-13 | 2026-10-14 |
| CVE-2026-103296 CAI Content Credentials is affected by an Improper Verification of Cryptographic... |
high | 7.5 | — | Adobe / c2pa | 2026-10-13 | 2026-10-14 |
| CVE-2026-106341 Type confusion in V8 in Google Chrome prior to 155.0.8059.39 allowed a remote at... |
high | 8.8 | — | Google / chrome | 2026-10-06 | 2026-10-14 |
| CVE-2026-106342 Information leak in Autofill in Google Chrome prior to 155.0.8059.39 allowed a r... |
high | 8.8 | — | Google / chrome | 2026-10-06 | 2026-10-14 |
| CVE-2026-87428 In Brocade ASCG before 3.5.0, a local unauthorized user on the ASCG VM who can i... |
high | 7.8 | — | Broadcom / brocade active support connectivity gateway | 2026-10-08 | 2026-10-14 |
| CVE-2026-102775 Joomla Extension - phoca.cz - Authorisation bypass through user-controlled key (... |
high | 7.5 | — | Phoca / phoca cart | 2026-10-05 | 2026-10-14 |
| CVE-2026-106346 Improper state validation in DevTools in Google Chrome prior to 155.0.8059.39 al... |
high | 8.8 | — | Google / chrome | 2026-10-06 | 2026-10-14 |
| CVE-2026-106347 Use after free in Track in Google Chrome prior to 155.0.8059.39 allowed a remote... |
high | 8.8 | — | Google / chrome | 2026-10-06 | 2026-10-14 |
| CVE-2026-106349 Use after free in V8 in Google Chrome prior to 155.0.8059.39 allowed a remote at... |
high | 8.8 | — | Google / chrome | 2026-10-06 | 2026-10-14 |
| CVE-2026-106350 Incorrect authorization in Browser in Google Chrome prior to 155.0.8059.39 allow... |
high | 8.8 | — | Google / chrome | 2026-10-06 | 2026-10-14 |
| CVE-2026-87424 A vulnerability in the SupportLink API authentication component of Brocade ASCG... |
high | 8.8 | — | Broadcom / brocade active support connectivity gateway | 2026-10-08 | 2026-10-14 |
| CVE-2026-85490 When Brocade ASCG before 3.5.0 processes support bundle archives ingested from r... |
high | 8.8 | — | Broadcom / brocade active support connectivity gateway | 2026-10-08 | 2026-10-14 |
| CVE-2026-85489 An authentication flaw exists in the Brocade ASCG administrative management serv... |
high | 8.8 | — | Broadcom / brocade active support connectivity gateway | 2026-10-08 | 2026-10-14 |
| CVE-2026-85488 Brocade ASCG before 3.5.0 has a well-known Brocade default password embedded in... |
high | 7.8 | — | Broadcom / brocade active support connectivity gateway | 2026-10-08 | 2026-10-14 |
| CVE-2026-106352 Incorrect authorization in WebProtect in Google Chrome prior to 155.0.8059.39 al... |
high | 8.8 | — | Google / chrome | 2026-10-06 | 2026-10-14 |
| CVE-2026-85487 A path traversal vulnerability exists in the HTTP service component of Brocade A... |
high | 8.8 | — | Broadcom / brocade active support connectivity gateway | 2026-10-08 | 2026-10-14 |
| CVE-2026-85486 Brocade ASCG before 3.5.0 improperly processes user input by evaluating form dat... |
high | 8.0 | — | Broadcom / brocade active support connectivity gateway | 2026-10-08 | 2026-10-14 |
| CVE-2026-85423 A vulnerability has been identified in the data collection service of Brocade AS... |
high | 8.8 | — | Broadcom / brocade active support connectivity gateway | 2026-10-08 | 2026-10-14 |
| CVE-2026-85422 A vulnerability in Brocade ASCG version before 3.5.0 could allow an attacker to... |
high | 7.8 | — | Broadcom / brocade active support connectivity gateway | 2026-10-08 | 2026-10-14 |
| CVE-2026-85421 A critical security vulnerability has been identified in Brocade ASCG versions b... |
high | 8.8 | — | Broadcom / brocade active support connectivity gateway | 2026-10-08 | 2026-10-14 |
| CVE-2026-106357 Use after free in WebRTC in Google Chrome prior to 155.0.8059.39 allowed a remot... |
high | 8.8 | — | Google / chrome | 2026-10-06 | 2026-10-14 |
| CVE-2026-106363 Missing authorization in FullScreen in Google Chrome prior to 155.0.8059.39 allo... |
high | 8.3 | — | Google / chrome | 2026-10-06 | 2026-10-14 |
| CVE-2026-62906 Improper neutralization of special elements in data query logic in Microsoft Dis... |
high | 7.4 | — | Microsoft / discovery studio | 2026-09-03 | 2026-10-14 |
| CVE-2026-106367 Missing authorization in Mobile in Google Chrome on on Android prior to 155.0.80... |
high | 8.4 | — | Google / chrome | 2026-10-06 | 2026-10-14 |
| CVE-2026-86361 Dell System Update, versions prior to 2.3.0.0, contains an Incorrect Permission... |
high | 8.2 | — | Dell / system update | 2026-10-06 | 2026-10-14 |
| CVE-2026-86362 Dell System Update, versions prior to 2.3.0.0, contains an Improper Access Contr... |
high | 8.2 | — | Dell / system update | 2026-10-06 | 2026-10-14 |
| CVE-2022-2586 Linux Kernel Use-After-Free Vulnerability |
high | 7.8 | Listed | Linux / Kernel | 2024-01-08 | 2026-10-14 |
| CVE-2026-52296 FFmpeg before 9.0 has an out-of-bounds read because of missing required padding... |
high | 7.1 | — | Ffmpeg / ffmpeg | 2026-09-13 | 2026-10-14 |
| CVE-2026-96661 The Gmedia Photo Gallery plugin for WordPress is vulnerable to time-based SQL In... |
high | 7.5 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-94377 The Verified Reviews (Avis Vérifiés) plugin for WordPress is vulnerable to Store... |
high | 7.2 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-92817 The Ignition Perspective module does not properly validate session privileges wh... |
high | 8.8 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-91156 Discourse is an open-source discussion platform. |
high | 7.5 | — | — | 2026-10-14 | 2026-10-14 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.