October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
24,211
Critical
3,265
High
7,853
Medium
7,531
Low
729
Severity not reported
4,833
In CISA KEV
188
Most affected vendors (by CPE data where available): microsoft (1424), google (825), linux (722), ibm (323), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (116), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-87971 The If-So Dynamic Content WordPress plugin before 1.10.2 does not validate the U... |
high | 7.1 | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-97188 The String locator WordPress plugin before 2.6.8 does not restrict the classes a... |
high | 8.8 | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-58815 In multiple locations, there is a possible out of bounds write due to an incorre... |
high | 7.8 | — | Google / android | 2026-10-05 | 2026-10-07 |
| CVE-2026-55280 In multiple locations, there is a possible out-of-bounds write due to uninitiali... |
high | 8.8 | — | Google / android | 2026-10-05 | 2026-10-07 |
| CVE-2026-65772 Deserialization of untrusted data in Microsoft Dynamics 365 allows an authorized... |
high | 8.8 | — | Microsoft / dynamics 365 | 2026-09-08 | 2026-10-07 |
| CVE-2026-55286 In stpropnci_process of stpropnci.cc, there is a possible out of bounds write du... |
high | 7.8 | — | Google / android | 2026-10-05 | 2026-10-07 |
| CVE-2026-102126 A stored cross-site scripting (XSS) weakness in Kiteworks Core could allow an ad... |
high | 8.1 | — | Accellion / kiteworks | 2026-09-30 | 2026-10-07 |
| CVE-2026-102132 An administrative import function in Kiteworks Core did not verify that the requ... |
high | 7.2 | — | Accellion / kiteworks | 2026-09-30 | 2026-10-07 |
| CVE-2026-102123 A Kiteworks appliance setup interface did not confine a user-supplied file path... |
high | 7.4 | — | Accellion / kiteworks | 2026-09-30 | 2026-10-07 |
| CVE-2026-102120 A privilege escalation vulnerability in Kiteworks could have allowed an attacker... |
high | 8.8 | — | Accellion / kiteworks | 2026-09-30 | 2026-10-07 |
| CVE-2026-102118 A local privilege escalation vulnerability in Kiteworks could have allowed an at... |
high | 7.8 | — | Accellion / kiteworks | 2026-09-30 | 2026-10-07 |
| CVE-2026-102114 A command injection vulnerability in Kiteworks could allow a high-privileged aut... |
high | 7.2 | — | Accellion / kiteworks | 2026-09-30 | 2026-10-07 |
| CVE-2026-102113 A privilege escalation vulnerability in Kiteworks could allow an attacker who ha... |
high | 7.8 | — | Accellion / kiteworks | 2026-09-30 | 2026-10-07 |
| CVE-2026-102112 A privilege escalation vulnerability in Kiteworks could allow an attacker who ha... |
high | 7.8 | — | Accellion / kiteworks | 2026-09-30 | 2026-10-07 |
| CVE-2026-102150 A function in the Kiteworks Advanced Forms component was reachable without authe... |
high | 7.2 | — | Accellion / kiteworks | 2026-09-30 | 2026-10-07 |
| CVE-2026-106238 Race condition in Fonts in Google Chrome prior to 155.0.8059.39 allowed a remote... |
high | 8.3 | — | Google / chrome | 2026-10-06 | 2026-10-07 |
| CVE-2026-106240 Type confusion in V8 in Google Chrome prior to 155.0.8059.39 allowed a remote at... |
high | 8.8 | — | Google / chrome | 2026-10-06 | 2026-10-07 |
| CVE-2026-106268 Use after free in WebRTC in Google Chrome prior to 155.0.8059.39 allowed a remot... |
high | 8.8 | — | Google / chrome | 2026-10-06 | 2026-10-07 |
| CVE-2026-106269 Use after free in CSS in Google Chrome prior to 155.0.8059.39 allowed a remote a... |
high | 8.8 | — | Google / chrome | 2026-10-06 | 2026-10-07 |
| CVE-2026-106335 Use after free in Media in Google Chrome prior to 155.0.8059.39 allowed a remote... |
high | 8.8 | — | Google / chrome | 2026-10-06 | 2026-10-07 |
| CVE-2026-106371 Incorrect authorization in Transactions Platform in Google Chrome on on Android... |
high | 8.8 | — | Google / chrome | 2026-10-06 | 2026-10-07 |
| CVE-2026-106373 Use after free in Fonts in Google Chrome on on Windows prior to 155.0.8059.39 al... |
high | 8.8 | — | Google / chrome | 2026-10-06 | 2026-10-07 |
| CVE-2026-106374 Type confusion in V8 in Google Chrome prior to 155.0.8059.39 allowed a remote at... |
high | 8.8 | — | Google / chrome | 2026-10-06 | 2026-10-07 |
| CVE-2026-106377 Race condition in Fonts in Google Chrome prior to 155.0.8059.39 allowed a remote... |
high | 8.3 | — | Google / chrome | 2026-10-06 | 2026-10-07 |
| CVE-2026-106378 Privilege elevation in Sandbox in Google Chrome on on Mac prior to 155.0.8059.39... |
high | 8.3 | — | Google / chrome | 2026-10-06 | 2026-10-07 |
| CVE-2026-106383 Use after free in Media in Google Chrome prior to 155.0.8059.39 allowed a remote... |
high | 8.8 | — | Google / chrome | 2026-10-06 | 2026-10-07 |
| CVE-2026-106278 Use after free in Select in Google Chrome prior to 155.0.8059.39 allowed a remot... |
high | 8.8 | — | Google / chrome | 2026-10-06 | 2026-10-07 |
| CVE-2026-106279 Incorrect reference resolution in Passwords in Google Chrome on on iOS prior to... |
high | 7.4 | — | Google / chrome | 2026-10-06 | 2026-10-07 |
| CVE-2026-106283 Use after free in Streaming in Google Chrome prior to 155.0.8059.39 allowed a re... |
high | 8.8 | — | Google / chrome | 2026-10-06 | 2026-10-07 |
| CVE-2026-106291 Use after free in GarbageCollection in Google Chrome prior to 155.0.8059.39 allo... |
high | 8.8 | — | Google / chrome | 2026-10-06 | 2026-10-07 |
| CVE-2026-106292 Buffer overflow in Fonts in Google Chrome prior to 155.0.8059.39 allowed a remot... |
high | 8.3 | — | Google / chrome | 2026-10-06 | 2026-10-07 |
| CVE-2026-106293 Type confusion in ANGLE in Google Chrome prior to 155.0.8059.39 allowed a remote... |
high | 8.3 | — | Google / chrome | 2026-10-06 | 2026-10-07 |
| CVE-2026-106308 Incorrect reference resolution in Autofill in Google Chrome on on Android prior... |
high | 8.8 | — | Google / chrome | 2026-10-06 | 2026-10-07 |
| CVE-2026-106309 Incorrect authorization in Selection in Google Chrome on on iOS prior to 155.0.8... |
high | 8.8 | — | Google / chrome | 2026-10-06 | 2026-10-07 |
| CVE-2026-106314 Incorrect authorization in Bluetooth in Google Chrome prior to 155.0.8059.39 all... |
high | 8.8 | — | Google / chrome | 2026-10-06 | 2026-10-07 |
| CVE-2026-106315 Use after free in Modularization in Google Chrome prior to 155.0.8059.39 allowed... |
high | 8.8 | — | Google / chrome | 2026-10-06 | 2026-10-07 |
| CVE-2026-106318 Use after free in Media in Google Chrome prior to 155.0.8059.39 allowed a remote... |
high | 8.8 | — | Google / chrome | 2026-10-06 | 2026-10-07 |
| CVE-2026-106393 Use after free in Storage in Google Chrome prior to 155.0.8059.39 allowed a remo... |
high | 8.3 | — | Google / chrome | 2026-10-06 | 2026-10-07 |
| CVE-2026-106409 Incorrect reference resolution in WebAppInstalls in Google Chrome on on Mac prio... |
high | 8.3 | — | Google / chrome | 2026-10-06 | 2026-10-07 |
| CVE-2026-106411 Use after free in Parser in Google Chrome prior to 155.0.8059.39 allowed a remot... |
high | 8.8 | — | Google / chrome | 2026-10-06 | 2026-10-07 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.