October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
24,211
Critical
3,265
High
7,853
Medium
7,531
Low
729
Severity not reported
4,833
In CISA KEV
188
Most affected vendors (by CPE data where available): microsoft (1424), google (825), linux (722), ibm (323), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (116), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-106247 Buffer overflow in ANGLE in Google Chrome prior to 155.0.8059.39 allowed a remot... |
high | 8.3 | — | Google / chrome | 2026-10-06 | 2026-10-07 |
| CVE-2026-106248 Use after free in Bindings in Google Chrome prior to 155.0.8059.39 allowed a rem... |
high | 8.8 | — | Google / chrome | 2026-10-06 | 2026-10-07 |
| CVE-2026-106249 Incorrect authorization in Autofill in Google Chrome on on Android prior to 155.... |
high | 8.8 | — | Google / chrome | 2026-10-06 | 2026-10-07 |
| CVE-2026-106412 Race condition in Core in Google Chrome on on Mac prior to 155.0.8059.39 allowed... |
high | 8.3 | — | Google / chrome | 2026-10-06 | 2026-10-07 |
| CVE-2026-106423 Use after free in Media in Google Chrome prior to 155.0.8059.39 allowed a remote... |
high | 8.8 | — | Google / chrome | 2026-10-06 | 2026-10-07 |
| CVE-2026-106426 Race condition in Fonts in Google Chrome prior to 155.0.8059.39 allowed a remote... |
high | 8.3 | — | Google / chrome | 2026-10-06 | 2026-10-07 |
| CVE-2026-101152 Insufficient validation in the Single Sign-On (SSO) login flow could allow a rem... |
high | 8.0 | — | — | 2026-10-06 | 2026-10-07 |
| CVE-2026-101153 On affected versions of CloudVision Portal (on-premises) or CloudVision Sensor,... |
high | 8.0 | — | — | 2026-10-06 | 2026-10-07 |
| CVE-2026-101156 A stored cross-site scripting (XSS) vulnerability may allow an authenticated, hi... |
high | 8.4 | — | — | 2026-10-06 | 2026-10-07 |
| CVE-2026-101157 A stored cross-site scripting (XSS) vulnerability may allow an unauthenticated a... |
high | 8.7 | — | — | 2026-10-06 | 2026-10-07 |
| CVE-2026-101158 A missing input validation vulnerability in the Fileserver upload API allows an... |
high | 8.4 | — | — | 2026-10-06 | 2026-10-07 |
| CVE-2026-102155 An XML External Entity (XXE) injection vulnerability in the WiFi-server Spectral... |
high | 8.5 | — | — | 2026-10-06 | 2026-10-07 |
| CVE-2026-102160 An operating system (OS) command injection vulnerability in CloudVision CUE back... |
high | 7.2 | — | — | 2026-10-06 | 2026-10-07 |
| CVE-2026-102161 An unauthenticated attacker located on an adjacent private network (or any attac... |
high | 8.8 | — | — | 2026-10-06 | 2026-10-07 |
| CVE-2026-102162 On affected Arista Wi-Fi access points with captive portal, or application firew... |
high | 8.8 | — | — | 2026-10-06 | 2026-10-07 |
| CVE-2026-102163 On affected Arista access points with Wireless Intrusion Prevention System (WIPS... |
high | 8.8 | — | — | 2026-10-06 | 2026-10-07 |
| CVE-2026-102165 On affected Arista Wi-Fi access points, an unauthenticated attacker with network... |
high | 7.5 | — | — | 2026-10-06 | 2026-10-07 |
| CVE-2026-102167 On affected Arista Wi-Fi access points, a memory corruption vulnerability exists... |
high | 7.5 | — | — | 2026-10-06 | 2026-10-07 |
| CVE-2026-102101 Kiteworks Core before version 9.5.0 is vulnerable to Deserialization of Untruste... |
high | 8.1 | — | Accellion / kiteworks | 2026-09-30 | 2026-10-07 |
| CVE-2026-42720 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
high | 7.6 | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-42721 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
high | 7.6 | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-102099 Kiteworks Core before version 9.5.0 is vulnerable to Arbitrary File Write. |
high | 7.2 | — | Accellion / kiteworks | 2026-09-30 | 2026-10-07 |
| CVE-2026-102098 Kiteworks Core before version 9.5.0 is vulnerable to SQL Injection. |
high | 7.2 | — | Accellion / kiteworks | 2026-09-30 | 2026-10-07 |
| CVE-2026-102096 Kiteworks Core before version 9.5.0 is vulnerable to OS Command Injection that a... |
high | 7.2 | — | Accellion / kiteworks | 2026-09-30 | 2026-10-07 |
| CVE-2026-102093 Kiteworks Core before version 9.5.0 is vulnerable to Improper Privilege Manageme... |
high | 7.2 | — | Accellion / kiteworks | 2026-09-30 | 2026-10-07 |
| CVE-2026-102092 Kiteworks Core before version 9.5.0 is vulnerable to Stored Cross-site Scripting... |
high | 8.7 | — | Accellion / kiteworks | 2026-09-30 | 2026-10-07 |
| CVE-2026-49933 In handle_le_monitor_device_event of msft.cc, there is a possible control-flow h... |
high | 7.8 | — | Google / android | 2026-10-05 | 2026-10-07 |
| CVE-2026-106255 Race condition in V8 in Google Chrome prior to 155.0.8059.39 allowed a remote at... |
high | 8.8 | — | Google / chrome | 2026-10-06 | 2026-10-07 |
| CVE-2026-106256 Information leak in Passwords in Google Chrome on on Android prior to 155.0.8059... |
high | 8.8 | — | Google / chrome | 2026-10-06 | 2026-10-07 |
| CVE-2026-106252 Incorrect comparison in Fonts in Google Chrome prior to 155.0.8059.39 allowed a... |
high | 8.8 | — | Google / chrome | 2026-10-06 | 2026-10-07 |
| CVE-2026-106257 Use after free in HTML in Google Chrome prior to 155.0.8059.39 allowed a remote... |
high | 8.8 | — | Google / chrome | 2026-10-06 | 2026-10-07 |
| CVE-2026-106421 Use after free in PDF in Google Chrome prior to 155.0.8059.39 allowed a remote a... |
high | 8.8 | — | Google / chrome | 2026-10-06 | 2026-10-07 |
| CVE-2026-28625 In multiple locations, there is a possible permission bypass due to a logic erro... |
high | 7.8 | — | Google / android | 2026-10-05 | 2026-10-07 |
| CVE-2026-28640 In checkCallerIsCertInstallerOrSelfInProfile of CredentialStorageActivity.java,... |
high | 7.8 | — | Google / android | 2026-10-05 | 2026-10-07 |
| CVE-2026-28641 In shouldDisableUninstallButton of ApplicationActionButtonsPreferenceController.... |
high | 7.8 | — | Google / android | 2026-10-05 | 2026-10-07 |
| CVE-2026-28647 In updateState of DeviceAdminAppsPreferenceController.java, there is a possible... |
high | 7.8 | — | Google / android | 2026-10-05 | 2026-10-07 |
| CVE-2026-28648 In Settings, there is a possible permission bypass due to a confused deputy. |
high | 7.8 | — | Google / android | 2026-10-05 | 2026-10-07 |
| CVE-2026-45524 In isSystem of WifiPermissionsUtil.java, there is a possible sandbox escape due... |
high | 8.8 | — | Google / android | 2026-10-05 | 2026-10-07 |
| CVE-2026-49878 In wpas_handle_robust_av_scs_recv_action of robust_av.c, there is a possible out... |
high | 7.2 | — | Google / android | 2026-10-05 | 2026-10-07 |
| CVE-2026-18176 IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remot... |
high | 7.4 | — | Ibm / financial transaction manager | 2026-09-22 | 2026-10-07 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.