October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
24,087
Critical
3,247
High
7,734
Medium
7,399
Low
727
Severity not reported
4,980
In CISA KEV
190
Most affected vendors (by CPE data where available): microsoft (1401), google (814), linux (709), ibm (323), oracle (193), mozilla (182), adobe (155), apache (116), broadcom (113), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-113171 Memory corruption in Prompts in Google Chrome on on Android prior to 156.0.8078.... |
critical | 9.6 | — | Google / chrome | 2026-10-20 | 2026-10-22 |
| CVE-2026-113186 Memory corruption in DevTools in Google Chrome prior to 156.0.8078.47 allowed a... |
critical | 9.6 | — | Google / chrome | 2026-10-20 | 2026-10-22 |
| CVE-2026-113189 Use after free in Core in Google Chrome prior to 156.0.8078.47 allowed a remote... |
critical | 9.6 | — | Google / chrome | 2026-10-20 | 2026-10-22 |
| CVE-2026-113084 Improper input validation in Permissions in Google Chrome prior to 156.0.8078.47... |
critical | 9.6 | — | Google / chrome | 2026-10-20 | 2026-10-22 |
| CVE-2026-113089 Improper input validation in PrintPreview in Google Chrome prior to 156.0.8078.4... |
critical | 9.6 | — | Google / chrome | 2026-10-20 | 2026-10-22 |
| CVE-2026-113116 Use after free in DevTools in Google Chrome prior to 156.0.8078.47 allowed a rem... |
critical | 9.6 | — | Google / chrome | 2026-10-20 | 2026-10-22 |
| CVE-2026-113126 Memory corruption in PolicyContainer in Google Chrome prior to 156.0.8078.47 all... |
critical | 9.6 | — | Google / chrome | 2026-10-20 | 2026-10-22 |
| CVE-2026-113138 Memory corruption in WebAppInstalls in Google Chrome prior to 156.0.8078.47 allo... |
critical | 9.6 | — | Google / chrome | 2026-10-20 | 2026-10-22 |
| CVE-2026-113023 Improper input validation in Extensions in Google Chrome prior to 156.0.8078.47... |
critical | 9.6 | — | Google / chrome | 2026-10-20 | 2026-10-22 |
| CVE-2026-113056 Memory corruption in PerformanceAPIs in Google Chrome prior to 156.0.8078.47 all... |
critical | 9.6 | — | Google / chrome | 2026-10-20 | 2026-10-22 |
| CVE-2026-113072 Memory corruption in CSS in Google Chrome prior to 156.0.8078.47 allowed a remot... |
critical | 9.6 | — | Google / chrome | 2026-10-20 | 2026-10-22 |
| CVE-2026-113007 Memory corruption in Permissions in Google Chrome prior to 156.0.8078.47 allowed... |
critical | 9.6 | — | Google / chrome | 2026-10-20 | 2026-10-22 |
| CVE-2026-113014 Use after free in PerformanceAPIs in Google Chrome prior to 156.0.8078.47 allowe... |
critical | 9.6 | — | Google / chrome | 2026-10-20 | 2026-10-22 |
| CVE-2026-112992 Memory corruption in Canvas in Google Chrome prior to 156.0.8078.47 allowed a re... |
critical | 9.6 | — | Google / chrome | 2026-10-20 | 2026-10-22 |
| CVE-2026-101590 Vulnerability in the Helidon product of Oracle Fusion Middleware (component: hel... |
critical | 9.1 | — | — | 2026-10-20 | 2026-10-22 |
| CVE-2026-101484 Vulnerability in Oracle Secure Backup (component: Backup and Restore). |
critical | 9.8 | — | — | 2026-10-20 | 2026-10-22 |
| CVE-2026-101521 Vulnerability in Oracle APEX (component: General). |
critical | 9.8 | — | — | 2026-10-20 | 2026-10-22 |
| CVE-2026-77930 EvoScientist 0.1.0 before 0.2.5 contains an approval bypass vulnerability that a... |
critical | 9.8 | — | — | 2026-10-20 | 2026-10-22 |
| CVE-2026-113390 A flaw has been found in DrayTek Vigor2960 1.5.1.6 Revision 8218. |
critical | 9.9 | — | — | 2026-10-20 | 2026-10-22 |
| CVE-2026-112370 A vulnerability was found in H3C Magic NX15 100R017. |
critical | 9.9 | — | — | 2026-10-19 | 2026-10-22 |
| CVE-2026-109444 OpenSRE through 0.1.2026.10.19 contains an approval gate bypass vulnerability th... |
critical | 9.8 | — | — | 2026-10-20 | 2026-10-22 |
| CVE-2026-105016 Heap-based buffer overflow in Microsoft QUIC allows an unauthorized attacker to... |
critical | 9.8 | — | — | 2026-10-13 | 2026-10-22 |
| CVE-2026-73373 Joomla! |
critical | 9.8 | — | Joomla / joomla\! | 2026-08-18 | 2026-10-22 |
| CVE-2026-47606 NVIDIA Triton Inference Server for Linux contains a vulnerability where an attac... |
critical | 9.1 | — | Nvidia / triton inference server | 2026-08-18 | 2026-10-22 |
| CVE-2026-102560 A flaw was found in libsoup. |
critical | 9.8 | — | Gnome / libsoup | 2026-09-29 | 2026-10-22 |
| CVE-2024-21762 Fortinet FortiOS Out-of-Bound Write Vulnerability |
critical | 9.8 | Listed | Fortinet / FortiOS | 2024-02-09 | 2026-10-22 |
| CVE-2026-114220 NT OneAPP developed by NewType Infortech has an Improper Certificate Validation... |
critical | 9.1 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-93909 IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 is vulnera... |
critical | 9.1 | — | Ibm / websphere application server | 2026-10-13 | 2026-10-22 |
| CVE-2026-93895 IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could all... |
critical | 9.1 | — | Ibm / websphere application server | 2026-10-13 | 2026-10-22 |
| CVE-2022-51022 YiShaAdmin 2.2 through 3.1, fixed in commit 025b062, contains an unauthenticated... |
critical | 9.1 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-95695 IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could all... |
critical | 9.1 | — | Ibm / websphere application server | 2026-10-13 | 2026-10-22 |
| CVE-2026-87095 Sensitive information disclosure and manipulation due to improper authorization... |
critical | 9.1 | — | — | 2026-10-21 | 2026-10-22 |
| CVE-2026-92892 Potential arbitrary code execution under specific configurations. |
critical | 9.0 | — | — | 2026-10-13 | 2026-10-22 |
| CVE-2026-76299 As part of Cisco's ongoing commitment to proactive security and product quality,... |
critical | 9.9 | — | — | 2026-10-21 | 2026-10-22 |
| CVE-2026-76302 As part of Cisco's ongoing commitment to proactive security and product quality,... |
critical | 9.9 | — | — | 2026-10-21 | 2026-10-22 |
| CVE-2026-76531 As part of Cisco's ongoing commitment to proactive security and product quality,... |
critical | 9.9 | — | — | 2026-10-21 | 2026-10-22 |
| CVE-2026-92812 Decap CMS before 3.11.0 contains a path traversal vulnerability in the local pro... |
critical | 9.8 | — | — | 2026-09-16 | 2026-10-22 |
| CVE-2020-21012 Sourcecodester Hotel and Lodge Management System 2.0 is vulnerable to unauthenti... |
critical | 9.8 | — | Nikhil-bhalerao / hotel and lodge management system | 2021-10-01 | 2026-10-22 |
| CVE-2026-112712 @fastify/middie is the Express-style middleware engine for Fastify. |
critical | 9.1 | — | — | 2026-10-20 | 2026-10-22 |
| CVE-2026-112241 Authentication Bypass by Spoofing vulnerability in Brainstorm Force SureCart sur... |
critical | 9.8 | — | — | 2026-10-22 | 2026-10-22 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.