October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
23,080
Critical
3,182
High
7,360
Medium
6,922
Low
714
Severity not reported
4,902
In CISA KEV
190
Most affected vendors (by CPE data where available): microsoft (1394), google (802), ibm (323), mozilla (182), oracle (157), adobe (147), linux (129), apache (116), broadcom (113), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-118579 A weakness has been identified in D-Link DIR-505 1.10B02. |
critical | 9.8 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-113399 Incorrect boundary conditions in the SVG component. |
critical | 9.8 | — | — | 2026-10-20 | 2026-10-29 |
| CVE-2026-118316 Improper input validation in V8 in Google Chrome prior to 156.0.8078.73 allowed... |
critical | 9.6 | — | Google / chrome | 2026-10-27 | 2026-10-29 |
| CVE-2026-118321 Improper input validation in Core in Google Chrome on on Android prior to 156.0.... |
critical | 9.6 | — | Google / chrome | 2026-10-27 | 2026-10-29 |
| CVE-2026-118332 Improper input validation in Compositing in Google Chrome prior to 156.0.8078.73... |
critical | 9.6 | — | Google / chrome | 2026-10-27 | 2026-10-29 |
| CVE-2026-118340 Memory corruption in Skia in Google Chrome prior to 156.0.8078.73 allowed a remo... |
critical | 9.6 | — | Google / chrome | 2026-10-27 | 2026-10-29 |
| CVE-2026-118342 Out of bounds write in Editing in Google Chrome prior to 156.0.8078.73 allowed a... |
critical | 9.6 | — | Google / chrome | 2026-10-27 | 2026-10-29 |
| CVE-2026-118355 Improper input validation in Command in Google Chrome prior to 156.0.8078.73 all... |
critical | 9.6 | — | Google / chrome | 2026-10-27 | 2026-10-29 |
| CVE-2026-109618 PHP Memory Corruption Vulnerability |
critical | 9.8 | Listed | PHP Group / PHP | 2026-10-21 | 2026-10-29 |
| CVE-2026-91218 Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (compo... |
critical | 9.6 | — | — | 2026-10-20 | 2026-10-29 |
| CVE-2026-119145 Frappe before 15.121.0 and 16.x before 16.34.0 contains a path traversal vulnera... |
critical | 9.9 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-118762 Monkeytype is a minimalistic and customizable typing test. |
critical | 9.3 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-110685 Cpanel::JSON::XS versions before 4.80 for Perl leak the decoded arguments of a t... |
critical | 9.1 | — | — | 2026-10-19 | 2026-10-29 |
| CVE-2026-44179 XWiki Remote Macros provides XWiki rendering macros that are useful when migrati... |
critical | 9.9 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-42922 A authorization bypass vulnerability exists in the /nodered functionality of FUX... |
critical | 9.8 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-54856 Unauthenticated PHP Object Injection in RexCoin |
critical | 9.8 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-54857 Unauthenticated PHP Object Injection in Quirky |
critical | 9.8 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-54860 Unauthenticated PHP Object Injection in Ozisti |
critical | 9.8 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-61991 Unauthenticated Remote Code Execution (RCE) in AjaxLoadMore Cache |
critical | 10.0 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-61992 Unauthenticated PHP Object Injection in GEO my WordPress |
critical | 9.8 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-61997 Unauthenticated PHP Object Injection in Legal Stone |
critical | 9.8 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-61998 Unauthenticated PHP Object Injection in Le Truffe |
critical | 9.8 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-62003 Unauthenticated PHP Object Injection in Mission |
critical | 9.8 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-62004 Unauthenticated PHP Object Injection in Motorix |
critical | 9.8 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-62005 Unauthenticated PHP Object Injection in Muzicon |
critical | 9.8 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-62009 Unauthenticated PHP Object Injection in Filmax |
critical | 9.8 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-62010 Unauthenticated PHP Object Injection in Avventure |
critical | 9.8 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-62011 Unauthenticated PHP Object Injection in Bonbon |
critical | 9.8 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-62014 Unauthenticated PHP Object Injection in EmojiNation |
critical | 9.8 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-62015 Unauthenticated PHP Object Injection in Gamezone |
critical | 9.8 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-62016 Unauthenticated PHP Object Injection in Gamic |
critical | 9.8 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-62131 Unauthenticated PHP Object Injection in Zoho Flow |
critical | 9.8 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-115995 A security vulnerability has been detected in Unitree Robotics Unitree Go2 up to... |
critical | 9.6 | — | — | 2026-10-24 | 2026-10-29 |
| CVE-2026-118305 Memory corruption in Turbolev in Google Chrome prior to 156.0.8078.73 allowed a... |
critical | 9.6 | — | Google / chrome | 2026-10-27 | 2026-10-29 |
| CVE-2026-118306 Memory corruption in FileSystem in Google Chrome prior to 156.0.8078.73 allowed... |
critical | 9.6 | — | Google / chrome | 2026-10-27 | 2026-10-29 |
| CVE-2026-118308 Use after free in SVG in Google Chrome prior to 156.0.8078.73 allowed a remote a... |
critical | 9.6 | — | Google / chrome | 2026-10-27 | 2026-10-29 |
| CVE-2026-118309 Improper input validation in UI in Google Chrome on on Android prior to 156.0.80... |
critical | 9.6 | — | Google / chrome | 2026-10-27 | 2026-10-29 |
| CVE-2026-118310 Improper input validation in Views in Google Chrome on on Windows prior to 156.0... |
critical | 9.6 | — | Google / chrome | 2026-10-27 | 2026-10-29 |
| CVE-2026-118312 Memory corruption in Paint in Google Chrome prior to 156.0.8078.73 allowed a rem... |
critical | 9.6 | — | Google / chrome | 2026-10-27 | 2026-10-29 |
| CVE-2026-64024 In the Linux kernel, the following vulnerability has been resolved:
tcp: fix st... |
critical | 9.4 | — | Linux / linux kernel | 2026-07-19 | 2026-10-29 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.