October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
22,618
Critical
3,170
High
7,236
Medium
7,074
Low
640
Severity not reported
4,498
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (722), google (413), ibm (322), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-109765 Race condition, use-after-free in the Graphics: Text component. |
medium | 4.2 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-109767 Information disclosure in the Networking component. |
medium | 4.3 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-109749 Use-after-free in the JavaScript: WebAssembly component. |
medium | 5.4 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-109751 Information disclosure in the Networking component. |
medium | 4.3 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-109752 Use-after-free in the DOM: Workers component. |
medium | 5.4 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-109741 Use-after-free in the Storage: Bucket File System component. |
medium | 5.4 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-109742 Information disclosure in the PDF Viewer component. |
medium | 4.3 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-109748 Use-after-free in the JavaScript: WebAssembly component. |
medium | 5.4 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-109732 Use-after-free in the DOM: Streams component. |
medium | 5.4 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-109735 Use-after-free in the DOM: Animation component. |
medium | 5.4 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-109738 Use-after-free in the Audio/Video: Playback component. |
medium | 5.4 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-109724 Use-after-free in the DOM: Core & HTML component. |
medium | 5.4 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-109725 Use-after-free in the DOM: Core & HTML component. |
medium | 5.4 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-109726 Use-after-free in the SVG component. |
medium | 5.4 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-109727 Use-after-free in the Audio/Video component. |
medium | 5.4 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-109728 Use-after-free in the DOM: Animation component. |
medium | 5.4 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-109729 Use-after-free in the JavaScript Engine: JIT component. |
medium | 5.4 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-109717 Use-after-free in the DOM: Bindings (WebIDL) component. |
medium | 5.4 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-109718 Use-after-free in the XML component. |
medium | 5.4 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-109719 Race condition, use-after-free in the Graphics: CanvasWebGL component. |
medium | 4.2 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-109710 Use-after-free in the Graphics: Text component. |
medium | 5.4 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-109711 Use-after-free in the Graphics: Canvas2D component. |
medium | 5.4 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-109713 Use-after-free in the Crash Reporting component. |
medium | 5.4 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-109706 Use-after-free in the Storage: IndexedDB component. |
medium | 5.4 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-109392 Pimcore through 2026.3.1 contains a stored cross-site scripting vulnerability th... |
medium | 5.4 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-109315 Grav from 2.0.22 before 2.1.7 contains an information disclosure vulnerability t... |
medium | 6.5 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-109330 Network-AI 5.0.0 before 5.15.2 contains a cross-site WebSocket hijacking vulnera... |
medium | 4.3 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-109335 SurrealDB from 3.0.0 before 3.3.0 contains an information disclosure vulnerabili... |
medium | 6.5 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-109310 SiYuan v3.1.12 before v3.8.6 fails to restrict the Sprig template function map i... |
medium | 6.5 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-109180 jshERP through 3.6 contains an authorization bypass vulnerability that allows au... |
medium | 4.3 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-109168 lamp-cloud through 5.10.1 contains an insecure direct object reference vulnerabi... |
medium | 6.5 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-108897 A security vulnerability has been detected in Smart Media4U Technology SHAREit A... |
medium | 5.3 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-108813 A vulnerability was detected in SEMCMS up to 5.0. |
medium | 6.3 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-108821 A security vulnerability has been detected in Tencent WeKnora up to 0.8.1. |
medium | 6.3 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-108830 A weakness has been identified in meetecho janus-gateway up to 1.4.2. |
medium | 4.2 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-108801 A security flaw has been discovered in prasathmani TinyFileManager up to 2.6. |
medium | 6.3 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-106425 Missing authorization in BrowserTag in Google Chrome prior to 155.0.8059.39 allo... |
medium | 4.2 | — | Google / chrome | 2026-10-06 | 2026-10-13 |
| CVE-2026-70414 Dell Command | Configure (DCC), versions prior to 5.2.3.35, contain a Plaintext... |
medium | 5.5 | — | Dell / command\|configure | 2026-10-06 | 2026-10-13 |
| CVE-2026-102404 Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial... |
medium | 6.5 | — | Elastic / elasticsearch | 2026-10-06 | 2026-10-13 |
| CVE-2026-102407 Incorrect Authorization (CWE-863) in Elasticsearch can lead to unauthorized data... |
medium | 5.4 | — | Elastic / elasticsearch | 2026-10-06 | 2026-10-13 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.