October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
21,899
Critical
3,119
High
7,046
Medium
6,890
Low
606
Severity not reported
4,238
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (722), google (413), ibm (321), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-106391 Incorrect authorization in WebShare in Google Chrome on on Android prior to 155.... |
medium | 4.2 | — | Google / chrome | 2026-10-06 | 2026-10-07 |
| CVE-2026-106392 Information leak in WebAudio in Google Chrome prior to 155.0.8059.39 allowed a r... |
medium | 4.3 | — | Google / chrome | 2026-10-06 | 2026-10-07 |
| CVE-2026-106394 Incomplete cleanup in Glic in Google Chrome prior to 155.0.8059.39 allowed a rem... |
medium | 4.3 | — | Google / chrome | 2026-10-06 | 2026-10-07 |
| CVE-2026-106398 Incorrect authorization in Media in Google Chrome prior to 155.0.8059.39 allowed... |
medium | 4.3 | — | Google / chrome | 2026-10-06 | 2026-10-07 |
| CVE-2026-106245 Uninitialized resource in ANGLE in Google Chrome prior to 155.0.8059.39 allowed... |
medium | 4.3 | — | Google / chrome | 2026-10-06 | 2026-10-07 |
| CVE-2026-106400 Clickjacking in Messages in Google Chrome on on Android prior to 155.0.8059.39 a... |
medium | 5.4 | — | Google / chrome | 2026-10-06 | 2026-10-07 |
| CVE-2026-106402 Incorrect authorization in Extensions in Google Chrome prior to 155.0.8059.39 al... |
medium | 4.8 | — | Google / chrome | 2026-10-06 | 2026-10-07 |
| CVE-2026-106406 Missing authorization in Mobile in Google Chrome on on iOS prior to 155.0.8059.3... |
medium | 5.4 | — | Google / chrome | 2026-10-06 | 2026-10-07 |
| CVE-2026-106410 Missing authorization in Permissions in Google Chrome prior to 155.0.8059.39 all... |
medium | 4.2 | — | Google / chrome | 2026-10-06 | 2026-10-07 |
| CVE-2026-106246 Incorrect authorization in Browser in Google Chrome prior to 155.0.8059.39 allow... |
medium | 5.4 | — | Google / chrome | 2026-10-06 | 2026-10-07 |
| CVE-2026-106328 Incorrect authorization in PDF in Google Chrome on on Android prior to 155.0.805... |
medium | 5.9 | — | Google / chrome | 2026-10-06 | 2026-10-07 |
| CVE-2026-106337 UI misrepresentation in UI in Google Chrome on on Android prior to 155.0.8059.39... |
medium | 5.4 | — | Google / chrome | 2026-10-06 | 2026-10-07 |
| CVE-2026-101149 Insufficient validation of OIDC SSO provider configuration could allow a user wi... |
medium | 4.1 | — | — | 2026-10-06 | 2026-10-07 |
| CVE-2026-101150 Insufficient validation of OIDC bearer token configuration could allow a user wi... |
medium | 4.1 | — | — | 2026-10-06 | 2026-10-07 |
| CVE-2026-101151 Insufficient validation of request in login flow could allow a remote, unauthent... |
medium | 4.3 | — | — | 2026-10-06 | 2026-10-07 |
| CVE-2026-102156 Improper neutralization of Lightweight Directory Access Protocol (LDAP) authenti... |
medium | 6.8 | — | — | 2026-10-06 | 2026-10-07 |
| CVE-2026-102157 An insecure direct object reference (IDOR) vulnerability in a CloudVision CUE fi... |
medium | 5.9 | — | — | 2026-10-06 | 2026-10-07 |
| CVE-2026-102158 Improper validation of selected CloudVision CUE application programming interfac... |
medium | 6.5 | — | — | 2026-10-06 | 2026-10-07 |
| CVE-2026-102168 On affected Arista Wi-Fi access points with Captive Portal enabled, an unauthent... |
medium | 6.5 | — | — | 2026-10-06 | 2026-10-07 |
| CVE-2026-102169 On affected Arista Wi-Fi access points with Captive Portal enabled, an unauthent... |
medium | 6.5 | — | — | 2026-10-06 | 2026-10-07 |
| CVE-2026-106338 UI misrepresentation in PictureInPicture in Google Chrome on on Android prior to... |
medium | 5.4 | — | Google / chrome | 2026-10-06 | 2026-10-07 |
| CVE-2026-106321 Information leak in Editing in Google Chrome prior to 155.0.8059.39 allowed a re... |
medium | 4.3 | — | Google / chrome | 2026-10-06 | 2026-10-07 |
| CVE-2026-106320 Use of released resource in UI in Google Chrome prior to 155.0.8059.39 allowed a... |
medium | 4.2 | — | Google / chrome | 2026-10-06 | 2026-10-07 |
| CVE-2026-106325 Incorrect reference resolution in Core in Google Chrome prior to 155.0.8059.39 a... |
medium | 4.3 | — | Google / chrome | 2026-10-06 | 2026-10-07 |
| CVE-2026-105111 Improper neutralization of input during web page generation ('cross-site scripti... |
medium | 4.7 | — | — | 2026-10-06 | 2026-10-07 |
| CVE-2026-103075 Missing Authorization vulnerability in WPMU DEV Hustle wordpress-popup allows Ex... |
medium | 4.3 | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-104390 Missing Authorization vulnerability in Arraytics Booktics booktics allows Exploi... |
medium | 4.3 | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-104391 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-104393 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-105871 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-105873 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-105875 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-105876 Missing Authorization vulnerability in WP Chill Modula Image Gallery modula-best... |
medium | 5.3 | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-105884 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-27434 Missing Authorization vulnerability in sc Internet Vivoo WP Rentals wprentals al... |
medium | 5.3 | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-97294 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-77121 A user account with permission to deploy artifacts to a hosted Maven repository... |
medium | 6.5 | — | Sonatype / nexus repository manager | 2026-09-02 | 2026-10-07 |
| CVE-2026-106254 Information leak in Mobile in Google Chrome on on Android prior to 155.0.8059.39... |
medium | 5.1 | — | Google / chrome | 2026-10-06 | 2026-10-07 |
| CVE-2026-102090 Kiteworks Core before version 9.5.1 is vulnerable to Content Injection. |
medium | 4.3 | — | Accellion / kiteworks | 2026-09-30 | 2026-10-07 |
| CVE-2026-106413 Race condition in Browser in Google Chrome prior to 155.0.8059.39 allowed a remo... |
medium | 4.2 | — | Google / chrome | 2026-10-06 | 2026-10-07 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.