October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
22,617
Critical
3,170
High
7,236
Medium
7,073
Low
640
Severity not reported
4,498
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (722), google (413), ibm (322), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2024-54656 Rejected reason: This candidate was in a CNA pool that was not assigned to any i... |
not reported | — | — | — | 2026-10-19 | 2026-10-27 |
| CVE-2024-54657 Rejected reason: This candidate was in a CNA pool that was not assigned to any i... |
not reported | — | — | — | 2026-10-19 | 2026-10-27 |
| CVE-2026-39928 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-118023 Sandbox escape due to use-after-free in the Graphics: WebRender component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-118024 Use-after-free in the Graphics: Text component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-118025 Other issue in the SVG component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-118026 Invalid pointer in the JavaScript: GC component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-118012 Use-after-free in the DOM: Animation component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-118013 Use-after-free in the Layout: Images, Video, and HTML Frames component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-118014 Use-after-free in the JavaScript Engine: JIT component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-118015 Use-after-free in the DOM: Core & HTML component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-118016 Use-after-free in the DOM: Core & HTML component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-118017 Use-after-free in the SVG component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-118019 Race condition, use-after-free in the DOM: File component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-118020 Use-after-free in the Layout component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-118021 Sandbox escape due to use-after-free in the XPCOM component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-118022 Sandbox escape due to use-after-free in the Disability Access APIs component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-118003 Information disclosure in the Networking: DNS component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-118004 Incorrect boundary conditions in the CSS Transitions and Animations component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-118005 Use-after-free in the WebRTC: Signaling component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-118006 Privilege escalation due to use-after-free in the WebRTC: Signaling component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-118007 Use-after-free in the JavaScript: GC component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-118009 Integer overflow, use-after-free in the Graphics: Text component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-118010 Use-after-free in the Disability Access APIs component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-118011 Frame poisoning in the CSS Parsing and Computation component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117992 Information disclosure in the CSS Parsing and Computation component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117993 Integer overflow in the Graphics: Text component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117994 Use-after-free in the JavaScript: GC component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117995 Privilege escalation in the DOM: UI Events & Focus Handling component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117996 Incorrect boundary conditions in the WebRTC component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117997 Sandbox escape due to use-after-free in the Widget component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117998 Mitigation bypass in the DOM: Push Subscriptions component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117999 Race condition in the IPC component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-118000 Information disclosure in the Networking: HTTP component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-118002 Information disclosure due to race condition in the Networking component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117982 Invalid pointer in the JavaScript Engine: JIT component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117983 Use-after-free in the Graphics component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117984 Incorrect boundary conditions in the Layout: Scrolling and Overflow component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117985 Sandbox escape due to use-after-free in the Graphics component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117986 Use-after-free in the Graphics component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.