October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
22,617
Critical
3,170
High
7,236
Medium
7,073
Low
640
Severity not reported
4,498
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (722), google (413), ibm (322), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-117950 Incorrect boundary conditions in the DOM: Core & HTML component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117951 Use-after-free in the DOM: Core & HTML component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117952 Uninitialized memory in the Networking component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117934 Use-after-free in the Layout component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117935 Use-after-free in the DOM: Bindings (WebIDL) component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117936 Use-after-free in the DOM: Core & HTML component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117937 Invalid pointer in the JavaScript Engine component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117938 Use-after-free in the Layout component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117939 Use-after-free in the XML component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117940 Use-after-free in the DOM: Core & HTML component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117941 Use-after-free in the DOM: CSS Object Model component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117942 Incorrect boundary conditions in the JavaScript Engine: JIT component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117943 Use-after-free in the DOM: Core & HTML component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117924 Use-after-free in the XSLT component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117925 Use-after-free in the DOM: Core & HTML component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117926 Incorrect boundary conditions in the SVG component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117927 Use-after-free in the SVG component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117928 Same-origin policy bypass in the CSS Parsing and Computation component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117929 Use-after-free in the DOM: Core & HTML component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117930 Use-after-free in the DOM: Bindings (WebIDL) component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117931 Use-after-free in the DOM: Events component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117932 Use-after-free in the DOM: Core & HTML component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117933 Frame poisoning in the CSS Parsing and Computation component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117915 Incorrect boundary conditions in the Layout: Block and Inline component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117916 Use-after-free in the XSLT component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117917 Invalid pointer in the Graphics: WebRender component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117918 Use-after-free in the Graphics: Canvas2D component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117919 Use-after-free in the DOM: Core & HTML component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117920 Use-after-free in the DOM: HTML Parser component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117921 Use-after-free in the CSS Parsing and Computation component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117922 Use-after-free in the Networking: WebSockets component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117923 Use-after-free in the Audio/Video component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117908 Use-after-free in the Graphics: ImageLib component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117909 Use-after-free in the JavaScript: GC component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117910 Invalid pointer in the JavaScript Engine component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117911 Use-after-free in the Audio/Video: Playback component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117912 Same-origin policy bypass in the CSS Parsing and Computation component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117913 Use-after-free in the SVG component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117914 Use-after-free in the SVG component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117898 Use-after-free in the JavaScript Engine: JIT component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.