October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
22,617
Critical
3,170
High
7,236
Medium
7,073
Low
640
Severity not reported
4,498
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (722), google (413), ibm (322), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-117899 Use-after-free in the Networking: HTTP component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117900 Use-after-free in the DOM: Editor component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117901 Use-after-free in the DOM: Core & HTML component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117902 Use-after-free in the Layout: Text and Fonts component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117903 Use-after-free in the Audio/Video component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117904 Use-after-free in the JavaScript: GC component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117905 Use-after-free in the Audio/Video: Playback component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117906 Use-after-free in the CSS Parsing and Computation component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117907 Use-after-free in the Networking component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117888 Uninitialized memory in the Graphics: Canvas2D component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117889 Incorrect boundary conditions in the JavaScript Engine component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117890 JIT miscompilation in the JavaScript Engine: JIT component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117891 Use-after-free in the JavaScript Engine: JIT component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117892 Privilege escalation due to use-after-free in the WebRTC: Networking component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117893 Incorrect boundary conditions in the Security: PSM component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117894 Incorrect boundary conditions in the WebRTC: Signaling component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117895 Use-after-free in the DOM: Core & HTML component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117896 Use-after-free in the DOM: Core & HTML component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117897 Incorrect boundary conditions in the Layout: Tables component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117878 Other issue, use-after-free in the Storage: IndexedDB component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117879 Incorrect boundary conditions in the Layout: Tables component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117880 Use-after-free in the XML component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117881 Use-after-free in the DOM: Core & HTML component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117882 Use-after-free in the Layout component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117883 Use-after-free in the DOM: HTML Parser component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117884 Use-after-free in the Networking component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117885 Use-after-free in the Layout: Grid component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117886 Incorrect boundary conditions in the Graphics: Text component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117887 Use-after-free in the DOM: Core & HTML component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117868 Sandbox escape in the DOM: Networking component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117869 Use-after-free in the DOM: Core & HTML component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117870 Use-after-free in the JavaScript Engine component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117871 Invalid pointer in the Graphics component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117872 Use-after-free in the JavaScript: Standard Library component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117873 Incorrect boundary conditions in the Audio/Video: Playback component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117874 Use-after-free in the Internationalization component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117875 Use-after-free in the Layout: Scrolling and Overflow component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117876 Use-after-free in the Layout: Text and Fonts component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117877 Use-after-free in the Layout: Text and Fonts component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117860 Same-origin policy bypass in the DOM: Navigation component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.