October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 29, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
22,229
Critical
3,102
High
7,094
Medium
6,630
Low
674
Severity not reported
4,729
In CISA KEV
188
Most affected vendors (by CPE data where available): microsoft (1176), google (780), ibm (323), mozilla (182), oracle (154), adobe (137), linux (126), apache (116), broadcom (113), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-100795 Denial-of-service in the Networking component. |
medium | 6.5 | — | Mozilla / firefox | 2026-09-29 | 2026-10-19 |
| CVE-2026-103500 An attacker could cause a heap buffer overflow by getting a user to open an emai... |
medium | 6.1 | — | Mozilla / thunderbird | 2026-09-30 | 2026-10-16 |
| CVE-2026-100766 Information disclosure in the Networking: JAR component. |
medium | 4.3 | — | Mozilla / firefox | 2026-09-29 | 2026-10-13 |
| CVE-2026-100821 Site isolation issue in the Panning and Zooming component. |
medium | 4.7 | — | Mozilla / firefox | 2026-09-29 | 2026-10-13 |
| CVE-2026-100822 Spoofing issue in the Networking: HTTP component. |
medium | 5.4 | — | Mozilla / firefox | 2026-09-29 | 2026-10-13 |
| CVE-2026-100826 Denial-of-service in the Storage: StorageManager component. |
medium | 6.5 | — | Mozilla / firefox | 2026-09-29 | 2026-10-13 |
| CVE-2026-92030 Mitigation bypass in the DOM: Copy & Paste and Drag & Drop component. |
medium | 5.4 | — | Mozilla / firefox | 2026-09-15 | 2026-10-06 |
| CVE-2026-92031 Information disclosure in the Graphics: ImageLib component. |
medium | 6.5 | — | Mozilla / firefox | 2026-09-15 | 2026-10-06 |
| CVE-2026-92005 Use-after-free in the Audio/Video: Web Codecs component. |
medium | 5.3 | — | Mozilla / firefox | 2026-09-15 | 2026-10-06 |
| CVE-2026-100817 Other issue in the JavaScript: WebAssembly component. |
medium | 5.4 | — | Mozilla / firefox | 2026-09-29 | 2026-10-06 |
| CVE-2026-92068 Site isolation issue in the Reader Mode component. |
medium | 5.4 | — | Mozilla / firefox | 2026-09-15 | 2026-10-05 |
| CVE-2026-92069 Spoofing issue in the DOM: Navigation component. |
medium | 5.4 | — | Mozilla / firefox | 2026-09-15 | 2026-10-05 |
| CVE-2026-92070 Information disclosure in the Networking component. |
medium | 4.3 | — | Mozilla / firefox | 2026-09-15 | 2026-10-05 |
| CVE-2026-92077 Denial-of-service in the SVG component. |
medium | 6.5 | — | Mozilla / firefox | 2026-09-15 | 2026-10-05 |
| CVE-2026-92078 Denial-of-service in the Security component. |
medium | 6.5 | — | Mozilla / firefox | 2026-09-15 | 2026-10-05 |
| CVE-2026-92063 Denial-of-service in the Audio/Video component. |
medium | 6.5 | — | Mozilla / firefox | 2026-09-15 | 2026-10-05 |
| CVE-2026-92039 Mitigation bypass in the DOM: Notifications component. |
medium | 6.3 | — | Mozilla / firefox | 2026-09-15 | 2026-10-05 |
| CVE-2026-86853 A malicious webpage could repeatedly trigger external URL schemes, causing syste... |
medium | 4.3 | — | Mozilla / firefox mobile | 2026-09-08 | 2026-10-05 |
| CVE-2026-100812 Denial-of-service in the Graphics component. |
medium | 6.5 | — | Mozilla / firefox | 2026-09-29 | 2026-10-05 |
| CVE-2026-100823 Spoofing issue in the Downloads component in Firefox for Android. |
medium | 5.4 | — | Mozilla / firefox mobile | 2026-09-29 | 2026-10-05 |
| CVE-2026-96869 Information disclosure in the Networking component. |
medium | 4.3 | — | Mozilla / firefox | 2026-09-29 | 2026-10-05 |
| CVE-2026-100783 Uninitialized memory in the Audio/Video component. |
medium | 4.3 | — | Mozilla / firefox | 2026-09-29 | 2026-10-05 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.