October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
24,583
Critical
3,295
High
7,975
Medium
7,639
Low
740
Severity not reported
4,934
In CISA KEV
191
Most affected vendors (by CPE data where available): microsoft (1424), google (825), linux (722), ibm (323), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (116), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-117996 Incorrect boundary conditions in the WebRTC component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117997 Sandbox escape due to use-after-free in the Widget component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117998 Mitigation bypass in the DOM: Push Subscriptions component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117999 Race condition in the IPC component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-118000 Information disclosure in the Networking: HTTP component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-118002 Information disclosure due to race condition in the Networking component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117982 Invalid pointer in the JavaScript Engine: JIT component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117983 Use-after-free in the Graphics component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117984 Incorrect boundary conditions in the Layout: Scrolling and Overflow component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117985 Sandbox escape due to use-after-free in the Graphics component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117986 Use-after-free in the Graphics component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117987 Use-after-free in the Graphics component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117988 Sandbox escape due to incorrect boundary conditions in the Graphics: CanvasWebGL... |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117989 Use-after-free in the Graphics component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117990 Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender c... |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117991 Incorrect boundary conditions in the Layout: Text and Fonts component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117972 Use-after-free in the Graphics component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117973 Use-after-free in the Networking: DNS component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117974 Use-after-free in the XML component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117975 Sandbox escape due to invalid pointer in the Graphics: WebRender component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117976 Site isolation issue in the DOM: Navigation component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117977 Other issue in the Console component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117978 Incorrect boundary conditions in the Graphics component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117979 Incorrect boundary conditions in the Graphics: WebRender component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117980 Use-after-free in the Graphics component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117981 Privilege escalation in the Toolkit component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117963 Incorrect boundary conditions in the DOM: Service Workers component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117964 Use-after-free in the Panning and Zooming component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117965 Same-origin policy bypass in the Address Bar component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117966 Site isolation issue in the Networking: HTTP component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117967 Mitigation bypass in the DOM: Security component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117968 Use-after-free in the DOM: Core & HTML component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117969 Invalid pointer in the JavaScript Engine: JIT component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117970 Race condition in the Disability Access APIs component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117971 Sandbox escape due to use-after-free in the Print Preview component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117953 Use-after-free in the DOM: Core & HTML component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117954 Use-after-free in the Layout: Positioned component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117955 JIT miscompilation in the JavaScript: WebAssembly component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117956 Invalid pointer in the Nimbus Desktop Client component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117957 Cryptographic issue in the WebRTC: Networking component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.