October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
24,583
Critical
3,295
High
7,975
Medium
7,639
Low
740
Severity not reported
4,934
In CISA KEV
191
Most affected vendors (by CPE data where available): microsoft (1424), google (825), linux (722), ibm (323), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (116), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-117958 Site isolation issue in the Networking: HTTP component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117959 Site isolation issue in the DOM: Service Workers component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117960 Spoofing issue in the DOM: Core & HTML component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117961 Incorrect boundary conditions in the Layout: Text and Fonts component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117962 Sandbox escape due to incorrect boundary conditions in the Storage: Quota Manage... |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117944 Use-after-free in the Layout component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117945 Incorrect boundary conditions in the XML component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117946 Incorrect boundary conditions in the JavaScript Engine component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117947 Use-after-free in the XML component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117948 Use-after-free in the SVG component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117949 Use-after-free in the DOM: Core & HTML component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117950 Incorrect boundary conditions in the DOM: Core & HTML component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117951 Use-after-free in the DOM: Core & HTML component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117952 Uninitialized memory in the Networking component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117934 Use-after-free in the Layout component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117935 Use-after-free in the DOM: Bindings (WebIDL) component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117936 Use-after-free in the DOM: Core & HTML component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117937 Invalid pointer in the JavaScript Engine component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117938 Use-after-free in the Layout component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117939 Use-after-free in the XML component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117940 Use-after-free in the DOM: Core & HTML component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117941 Use-after-free in the DOM: CSS Object Model component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117942 Incorrect boundary conditions in the JavaScript Engine: JIT component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117943 Use-after-free in the DOM: Core & HTML component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117924 Use-after-free in the XSLT component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117925 Use-after-free in the DOM: Core & HTML component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117926 Incorrect boundary conditions in the SVG component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117927 Use-after-free in the SVG component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117928 Same-origin policy bypass in the CSS Parsing and Computation component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117929 Use-after-free in the DOM: Core & HTML component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117930 Use-after-free in the DOM: Bindings (WebIDL) component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117931 Use-after-free in the DOM: Events component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117932 Use-after-free in the DOM: Core & HTML component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117933 Frame poisoning in the CSS Parsing and Computation component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117915 Incorrect boundary conditions in the Layout: Block and Inline component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117916 Use-after-free in the XSLT component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117917 Invalid pointer in the Graphics: WebRender component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117918 Use-after-free in the Graphics: Canvas2D component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117919 Use-after-free in the DOM: Core & HTML component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117920 Use-after-free in the DOM: HTML Parser component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.