October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
24,583
Critical
3,295
High
7,975
Medium
7,639
Low
740
Severity not reported
4,934
In CISA KEV
191
Most affected vendors (by CPE data where available): microsoft (1424), google (825), linux (722), ibm (323), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (116), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-117868 Sandbox escape in the DOM: Networking component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117869 Use-after-free in the DOM: Core & HTML component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117870 Use-after-free in the JavaScript Engine component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117871 Invalid pointer in the Graphics component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117872 Use-after-free in the JavaScript: Standard Library component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117873 Incorrect boundary conditions in the Audio/Video: Playback component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117874 Use-after-free in the Internationalization component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117875 Use-after-free in the Layout: Scrolling and Overflow component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117876 Use-after-free in the Layout: Text and Fonts component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117877 Use-after-free in the Layout: Text and Fonts component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117860 Same-origin policy bypass in the DOM: Navigation component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117861 Sandbox escape in the DOM: Navigation component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117862 Privilege escalation due to incorrect boundary conditions in the Networking comp... |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117863 Information disclosure due to uninitialized memory in the Audio/Video component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117864 Sandbox escape in the Form Manager component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117865 Use-after-free in the JavaScript: GC component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117866 Privilege escalation due to use-after-free in the Graphics: Canvas2D component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117867 Use-after-free in the Layout component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-116469 MISP Guard, a proxy-based security filter for MISP (Malware Information Sharing... |
not reported | — | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2024-36345 Improper input validation in the AMD OverDrive (AOD) System Management Mode (SMM... |
not reported | — | — | — | 2026-05-15 | 2026-10-27 |
| CVE-2026-18330 A hard-coded
cryptographic key vulnerability exists in the web module of TP-Link... |
not reported | — | — | — | 2026-09-03 | 2026-10-27 |
| CVE-2026-111054 Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2024-10085 CWE-770: Allocation of Resources Without Limits or Throttling vulnerability exis... |
not reported | — | — | — | 2026-09-01 | 2026-10-27 |
| CVE-2024-7952 A data exposure vulnerability exists in the affected product. |
not reported | — | — | — | 2026-09-01 | 2026-10-27 |
| CVE-2024-7956 A vulnerability exists in the affected products that allows a threat actor to ga... |
not reported | — | — | — | 2026-09-02 | 2026-10-27 |
| CVE-2024-5540 The reflective cross-site scripting vulnerability found in ALC WebCTRL and Carri... |
not reported | — | — | — | 2025-11-27 | 2026-10-27 |
| CVE-2024-58291 Flatboard 3.2 contains a stored cross-site scripting vulnerability that allows a... |
not reported | — | — | — | 2025-12-11 | 2026-10-27 |
| CVE-2024-58293 Akaunting 3.1.8 contains a server-side template injection vulnerability that all... |
not reported | — | — | — | 2025-12-11 | 2026-10-27 |
| CVE-2024-58306 minaliC 2.0.0 contains a denial of service vulnerability that allows remote atta... |
not reported | — | — | — | 2025-12-11 | 2026-10-27 |
| CVE-2024-36315 Improper enforcement of the LFENCE serialization property may allow an attacker... |
not reported | — | — | — | 2026-05-13 | 2026-10-27 |
| CVE-2024-21962 Improper Input Validation in the AMD RAID driver could allow an attacker to poin... |
not reported | — | — | — | 2026-05-15 | 2026-10-27 |
| CVE-2024-21950 An out of bounds read in the remote management firmware could allow a privileged... |
not reported | — | — | — | 2026-05-15 | 2026-10-27 |
| CVE-2024-36323 Improper isolation of VCN-JPEG HW register space could allow a malicious Guest V... |
not reported | — | — | — | 2026-05-15 | 2026-10-27 |
| CVE-2024-24769 vantage6 is an open-source infrastructure for privacy preserving analysis. |
not reported | — | — | — | 2026-06-17 | 2026-10-27 |
| CVE-2024-27928 vantage6 is an open-source infrastructure for privacy preserving analysis. |
not reported | — | — | — | 2026-06-17 | 2026-10-27 |
| CVE-2026-99090 In the Linux kernel, the following vulnerability has been resolved:
drm/amdgpu:... |
not reported | — | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-107458 Rejected reason: This CVE has been rejected by Upstream, as they failed to creat... |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-115533 The LeRobot library is vulnerable to arbitrary code execution via unsafe dynamic... |
not reported | — | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-113644 In Eclipse ioFog iofogctl versions 1.0.0 through 3.7.0 and 3.8.0-rc.1 through 3.... |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-115216 In Eclipse ioFog Operator versions 3.8.0 before 3.9.2, TLS certificate verificat... |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.