October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
24,583
Critical
3,295
High
7,975
Medium
7,639
Low
740
Severity not reported
4,934
In CISA KEV
191
Most affected vendors (by CPE data where available): microsoft (1424), google (825), linux (722), ibm (323), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (116), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-65628 jose_jwk:shared_secret/2 (exposed in Elixir as JOSE.JWK.shared_secret/2) derives... |
not reported | — | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-65629 Use of Password Hash With Insufficient Computational Effort in the jose library... |
not reported | — | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-65630 Observable Timing Discrepancy vulnerability in potatosalad jose allows recovery... |
not reported | — | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-65631 Inefficient Algorithmic Complexity in erlang-jose allows an unauthenticated remo... |
not reported | — | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-65632 The jose library accepts ECDSA (ES256, ES256K, ES384, and ES512) JWS signatures... |
not reported | — | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-106087 TRO600 contains an arbitrary file read vulnerability. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-10756 TRO600 contains a vulnerability that allows an authenticated attacker to bypass... |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-13162 An OS command vulnerability exists in CoreTec product that allows authenticated... |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-118018 Spoofing issue in the Downloads component in Firefox for Android. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-118027 Frame poisoning in the Layout component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-112550 A type confusion issue was addressed with improved memory handling. |
not reported | — | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-112551 An authorization issue was addressed with improved state management. |
not reported | — | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-112552 An out-of-bounds write issue was addressed with improved bounds checking. |
not reported | — | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-112553 An out-of-bounds write issue was addressed with improved bounds checking. |
not reported | — | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-112554 An out-of-bounds read was addressed with improved bounds checking. |
not reported | — | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-112555 A validation issue was addressed with improved input sanitization. |
not reported | — | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-112557 The issue was addressed with improved checks. |
not reported | — | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-112558 A permissions issue was addressed with additional sandbox restrictions. |
not reported | — | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-112560 An out-of-bounds read was addressed with improved bounds checking. |
not reported | — | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-112561 An out-of-bounds read was addressed with improved bounds checking. |
not reported | — | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-112562 A parsing issue in the handling of directory paths was addressed with improved p... |
not reported | — | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-112563 An out-of-bounds write issue was addressed with improved bounds checking. |
not reported | — | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-112565 An integer overflow was addressed with improved input validation. |
not reported | — | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-112566 A null pointer dereference was addressed with improved validation. |
not reported | — | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-112567 This issue was addressed with improved checks. |
not reported | — | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-112568 A logic issue was addressed with improved checks. |
not reported | — | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-112569 An access issue was addressed with additional sandbox restrictions. |
not reported | — | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-112570 An access issue was addressed with additional sandbox restrictions. |
not reported | — | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-112571 A memory initialization issue was addressed with improved memory handling. |
not reported | — | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-112575 The issue was addressed with improved handling of secure input state. |
not reported | — | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-112576 A memory integrity issue was addressed with improved handling of copy-on-write p... |
not reported | — | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-112577 A privacy issue was addressed by moving sensitive data. |
not reported | — | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-112593 An out-of-bounds write issue was addressed with improved bounds checking. |
not reported | — | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-112595 This issue was addressed with improved authentication. |
not reported | — | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-112596 An integer overflow was addressed with improved bounds checking. |
not reported | — | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-112599 A use-after-free issue was addressed with improved memory management. |
not reported | — | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-112601 An integer overflow was addressed with improved input validation. |
not reported | — | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-112604 An out-of-bounds read was addressed with improved bounds checking. |
not reported | — | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-112606 A type confusion issue was addressed with improved memory handling. |
not reported | — | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-112607 An out-of-bounds read was addressed with improved bounds checking. |
not reported | — | — | — | 2026-10-26 | 2026-10-27 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.