October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
24,546
Critical
3,291
High
7,931
Medium
7,625
Low
740
Severity not reported
4,959
In CISA KEV
191
Most affected vendors (by CPE data where available): microsoft (1424), google (825), linux (722), ibm (323), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (116), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-92609 Session fixation in HTTP management authentication allows remote attackers to ga... |
critical | 9.8 | — | Apache / qpid broker-j | 2026-09-25 | 2026-10-05 |
| CVE-2026-92032 Sandbox escape due to invalid pointer in the Graphics component. |
critical | 9.6 | — | Mozilla / firefox | 2026-09-15 | 2026-10-05 |
| CVE-2026-92034 Site isolation issue in the Graphics component. |
critical | 9.1 | — | Mozilla / firefox | 2026-09-15 | 2026-10-05 |
| CVE-2026-92035 Sandbox escape due to incorrect boundary conditions in the Graphics component. |
critical | 9.6 | — | Mozilla / firefox | 2026-09-15 | 2026-10-05 |
| CVE-2026-92036 Incorrect boundary conditions in the Networking: HTTP component. |
critical | 9.8 | — | Mozilla / firefox | 2026-09-15 | 2026-10-05 |
| CVE-2026-92037 Incorrect boundary conditions in the DOM: Animation component. |
critical | 9.8 | — | Mozilla / firefox | 2026-09-15 | 2026-10-05 |
| CVE-2026-92038 Mitigation bypass in the Remote Settings Client component. |
critical | 9.1 | — | Mozilla / firefox | 2026-09-15 | 2026-10-05 |
| CVE-2026-92041 Mitigation bypass in the DOM: Networking component. |
critical | 9.1 | — | Mozilla / firefox | 2026-09-15 | 2026-10-05 |
| CVE-2026-92045 Sandbox escape due to incorrect boundary conditions in the WebRTC component. |
critical | 9.6 | — | Mozilla / firefox | 2026-09-15 | 2026-10-05 |
| CVE-2026-51880 deeptutor 1.4.0 contains a path traversal issue in EditFileTool.execute. |
critical | 9.8 | — | — | 2026-10-01 | 2026-10-05 |
| CVE-2026-51875 In Devika v1.0, the Feature Agent save_code_to_project function contains a path... |
critical | 9.1 | — | — | 2026-10-01 | 2026-10-05 |
| CVE-2026-100810 Other issue in the DevTools component. |
critical | 9.8 | — | Mozilla / firefox | 2026-09-29 | 2026-10-05 |
| CVE-2026-100811 Sandbox escape due to use-after-free in the DOM: Core & HTML component. |
critical | 9.6 | — | Mozilla / firefox | 2026-09-29 | 2026-10-05 |
| CVE-2026-100818 Sandbox escape due to use-after-free in the Widget: Gtk component. |
critical | 9.6 | — | Mozilla / firefox | 2026-09-29 | 2026-10-05 |
| CVE-2026-100778 Sandbox escape due to use-after-free in the DOM: Core & HTML component. |
critical | 9.6 | — | Mozilla / firefox | 2026-09-29 | 2026-10-05 |
| CVE-2025-1009 An attacker could have caused a use-after-free via crafted XSLT data, leading to... |
critical | 9.8 | — | Mozilla / firefox | 2025-02-04 | 2026-10-05 |
| CVE-2025-1016 Memory safety bugs present in Firefox 134, Thunderbird 134, Firefox ESR 115.19,... |
critical | 9.8 | — | Mozilla / firefox | 2025-02-04 | 2026-10-05 |
| CVE-2025-1017 Memory safety bugs present in Firefox 134, Thunderbird 134, Firefox ESR 128.6, a... |
critical | 9.8 | — | Mozilla / firefox | 2025-02-04 | 2026-10-05 |
| CVE-2025-1020 Memory safety bugs present in Firefox 134 and Thunderbird 134. |
critical | 9.8 | — | Mozilla / firefox | 2025-02-04 | 2026-10-05 |
| CVE-2026-103628 Out of bounds write in WebGL in Google Chrome prior to 154.0.8037.97 allowed a r... |
critical | 9.6 | — | Google / chrome | 2026-10-02 | 2026-10-05 |
| CVE-2026-103626 Incorrect authorization in FileSystem in Google Chrome on on Windows prior to 15... |
critical | 9.6 | — | Google / chrome | 2026-10-02 | 2026-10-05 |
| CVE-2026-100781 Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender c... |
critical | 9.6 | — | Mozilla / firefox | 2026-09-29 | 2026-10-05 |
| CVE-2026-100819 Sandbox escape due to incorrect boundary conditions in the XPCOM component. |
critical | 9.6 | — | Mozilla / firefox | 2026-09-29 | 2026-10-05 |
| CVE-2026-100786 Sandbox escape due to use-after-free in the Graphics component. |
critical | 9.6 | — | Mozilla / firefox | 2026-09-29 | 2026-10-05 |
| CVE-2026-100787 Sandbox escape in the XUL component. |
critical | 9.6 | — | Mozilla / firefox | 2026-09-29 | 2026-10-05 |
| CVE-2026-56154 Use After Free vulnerability in Apache HTTP Server's mod_rewrite when using look... |
critical | 9.8 | — | Apache / http server | 2026-10-01 | 2026-10-05 |
| CVE-2026-57941 Use After Free vulnerability in Apache HTTP Server's mod_http2 via shared sessio... |
critical | 9.8 | — | Apache / http server | 2026-10-01 | 2026-10-05 |
| CVE-2026-59797 Improper Privilege Management vulnerability in Apache HTTP Server's mod_ssl via... |
critical | 9.8 | — | Apache / http server | 2026-10-01 | 2026-10-05 |
| CVE-2026-97637 The JSON API Auth plugin for WordPress is vulnerable to Authentication Bypass vi... |
critical | 9.8 | — | — | 2026-10-02 | 2026-10-03 |
| CVE-2026-14378 The DevKit Pro plugin for WordPress is vulnerable to Authentication Bypass Leadi... |
critical | 9.8 | — | — | 2026-10-02 | 2026-10-03 |
| CVE-2026-19660 The Divi Membership plugin for WordPress is vulnerable to Authentication Bypass... |
critical | 9.8 | — | — | 2026-10-02 | 2026-10-03 |
| CVE-2026-19652 The Divi Membership plugin for WordPress is vulnerable to Privilege Escalation i... |
critical | 9.8 | — | — | 2026-10-02 | 2026-10-03 |
| CVE-2026-103648 Path traversal in image-downloader 4.3.0 allows an attacker who can control the... |
critical | 9.1 | — | — | 2026-10-02 | 2026-10-03 |
| CVE-2026-97413 In the Linux kernel, the following vulnerability has been resolved:
RDMA/rtrs-s... |
critical | 9.8 | — | — | 2026-09-24 | 2026-10-03 |
| CVE-2026-76504 Cisco Catalyst SD-WAN Manager Hex Encoding Vulnerability |
critical | 9.8 | Listed | Cisco / Catalyst SD-WAN Manager | 2026-09-30 | 2026-10-03 |
| CVE-2026-100255 In JetBrains TeamCity before 2026.2,
2026.1.4,
2025.11.8 administrator account... |
critical | 9.8 | — | Jetbrains / teamcity | 2026-09-30 | 2026-10-02 |
| CVE-2026-88920 An authentication bypass in the DOM security processor in Apache WSS4J allows un... |
critical | 9.8 | — | Apache / wss4j | 2026-09-30 | 2026-10-02 |
| CVE-2026-51858 In camel-ai camel 0.2.91a1, v0.2.91a2 and v0.2.91a3, TerminalToolkit.shell_exec... |
critical | 9.8 | — | — | 2026-09-30 | 2026-10-02 |
| CVE-2026-15896 The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to... |
critical | 9.1 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-103765 Mooncake through 0.3.13.post1 contains a missing authentication vulnerability in... |
critical | 9.4 | — | — | 2026-10-02 | 2026-10-02 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.