October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 29, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
22,204
Critical
3,101
High
7,090
Medium
6,615
Low
672
Severity not reported
4,726
In CISA KEV
188
Most affected vendors (by CPE data where available): microsoft (1176), google (780), ibm (323), mozilla (182), oracle (154), adobe (137), linux (126), apache (116), broadcom (113), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-111497 A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google... |
critical | 9.8 | Listed | Google / brotli | 2026-10-22 | 2026-10-28 |
| CVE-2026-7910 Use after free in Views in Google Chrome prior to 148.0.7778.96 allowed a remote... |
critical | 9.6 | — | Google / chrome | 2026-05-06 | 2026-10-26 |
| CVE-2026-113078 Improper input validation in Compositing in Google Chrome prior to 156.0.8078.47... |
critical | 9.6 | — | Google / chrome | 2026-10-20 | 2026-10-26 |
| CVE-2026-11717 An authentication bypass vulnerability exists in the generic opaque token valida... |
critical | 9.1 | — | Google / mcp toolbox for databases | 2026-06-18 | 2026-10-26 |
| CVE-2026-11718 An authentication bypass vulnerability exists in the generic opaque token valida... |
critical | 9.1 | — | Google / mcp toolbox for databases | 2026-06-18 | 2026-10-26 |
| CVE-2026-0126 In WC-Radio, there is a possible out of bounds write due to a missing bounds che... |
critical | 9.8 | — | Google / android | 2026-06-16 | 2026-10-25 |
| CVE-2026-11720 A path traversal vulnerability exists in the HTTP tool URL builder of googleapis... |
critical | 9.1 | — | Google / mcp toolbox for databases | 2026-06-29 | 2026-10-25 |
| CVE-2026-13775 Use after free in GPU in Google Chrome prior to 150.0.7871.47 allowed a remote a... |
critical | 9.8 | — | Google / chrome | 2026-06-30 | 2026-10-25 |
| CVE-2026-13776 Type Confusion in Dawn in Google Chrome prior to 150.0.7871.47 allowed a remote... |
critical | 9.8 | — | Google / chrome | 2026-06-30 | 2026-10-25 |
| CVE-2026-13780 Insufficient validation of untrusted input in ANGLE in Google Chrome prior to 15... |
critical | 9.6 | — | Google / chrome | 2026-06-30 | 2026-10-25 |
| CVE-2026-13781 Insufficient validation of untrusted input in Skia in Google Chrome prior to 150... |
critical | 9.6 | — | Google / chrome | 2026-06-30 | 2026-10-25 |
| CVE-2026-13782 Use after free in Browser in Google Chrome prior to 150.0.7871.47 allowed a remo... |
critical | 10.0 | — | Google / chrome | 2026-06-30 | 2026-10-25 |
| CVE-2026-13785 Use after free in Bluetooth in Google Chrome on Mac prior to 150.0.7871.47 allow... |
critical | 9.6 | — | Google / chrome | 2026-06-30 | 2026-10-25 |
| CVE-2026-14101 Insufficient policy enforcement in Sandbox in Google Chrome on Mac prior to 150.... |
critical | 9.6 | — | Google / chrome | 2026-06-30 | 2026-10-25 |
| CVE-2026-14104 Insufficient validation of untrusted input in WebAppInstalls in Google Chrome pr... |
critical | 9.8 | — | Google / chrome | 2026-06-30 | 2026-10-25 |
| CVE-2026-14106 Insufficient validation of untrusted input in Text in Google Chrome on Android p... |
critical | 9.6 | — | Google / chrome | 2026-06-30 | 2026-10-25 |
| CVE-2026-14109 Insufficient policy enforcement in Mojo in Google Chrome prior to 150.0.7871.47... |
critical | 9.6 | — | Google / chrome | 2026-06-30 | 2026-10-25 |
| CVE-2026-14120 Inappropriate implementation in DevTools in Google Chrome prior to 150.0.7871.47... |
critical | 9.6 | — | Google / chrome | 2026-06-30 | 2026-10-25 |
| CVE-2026-14537 Incorrect Authorization in the direct HTTP API tool invocation endpoint in Googl... |
critical | 9.8 | — | Google / mcp toolbox for databases | 2026-07-31 | 2026-10-23 |
| CVE-2026-113270 Use after free in Internals in Google Chrome prior to 156.0.8078.47 allowed a re... |
critical | 9.6 | — | Google / chrome | 2026-10-20 | 2026-10-22 |
| CVE-2026-113283 Memory corruption in CredentialProvider in Google Chrome on on Windows prior to... |
critical | 9.6 | — | Google / chrome | 2026-10-20 | 2026-10-22 |
| CVE-2026-113300 Out of bounds write in Forms in Google Chrome prior to 156.0.8078.47 allowed a r... |
critical | 9.6 | — | Google / chrome | 2026-10-20 | 2026-10-22 |
| CVE-2026-113328 Improper input validation in Privacy in Google Chrome prior to 156.0.8078.47 all... |
critical | 9.6 | — | Google / chrome | 2026-10-20 | 2026-10-22 |
| CVE-2026-113336 Memory corruption in Compositing in Google Chrome prior to 156.0.8078.47 allowed... |
critical | 9.6 | — | Google / chrome | 2026-10-20 | 2026-10-22 |
| CVE-2026-113342 Memory corruption in Network in Google Chrome prior to 156.0.8078.47 allowed a r... |
critical | 9.6 | — | Google / chrome | 2026-10-20 | 2026-10-22 |
| CVE-2026-113211 Memory corruption in ServiceWorker in Google Chrome prior to 156.0.8078.47 allow... |
critical | 9.6 | — | Google / chrome | 2026-10-20 | 2026-10-22 |
| CVE-2026-113222 Use after free in V8 in Google Chrome prior to 156.0.8078.47 allowed a remote at... |
critical | 9.6 | — | Google / chrome | 2026-10-20 | 2026-10-22 |
| CVE-2026-113235 Improper input validation in Passwords in Google Chrome prior to 156.0.8078.47 a... |
critical | 9.6 | — | Google / chrome | 2026-10-20 | 2026-10-22 |
| CVE-2026-113252 Improper input validation in ANGLE in Google Chrome on on Windows prior to 156.0... |
critical | 9.6 | — | Google / chrome | 2026-10-20 | 2026-10-22 |
| CVE-2026-113261 Use after free in WebAppInstalls in Google Chrome prior to 156.0.8078.47 allowed... |
critical | 9.6 | — | Google / chrome | 2026-10-20 | 2026-10-22 |
| CVE-2026-113263 Use after free in Core in Google Chrome on on Android prior to 156.0.8078.47 all... |
critical | 9.6 | — | Google / chrome | 2026-10-20 | 2026-10-22 |
| CVE-2026-113169 Memory corruption in WebAppInstalls in Google Chrome on on Android prior to 156.... |
critical | 9.6 | — | Google / chrome | 2026-10-20 | 2026-10-22 |
| CVE-2026-113171 Memory corruption in Prompts in Google Chrome on on Android prior to 156.0.8078.... |
critical | 9.6 | — | Google / chrome | 2026-10-20 | 2026-10-22 |
| CVE-2026-113186 Memory corruption in DevTools in Google Chrome prior to 156.0.8078.47 allowed a... |
critical | 9.6 | — | Google / chrome | 2026-10-20 | 2026-10-22 |
| CVE-2026-113189 Use after free in Core in Google Chrome prior to 156.0.8078.47 allowed a remote... |
critical | 9.6 | — | Google / chrome | 2026-10-20 | 2026-10-22 |
| CVE-2026-113084 Improper input validation in Permissions in Google Chrome prior to 156.0.8078.47... |
critical | 9.6 | — | Google / chrome | 2026-10-20 | 2026-10-22 |
| CVE-2026-113089 Improper input validation in PrintPreview in Google Chrome prior to 156.0.8078.4... |
critical | 9.6 | — | Google / chrome | 2026-10-20 | 2026-10-22 |
| CVE-2026-113116 Use after free in DevTools in Google Chrome prior to 156.0.8078.47 allowed a rem... |
critical | 9.6 | — | Google / chrome | 2026-10-20 | 2026-10-22 |
| CVE-2026-113126 Memory corruption in PolicyContainer in Google Chrome prior to 156.0.8078.47 all... |
critical | 9.6 | — | Google / chrome | 2026-10-20 | 2026-10-22 |
| CVE-2026-113138 Memory corruption in WebAppInstalls in Google Chrome prior to 156.0.8078.47 allo... |
critical | 9.6 | — | Google / chrome | 2026-10-20 | 2026-10-22 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.