October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 29, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
22,209
Critical
3,102
High
7,090
Medium
6,615
Low
674
Severity not reported
4,728
In CISA KEV
188
Most affected vendors (by CPE data where available): microsoft (1176), google (780), ibm (323), mozilla (182), oracle (154), adobe (137), linux (126), apache (116), broadcom (113), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-74990 Internally found bugs present in Firefox ESR 115.38, Firefox ESR 140.13, Firefox... |
critical | 9.8 | — | Mozilla / firefox | 2026-08-18 | 2026-10-28 |
| CVE-2026-74989 Internally found bugs present in Firefox 153. |
critical | 9.8 | — | Mozilla / firefox | 2026-08-18 | 2026-10-28 |
| CVE-2026-74988 Internally found bugs present in Firefox ESR 153.0 and Firefox 153. |
critical | 9.8 | — | Mozilla / firefox | 2026-08-18 | 2026-10-28 |
| CVE-2026-74987 Internally found bugs present in Firefox ESR 140.13, Firefox ESR 153.0 and Firef... |
critical | 9.8 | — | Mozilla / firefox | 2026-08-18 | 2026-10-28 |
| CVE-2026-12293 Use-after-free in the Graphics: WebGPU component. |
critical | 9.8 | — | Mozilla / firefox | 2026-06-16 | 2026-10-26 |
| CVE-2026-14241 Memory safety bugs present in Firefox 152.0.3. |
critical | 9.8 | — | Mozilla / firefox | 2026-06-30 | 2026-10-25 |
| CVE-2023-29531 An attacker could have caused an out of bounds memory access using WebGL APIs, l... |
critical | 9.8 | — | Mozilla / firefox | 2023-06-19 | 2026-10-24 |
| CVE-2023-34416 Memory safety bugs present in Firefox 113, Firefox ESR 102.11, and Thunderbird 1... |
critical | 9.8 | — | Mozilla / firefox | 2023-06-19 | 2026-10-24 |
| CVE-2023-29542 A newline in a filename could have been used to bypass the file extension securi... |
critical | 9.8 | — | Mozilla / firefox | 2023-06-19 | 2026-10-23 |
| CVE-2026-5734 Memory safety bugs present in Firefox ESR 140.9.0, Thunderbird ESR 140.9.0, Fire... |
critical | 9.8 | — | Mozilla / firefox | 2026-04-07 | 2026-10-23 |
| CVE-2026-5735 Memory safety bugs present in Firefox 149.0.1 and Thunderbird 149.0.1. |
critical | 9.8 | — | Mozilla / firefox | 2026-04-07 | 2026-10-23 |
| CVE-2026-100800 Sandbox escape due to use-after-free in the Disability Access APIs component. |
critical | 9.6 | — | Mozilla / firefox | 2026-09-29 | 2026-10-19 |
| CVE-2026-100804 Sandbox escape due to use-after-free in the Preferences: Backend component. |
critical | 9.6 | — | Mozilla / firefox | 2026-09-29 | 2026-10-19 |
| CVE-2026-100788 Invalid pointer in the JavaScript: WebAssembly component. |
critical | 9.8 | — | Mozilla / firefox | 2026-09-29 | 2026-10-19 |
| CVE-2026-100794 Sandbox escape due to incorrect boundary conditions in the Internationalization... |
critical | 9.6 | — | Mozilla / firefox | 2026-09-29 | 2026-10-19 |
| CVE-2025-11719 Starting in Thunderbird 143, the use of the native messaging API by web extensio... |
critical | 9.8 | — | Mozilla / firefox | 2025-10-14 | 2026-10-18 |
| CVE-2025-11721 Memory safety bug present in Firefox 143 and Thunderbird 143. |
critical | 9.8 | — | Mozilla / firefox | 2025-10-14 | 2026-10-18 |
| CVE-2026-100758 Sandbox escape in the DOM: Navigation component. |
critical | 9.6 | — | Mozilla / firefox | 2026-09-29 | 2026-10-13 |
| CVE-2026-100760 Sandbox escape in the Security: Process Sandboxing component. |
critical | 9.6 | — | Mozilla / firefox | 2026-09-29 | 2026-10-13 |
| CVE-2026-106016 Mitigation bypass in the File Handling component. |
critical | 9.8 | — | Mozilla / firefox | 2026-10-06 | 2026-10-13 |
| CVE-2026-100762 Sandbox escape due to use-after-free in the DOM: Content Processes component. |
critical | 9.6 | — | Mozilla / firefox | 2026-09-29 | 2026-10-13 |
| CVE-2026-100763 Incorrect boundary conditions in the Graphics: WebGPU component. |
critical | 9.1 | — | Mozilla / firefox | 2026-09-29 | 2026-10-13 |
| CVE-2026-100828 Mitigation bypass in the Bookmarks & History component. |
critical | 9.6 | — | Mozilla / firefox | 2026-09-29 | 2026-10-13 |
| CVE-2026-100829 Mitigation bypass in the DOM: Security component. |
critical | 9.6 | — | Mozilla / firefox | 2026-09-29 | 2026-10-13 |
| CVE-2016-9063 An integer overflow during the parsing of XML using the Expat library. |
critical | 9.8 | — | Mozilla / firefox | 2018-06-11 | 2026-10-08 |
| CVE-2016-0718 Expat allows context-dependent attackers to cause a denial of service (crash) or... |
critical | 9.8 | — | Mozilla / firefox | 2016-05-26 | 2026-10-08 |
| CVE-2025-11717 When switching between Android apps using the card carousel Firefox shows a blac... |
critical | 9.1 | — | Mozilla / firefox | 2025-10-14 | 2026-10-08 |
| CVE-2025-14321 Use-after-free in the WebRTC: Signaling component. |
critical | 9.8 | — | Mozilla / firefox | 2025-12-09 | 2026-10-07 |
| CVE-2025-14324 JIT miscompilation in the JavaScript Engine: JIT component. |
critical | 9.8 | — | Mozilla / firefox | 2025-12-09 | 2026-10-07 |
| CVE-2025-14326 Use-after-free in the Audio/Video: GMP component. |
critical | 9.8 | — | Mozilla / firefox | 2025-12-09 | 2026-10-07 |
| CVE-2025-14330 JIT miscompilation in the JavaScript Engine: JIT component. |
critical | 9.8 | — | Mozilla / firefox | 2025-12-09 | 2026-10-07 |
| CVE-2026-92018 Sandbox escape in the DOM: Core & HTML component. |
critical | 9.6 | — | Mozilla / firefox | 2026-09-15 | 2026-10-06 |
| CVE-2026-100770 Sandbox escape due to use-after-free in the DOM: Content Processes component. |
critical | 9.6 | — | Mozilla / firefox | 2026-09-29 | 2026-10-06 |
| CVE-2026-100775 Sandbox escape in the Graphics component. |
critical | 9.6 | — | Mozilla / firefox | 2026-09-29 | 2026-10-06 |
| CVE-2026-92071 Sandbox escape due to incorrect boundary conditions in the Widget: Win32 compone... |
critical | 9.6 | — | Mozilla / firefox | 2026-09-15 | 2026-10-05 |
| CVE-2026-92075 Mitigation bypass in the Networking component. |
critical | 9.1 | — | Mozilla / firefox | 2026-09-15 | 2026-10-05 |
| CVE-2026-92079 Mitigation bypass in the Widget: Win32 component. |
critical | 9.1 | — | Mozilla / firefox | 2026-09-15 | 2026-10-05 |
| CVE-2026-92057 Mitigation bypass in the Enterprise Policies component. |
critical | 9.1 | — | Mozilla / firefox | 2026-09-15 | 2026-10-05 |
| CVE-2026-92059 Incorrect boundary conditions in the DOM: Editor component. |
critical | 9.3 | — | Mozilla / firefox | 2026-09-15 | 2026-10-05 |
| CVE-2026-92061 Incorrect boundary conditions in the Security: Process Sandboxing component. |
critical | 9.8 | — | Mozilla / firefox | 2026-09-15 | 2026-10-05 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.