October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,479
Critical
1,340
High
5,869
Medium
6,256
Low
648
Severity not reported
3,366
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1307), google (756), oracle (156), ibm (140), adobe (138), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-106235 Use after free in WebAudio in Google Chrome prior to 155.0.8059.39 allowed a rem... |
high | 8.8 | — | Google / chrome | 2026-10-06 | 2026-10-07 |
| CVE-2026-106238 Race condition in Fonts in Google Chrome prior to 155.0.8059.39 allowed a remote... |
high | 8.3 | — | Google / chrome | 2026-10-06 | 2026-10-07 |
| CVE-2026-106240 Type confusion in V8 in Google Chrome prior to 155.0.8059.39 allowed a remote at... |
high | 8.8 | — | Google / chrome | 2026-10-06 | 2026-10-07 |
| CVE-2026-106225 Missing authorization in Autofill in Google Chrome prior to 155.0.8059.39 allowe... |
high | 8.8 | — | Google / chrome | 2026-10-06 | 2026-10-08 |
| CVE-2026-106228 Confused deputy in Google Lens in Google Chrome prior to 155.0.8059.39 allowed a... |
high | 8.3 | — | Google / chrome | 2026-10-06 | 2026-10-07 |
| CVE-2026-106220 Information leak in Passwords in Google Chrome prior to 155.0.8059.39 allowed a... |
high | 8.8 | — | Google / chrome | 2026-10-06 | 2026-10-08 |
| CVE-2026-106221 Confused deputy in WebAPKs in Google Chrome on on Android prior to 155.0.8059.39... |
high | 8.3 | — | Google / chrome | 2026-10-06 | 2026-10-09 |
| CVE-2026-106207 Race condition in V8 in Google Chrome prior to 155.0.8059.39 allowed a remote at... |
high | 8.8 | — | Google / chrome | 2026-10-06 | 2026-10-08 |
| CVE-2026-106212 Incorrect authorization in Autofill in Google Chrome prior to 155.0.8059.39 allo... |
high | 8.8 | — | Google / chrome | 2026-10-06 | 2026-10-08 |
| CVE-2026-106198 Missing authorization in FileSystem in Google Chrome prior to 155.0.8059.39 allo... |
high | 8.2 | — | Google / chrome | 2026-10-06 | 2026-10-08 |
| CVE-2026-106199 Incorrect authorization in Actor in Google Chrome on on Android prior to 155.0.8... |
high | 8.2 | — | Google / chrome | 2026-10-06 | 2026-10-09 |
| CVE-2026-106200 Use after free in Track in Google Chrome prior to 155.0.8059.39 allowed a remote... |
high | 8.8 | — | Google / chrome | 2026-10-06 | 2026-10-08 |
| CVE-2026-106201 Race condition in V8 in Google Chrome prior to 155.0.8059.39 allowed a remote at... |
high | 8.8 | — | Google / chrome | 2026-10-06 | 2026-10-08 |
| CVE-2026-106203 Incomplete cleanup in Autofill in Google Chrome on on iOS prior to 155.0.8059.39... |
high | 8.8 | — | Google / chrome | 2026-10-06 | 2026-10-08 |
| CVE-2026-106204 Use after free in PDF in Google Chrome prior to 155.0.8059.39 allowed a remote a... |
high | 8.8 | — | Google / chrome | 2026-10-06 | 2026-10-08 |
| CVE-2026-106205 Missing authorization in Passwords in Google Chrome on on Android prior to 155.0... |
high | 8.1 | — | Google / chrome | 2026-10-06 | 2026-10-08 |
| CVE-2026-106190 Use after free in Media in Google Chrome prior to 155.0.8059.39 allowed a remote... |
high | 8.8 | — | Google / chrome | 2026-10-06 | 2026-10-08 |
| CVE-2026-106191 Missing authorization in Actor in Google Chrome prior to 155.0.8059.39 allowed a... |
high | 8.3 | — | Google / chrome | 2026-10-06 | 2026-10-08 |
| CVE-2026-106193 Use after free in Parser in Google Chrome prior to 155.0.8059.39 allowed a remot... |
high | 8.8 | — | Google / chrome | 2026-10-06 | 2026-10-08 |
| CVE-2026-106194 Missing authorization in WebAppInstalls in Google Chrome prior to 155.0.8059.39... |
high | 8.3 | — | Google / chrome | 2026-10-06 | 2026-10-08 |
| CVE-2026-106196 Missing authorization in Navigation in Google Chrome on on iOS prior to 155.0.80... |
high | 7.6 | — | Google / chrome | 2026-10-06 | 2026-10-08 |
| CVE-2026-106186 Uncontrolled search path element in CredentialProvider in Google Chrome on on Wi... |
high | 8.6 | — | Google / chrome | 2026-10-06 | 2026-10-08 |
| CVE-2026-106188 Confused deputy in SignIn in Google Chrome on on Android prior to 155.0.8059.39... |
high | 7.1 | — | Google / chrome | 2026-10-06 | 2026-10-08 |
| CVE-2026-106189 Code injection in ReaderMode in Google Chrome on on iOS prior to 155.0.8059.39 a... |
high | 7.3 | — | Google / chrome | 2026-10-06 | 2026-10-08 |
| CVE-2026-106121 The RabbitMQ Java client library allows Java and JVM-based applications to conne... |
high | 7.5 | — | Vmware / rabbitmq java client | 2026-10-06 | 2026-10-09 |
| CVE-2026-106122 The RabbitMQ Java client library allows Java and JVM-based applications to conne... |
high | 7.5 | — | Vmware / rabbitmq java client | 2026-10-06 | 2026-10-09 |
| CVE-2026-106118 ImageSharp is a 2D graphics library. |
high | 7.5 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-105488 Missing authorization in the global vault in Devolutions Server 2026.3.7.0 and e... |
high | 7.1 | — | — | 2026-10-06 | 2026-10-07 |
| CVE-2026-104073 NetBox versions 2.9.5 before 4.7.0 contain a server-side template injection vuln... |
high | 7.6 | — | — | 2026-10-06 | 2026-10-07 |
| CVE-2026-106115 ImageSharp is a 2D graphics library. |
high | 7.5 | — | Sixlabors / imagesharp | 2026-10-06 | 2026-10-24 |
| CVE-2026-106117 ImageSharp is a 2D graphics library. |
high | 7.5 | — | Sixlabors / imagesharp | 2026-10-06 | 2026-10-27 |
| CVE-2026-106110 ImageSharp is a 2D graphics library. |
high | 7.5 | — | Sixlabors / imagesharp | 2026-10-06 | 2026-10-24 |
| CVE-2026-106112 ImageSharp is a 2D graphics library. |
high | 7.5 | — | Sixlabors / imagesharp | 2026-10-06 | 2026-10-24 |
| CVE-2026-106113 ImageSharp is a 2D graphics library. |
high | 7.5 | — | Sixlabors / imagesharp | 2026-10-06 | 2026-10-24 |
| CVE-2026-106103 Quasar Framework is a framework for building high-performance Vue.js user interf... |
high | 7.1 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-101207 Dell OpenManage Integration with Microsoft Windows Admin Center, versions prior... |
high | 8.8 | — | — | 2026-10-06 | 2026-10-07 |
| CVE-2025-45871 LogicalDOC Enterprise up to and for 9.1.1 is vulnerable to blind SQL injection i... |
high | 8.1 | — | — | 2026-10-06 | 2026-10-14 |
| CVE-2026-95140 kkFileView v5.0.0 through v5.0.2 contains a directory traversal vulnerability in... |
high | 7.5 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-106219 In JetBrains TeamCity before 2026.2.1 missing validation of Git submodule URLs a... |
high | 7.5 | — | Jetbrains / teamcity | 2026-10-06 | 2026-10-08 |
| CVE-2026-105868 Payload is a free and open source headless content management system. |
high | 7.1 | — | Payloadcms / payload | 2026-10-06 | 2026-10-15 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.