October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,479
Critical
1,340
High
5,869
Medium
6,256
Low
648
Severity not reported
3,366
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1307), google (756), oracle (156), ibm (140), adobe (138), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-109751 Information disclosure in the Networking component. |
medium | 4.3 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-109735 Use-after-free in the DOM: Animation component. |
medium | 5.4 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-109738 Use-after-free in the Audio/Video: Playback component. |
medium | 5.4 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-109741 Use-after-free in the Storage: Bucket File System component. |
medium | 5.4 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-109742 Information disclosure in the PDF Viewer component. |
medium | 4.3 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-109725 Use-after-free in the DOM: Core & HTML component. |
medium | 5.4 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-109726 Use-after-free in the SVG component. |
medium | 5.4 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-109727 Use-after-free in the Audio/Video component. |
medium | 5.4 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-109728 Use-after-free in the DOM: Animation component. |
medium | 5.4 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-109729 Use-after-free in the JavaScript Engine: JIT component. |
medium | 5.4 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-109731 Incorrect boundary conditions in the Graphics: Canvas2D component. |
medium | 5.4 | — | — | 2026-10-13 | 2026-10-19 |
| CVE-2026-109732 Use-after-free in the DOM: Streams component. |
medium | 5.4 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-109717 Use-after-free in the DOM: Bindings (WebIDL) component. |
medium | 5.4 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-109718 Use-after-free in the XML component. |
medium | 5.4 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-109719 Race condition, use-after-free in the Graphics: CanvasWebGL component. |
medium | 4.2 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-109721 Incorrect boundary conditions in the JavaScript Engine: JIT component. |
medium | 5.4 | — | — | 2026-10-13 | 2026-10-19 |
| CVE-2026-109723 Integer overflow in the Layout: Text and Fonts component. |
medium | 5.4 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-109724 Use-after-free in the DOM: Core & HTML component. |
medium | 5.4 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-109710 Use-after-free in the Graphics: Text component. |
medium | 5.4 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-109711 Use-after-free in the Graphics: Canvas2D component. |
medium | 5.4 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-109713 Use-after-free in the Crash Reporting component. |
medium | 5.4 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-109714 Incorrect boundary conditions in the Layout component. |
medium | 5.4 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-109706 Use-after-free in the Storage: IndexedDB component. |
medium | 5.4 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-109406 A weakness has been identified in macrozheng mall up to 1.0.3. |
medium | 5.4 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-109404 A vulnerability was identified in conductor-oss conductor up to 3.33.0-rc10. |
medium | 5.3 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-89279 Cross-Site request forgery (CSRF) vulnerability in AuthTake Technology Inc. |
medium | 6.5 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-94410 A low privileged remote attacker is able to view a list of roles that should onl... |
medium | 4.3 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-109189 A vulnerability was detected in fit2cloud MeterSphere up to 3.6.9-lts. |
medium | 6.3 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-109190 A vulnerability has been found in conductor-oss conductor 3.31.2. |
medium | 6.3 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-109402 A vulnerability was found in conductor-oss conductor 3.22.0. |
medium | 6.3 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-109160 A vulnerability was determined in PublicCMS up to 5.202608.a. |
medium | 4.3 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-109153 A vulnerability was detected in MosaicML Composer up to 0.32.1. |
medium | 6.3 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-109155 A flaw has been found in DeepPavlov up to 1.7.0. |
medium | 6.3 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-109156 A vulnerability has been found in SeldonIO MLServer up to 1.6.1. |
medium | 6.3 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-89204 A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). |
medium | 5.4 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-89205 A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). |
medium | 6.3 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-89206 A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). |
medium | 6.3 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-89208 A vulnerability has been identified in Capital Embedded AR Classic 431-422 (All... |
medium | 5.3 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-89200 A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). |
medium | 6.7 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-89202 A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). |
medium | 6.5 | — | — | 2026-10-13 | 2026-10-16 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.