October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,457
Critical
1,337
High
5,864
Medium
6,249
Low
648
Severity not reported
3,359
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1307), google (756), oracle (156), ibm (140), adobe (138), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-102157 An insecure direct object reference (IDOR) vulnerability in a CloudVision CUE fi... |
medium | 5.9 | — | — | 2026-10-06 | 2026-10-07 |
| CVE-2026-102158 Improper validation of selected CloudVision CUE application programming interfac... |
medium | 6.5 | — | — | 2026-10-06 | 2026-10-07 |
| CVE-2026-101151 Insufficient validation of request in login flow could allow a remote, unauthent... |
medium | 4.3 | — | — | 2026-10-06 | 2026-10-07 |
| CVE-2026-101029 Gitea's repository migration and pull mirror egress checks could be bypassed wit... |
medium | 4.3 | — | Gitea / gitea | 2026-10-06 | 2026-10-15 |
| CVE-2026-101149 Insufficient validation of OIDC SSO provider configuration could allow a user wi... |
medium | 4.1 | — | — | 2026-10-06 | 2026-10-07 |
| CVE-2026-101150 Insufficient validation of OIDC bearer token configuration could allow a user wi... |
medium | 4.1 | — | — | 2026-10-06 | 2026-10-07 |
| CVE-2026-9226 Authentication bypass in the Azure AD external login flow in Devolutions Server... |
medium | 6.8 | — | — | 2026-10-06 | 2026-10-07 |
| CVE-2026-56936 In wacom_hid_set_device_mode of wacom_sys.c, there is a possible out-of-bounds w... |
medium | 6.8 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-56952 In platform_msg_handler_init of default_msg_handlers.c, there is a possible perm... |
medium | 6.7 | — | — | 2026-10-06 | 2026-10-07 |
| CVE-2026-70414 Dell Command | Configure (DCC), versions prior to 5.2.3.35, contain a Plaintext... |
medium | 5.5 | — | Dell / command\|configure | 2026-10-06 | 2026-10-13 |
| CVE-2026-55307 In kdn_set_sysregs_prot of hwcrypto-kdn.c, there is a possible information discl... |
medium | 4.4 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-106422 Incorrect authorization in API in Google Chrome prior to 155.0.8059.39 allowed a... |
medium | 4.3 | — | Google / chrome | 2026-10-06 | 2026-10-09 |
| CVE-2026-106424 Information leak in Audio in Google Chrome prior to 155.0.8059.39 allowed a remo... |
medium | 4.0 | — | Google / chrome | 2026-10-06 | 2026-10-08 |
| CVE-2026-106425 Missing authorization in BrowserTag in Google Chrome prior to 155.0.8059.39 allo... |
medium | 4.2 | — | Google / chrome | 2026-10-06 | 2026-10-13 |
| CVE-2026-106427 Confused deputy in Mobile in Google Chrome on on iOS prior to 155.0.8059.39 allo... |
medium | 5.4 | — | Google / chrome | 2026-10-06 | 2026-10-08 |
| CVE-2026-106415 Information leak in Enterprise in Google Chrome prior to 155.0.8059.39 allowed a... |
medium | 4.3 | — | Google / chrome | 2026-10-06 | 2026-10-07 |
| CVE-2026-106416 Code injection in Extensions in Google Chrome prior to 155.0.8059.39 allowed a r... |
medium | 5.4 | — | Google / chrome | 2026-10-06 | 2026-10-07 |
| CVE-2026-106418 Missing authorization in Network in Google Chrome prior to 155.0.8059.39 allowed... |
medium | 6.5 | — | Google / chrome | 2026-10-06 | 2026-10-13 |
| CVE-2026-106420 Incorrect calculation in API in Google Chrome on on Windows prior to 155.0.8059.... |
medium | 5.4 | — | Google / chrome | 2026-10-06 | 2026-10-07 |
| CVE-2026-106405 Race condition in CustomTabs in Google Chrome on on Android prior to 155.0.8059.... |
medium | 6.0 | — | Google / chrome | 2026-10-06 | 2026-10-09 |
| CVE-2026-106406 Missing authorization in Mobile in Google Chrome on on iOS prior to 155.0.8059.3... |
medium | 5.4 | — | Google / chrome | 2026-10-06 | 2026-10-07 |
| CVE-2026-106407 Incorrect authorization in GetUserMedia in Google Chrome prior to 155.0.8059.39... |
medium | 6.5 | — | Google / chrome | 2026-10-06 | 2026-10-09 |
| CVE-2026-106408 Protection mechanism failure in Mobile in Google Chrome on on iOS prior to 155.0... |
medium | 6.5 | — | Google / chrome | 2026-10-06 | 2026-10-09 |
| CVE-2026-106410 Missing authorization in Permissions in Google Chrome prior to 155.0.8059.39 all... |
medium | 4.2 | — | Google / chrome | 2026-10-06 | 2026-10-07 |
| CVE-2026-106413 Race condition in Browser in Google Chrome prior to 155.0.8059.39 allowed a remo... |
medium | 4.2 | — | Google / chrome | 2026-10-06 | 2026-10-07 |
| CVE-2026-106396 Improper input validation in Omnibox in Google Chrome on on Android prior to 155... |
medium | 5.4 | — | Google / chrome | 2026-10-06 | 2026-10-15 |
| CVE-2026-106397 Incorrect authorization in Mobile in Google Chrome on on iOS prior to 155.0.8059... |
medium | 6.1 | — | Google / chrome | 2026-10-06 | 2026-10-09 |
| CVE-2026-106398 Incorrect authorization in Media in Google Chrome prior to 155.0.8059.39 allowed... |
medium | 4.3 | — | Google / chrome | 2026-10-06 | 2026-10-07 |
| CVE-2026-106400 Clickjacking in Messages in Google Chrome on on Android prior to 155.0.8059.39 a... |
medium | 5.4 | — | Google / chrome | 2026-10-06 | 2026-10-07 |
| CVE-2026-106402 Incorrect authorization in Extensions in Google Chrome prior to 155.0.8059.39 al... |
medium | 4.8 | — | Google / chrome | 2026-10-06 | 2026-10-07 |
| CVE-2026-106404 Incorrect authorization in FontAccess in Google Chrome prior to 155.0.8059.39 al... |
medium | 6.5 | — | Google / chrome | 2026-10-06 | 2026-10-09 |
| CVE-2026-106388 Missing authorization in DataTransfer in Google Chrome prior to 155.0.8059.39 al... |
medium | 5.3 | — | Google / chrome | 2026-10-06 | 2026-10-07 |
| CVE-2026-106389 Incorrect authorization in USB in Google Chrome prior to 155.0.8059.39 allowed a... |
medium | 6.5 | — | Google / chrome | 2026-10-06 | 2026-10-09 |
| CVE-2026-106390 Incorrect provision of specified functionality in SanitizerAPI in Google Chrome... |
medium | 4.3 | — | Google / chrome | 2026-10-06 | 2026-10-07 |
| CVE-2026-106391 Incorrect authorization in WebShare in Google Chrome on on Android prior to 155.... |
medium | 4.2 | — | Google / chrome | 2026-10-06 | 2026-10-07 |
| CVE-2026-106392 Information leak in WebAudio in Google Chrome prior to 155.0.8059.39 allowed a r... |
medium | 4.3 | — | Google / chrome | 2026-10-06 | 2026-10-07 |
| CVE-2026-106394 Incomplete cleanup in Glic in Google Chrome prior to 155.0.8059.39 allowed a rem... |
medium | 4.3 | — | Google / chrome | 2026-10-06 | 2026-10-07 |
| CVE-2026-106395 Uninitialized resource in Dawn in Google Chrome on on Android prior to 155.0.805... |
medium | 4.7 | — | Google / chrome | 2026-10-06 | 2026-10-08 |
| CVE-2026-106379 Uninitialized resource in Skia in Google Chrome prior to 155.0.8059.39 allowed a... |
medium | 4.3 | — | Google / chrome | 2026-10-06 | 2026-10-07 |
| CVE-2026-106380 UI misrepresentation in UI in Google Chrome prior to 155.0.8059.39 allowed a rem... |
medium | 5.4 | — | Google / chrome | 2026-10-06 | 2026-10-07 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.