October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,254
Critical
1,318
High
5,767
Medium
6,150
Low
636
Severity not reported
3,383
In CISA KEV
19
Most affected vendors (by CPE data where available): microsoft (1303), google (745), oracle (156), ibm (140), adobe (129), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-118010 Use-after-free in the Disability Access APIs component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-118011 Frame poisoning in the CSS Parsing and Computation component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117991 Incorrect boundary conditions in the Layout: Text and Fonts component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117992 Information disclosure in the CSS Parsing and Computation component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117993 Integer overflow in the Graphics: Text component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117994 Use-after-free in the JavaScript: GC component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117995 Privilege escalation in the DOM: UI Events & Focus Handling component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117996 Incorrect boundary conditions in the WebRTC component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117997 Sandbox escape due to use-after-free in the Widget component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117998 Mitigation bypass in the DOM: Push Subscriptions component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117999 Race condition in the IPC component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-118000 Information disclosure in the Networking: HTTP component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-118002 Information disclosure due to race condition in the Networking component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117981 Privilege escalation in the Toolkit component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117982 Invalid pointer in the JavaScript Engine: JIT component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117983 Use-after-free in the Graphics component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117984 Incorrect boundary conditions in the Layout: Scrolling and Overflow component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117985 Sandbox escape due to use-after-free in the Graphics component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117986 Use-after-free in the Graphics component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117987 Use-after-free in the Graphics component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117988 Sandbox escape due to incorrect boundary conditions in the Graphics: CanvasWebGL... |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117989 Use-after-free in the Graphics component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117990 Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender c... |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117971 Sandbox escape due to use-after-free in the Print Preview component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117972 Use-after-free in the Graphics component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117973 Use-after-free in the Networking: DNS component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117974 Use-after-free in the XML component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117975 Sandbox escape due to invalid pointer in the Graphics: WebRender component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117976 Site isolation issue in the DOM: Navigation component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117977 Other issue in the Console component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117978 Incorrect boundary conditions in the Graphics component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117979 Incorrect boundary conditions in the Graphics: WebRender component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117980 Use-after-free in the Graphics component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117965 Same-origin policy bypass in the Address Bar component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117966 Site isolation issue in the Networking: HTTP component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117967 Mitigation bypass in the DOM: Security component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117968 Use-after-free in the DOM: Core & HTML component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117969 Invalid pointer in the JavaScript Engine: JIT component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117970 Race condition in the Disability Access APIs component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117960 Spoofing issue in the DOM: Core & HTML component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.