October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,254
Critical
1,318
High
5,767
Medium
6,150
Low
636
Severity not reported
3,383
In CISA KEV
19
Most affected vendors (by CPE data where available): microsoft (1303), google (745), oracle (156), ibm (140), adobe (129), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-117961 Incorrect boundary conditions in the Layout: Text and Fonts component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117962 Sandbox escape due to incorrect boundary conditions in the Storage: Quota Manage... |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117963 Incorrect boundary conditions in the DOM: Service Workers component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117964 Use-after-free in the Panning and Zooming component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117951 Use-after-free in the DOM: Core & HTML component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117952 Uninitialized memory in the Networking component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117953 Use-after-free in the DOM: Core & HTML component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117954 Use-after-free in the Layout: Positioned component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117955 JIT miscompilation in the JavaScript: WebAssembly component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117956 Invalid pointer in the Nimbus Desktop Client component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117957 Cryptographic issue in the WebRTC: Networking component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117958 Site isolation issue in the Networking: HTTP component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117959 Site isolation issue in the DOM: Service Workers component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117944 Use-after-free in the Layout component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117945 Incorrect boundary conditions in the XML component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117946 Incorrect boundary conditions in the JavaScript Engine component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117947 Use-after-free in the XML component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117948 Use-after-free in the SVG component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117949 Use-after-free in the DOM: Core & HTML component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117950 Incorrect boundary conditions in the DOM: Core & HTML component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117934 Use-after-free in the Layout component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117935 Use-after-free in the DOM: Bindings (WebIDL) component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117936 Use-after-free in the DOM: Core & HTML component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117937 Invalid pointer in the JavaScript Engine component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117938 Use-after-free in the Layout component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117939 Use-after-free in the XML component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117940 Use-after-free in the DOM: Core & HTML component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117941 Use-after-free in the DOM: CSS Object Model component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117942 Incorrect boundary conditions in the JavaScript Engine: JIT component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117943 Use-after-free in the DOM: Core & HTML component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117924 Use-after-free in the XSLT component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117925 Use-after-free in the DOM: Core & HTML component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117926 Incorrect boundary conditions in the SVG component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117927 Use-after-free in the SVG component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117928 Same-origin policy bypass in the CSS Parsing and Computation component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117929 Use-after-free in the DOM: Core & HTML component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117930 Use-after-free in the DOM: Bindings (WebIDL) component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117931 Use-after-free in the DOM: Events component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117932 Use-after-free in the DOM: Core & HTML component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117933 Frame poisoning in the CSS Parsing and Computation component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.