October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,254
Critical
1,318
High
5,767
Medium
6,150
Low
636
Severity not reported
3,383
In CISA KEV
19
Most affected vendors (by CPE data where available): microsoft (1303), google (745), oracle (156), ibm (140), adobe (129), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-117916 Use-after-free in the XSLT component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117917 Invalid pointer in the Graphics: WebRender component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117918 Use-after-free in the Graphics: Canvas2D component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117919 Use-after-free in the DOM: Core & HTML component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117920 Use-after-free in the DOM: HTML Parser component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117921 Use-after-free in the CSS Parsing and Computation component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117922 Use-after-free in the Networking: WebSockets component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117923 Use-after-free in the Audio/Video component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117906 Use-after-free in the CSS Parsing and Computation component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117907 Use-after-free in the Networking component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117908 Use-after-free in the Graphics: ImageLib component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117909 Use-after-free in the JavaScript: GC component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117910 Invalid pointer in the JavaScript Engine component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117911 Use-after-free in the Audio/Video: Playback component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117912 Same-origin policy bypass in the CSS Parsing and Computation component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117913 Use-after-free in the SVG component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117914 Use-after-free in the SVG component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117915 Incorrect boundary conditions in the Layout: Block and Inline component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117896 Use-after-free in the DOM: Core & HTML component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117897 Incorrect boundary conditions in the Layout: Tables component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117898 Use-after-free in the JavaScript Engine: JIT component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117899 Use-after-free in the Networking: HTTP component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117900 Use-after-free in the DOM: Editor component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117901 Use-after-free in the DOM: Core & HTML component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117902 Use-after-free in the Layout: Text and Fonts component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117903 Use-after-free in the Audio/Video component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117904 Use-after-free in the JavaScript: GC component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117905 Use-after-free in the Audio/Video: Playback component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117887 Use-after-free in the DOM: Core & HTML component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117888 Uninitialized memory in the Graphics: Canvas2D component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117889 Incorrect boundary conditions in the JavaScript Engine component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117890 JIT miscompilation in the JavaScript Engine: JIT component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117891 Use-after-free in the JavaScript Engine: JIT component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117892 Privilege escalation due to use-after-free in the WebRTC: Networking component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117893 Incorrect boundary conditions in the Security: PSM component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117894 Incorrect boundary conditions in the WebRTC: Signaling component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117895 Use-after-free in the DOM: Core & HTML component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117877 Use-after-free in the Layout: Text and Fonts component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117878 Other issue, use-after-free in the Storage: IndexedDB component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117879 Incorrect boundary conditions in the Layout: Tables component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.