October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,016
Critical
1,287
High
5,651
Medium
6,028
Low
636
Severity not reported
3,414
In CISA KEV
19
Most affected vendors (by CPE data where available): microsoft (1303), google (735), oracle (150), ibm (140), adobe (128), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-117607 Xerte Online Toolkits through 3.15.5 contains a remote code execution vulnerabil... |
high | 7.2 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-117609 rtl_433 through 25.12 contains a stack-based buffer overflow vulnerability in pr... |
high | 7.1 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-109999 The AI Marketing Expert — AI Email Marketing, AI Content Generator, SEO Analyzer... |
high | 7.2 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-111314 The affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display plugin... |
high | 7.2 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2014-125138 C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, and Cart Engin... |
high | 8.8 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2015-20129 CrushFTP before 7.3.0 contains a cross-site request forgery vulnerability that a... |
high | 8.8 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2013-20007 Linksys WAG200G through 1.01.06 contains an OS command injection vulnerability t... |
high | 7.2 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-110747 ProtobufParser._readStringKey() reads the length prefix of a protobuf map entry'... |
high | 7.5 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-104895 The asynchronous Smile parser (NonBlockingByteArrayParser) uses a raw-binary len... |
high | 7.5 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-104016 ProtobufParser parses length-prefixed protobuf string and bytes fields by checki... |
high | 7.5 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-58257 GRR is a resource management and reservation application. |
high | 7.2 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-59158 Nuxt Ollama integrates the official Ollama JavaScript library into Nuxt applicat... |
high | 7.5 | — | — | 2026-10-27 | 2026-10-29 |
| CVE-2026-118358 Memory corruption in WebAudio in Google Chrome prior to 156.0.8078.73 allowed a... |
high | 8.8 | — | Google / chrome | 2026-10-27 | 2026-10-29 |
| CVE-2026-118359 Memory corruption in V8 in Google Chrome prior to 156.0.8078.73 allowed a remote... |
high | 8.8 | — | Google / chrome | 2026-10-27 | 2026-10-29 |
| CVE-2026-58205 GRR is a resource management and reservation application. |
high | 8.1 | — | — | 2026-10-27 | 2026-10-29 |
| CVE-2026-58255 Cronicle is a multi-server task scheduler and runner, with a web based front-end... |
high | 8.8 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-118350 Use after free in Turbolev in Google Chrome prior to 156.0.8078.73 allowed a rem... |
high | 8.8 | — | Google / chrome | 2026-10-27 | 2026-10-29 |
| CVE-2026-118351 Memory corruption in Skia in Google Chrome prior to 156.0.8078.73 allowed a remo... |
high | 8.8 | — | Google / chrome | 2026-10-27 | 2026-10-29 |
| CVE-2026-118352 Memory corruption in Cache in Google Chrome prior to 156.0.8078.73 allowed a rem... |
high | 8.8 | — | Google / chrome | 2026-10-27 | 2026-10-29 |
| CVE-2026-118353 Use after free in Paint in Google Chrome prior to 156.0.8078.73 allowed a remote... |
high | 8.8 | — | Google / chrome | 2026-10-27 | 2026-10-29 |
| CVE-2026-118354 Improper input validation in Skia in Google Chrome prior to 156.0.8078.73 allowe... |
high | 8.8 | — | Google / chrome | 2026-10-27 | 2026-10-29 |
| CVE-2026-118356 Use after free in WTF in Google Chrome prior to 156.0.8078.73 allowed a remote a... |
high | 8.8 | — | Google / chrome | 2026-10-27 | 2026-10-29 |
| CVE-2026-118357 Use after free in FileSystem in Google Chrome prior to 156.0.8078.73 allowed a r... |
high | 8.8 | — | Google / chrome | 2026-10-27 | 2026-10-29 |
| CVE-2026-118341 Use after free in Modularization in Google Chrome prior to 156.0.8078.73 allowed... |
high | 8.8 | — | Google / chrome | 2026-10-27 | 2026-10-29 |
| CVE-2026-118343 Improper input validation in ReadingList in Google Chrome prior to 156.0.8078.73... |
high | 8.8 | — | Google / chrome | 2026-10-27 | 2026-10-29 |
| CVE-2026-118344 Use after free in Layout in Google Chrome prior to 156.0.8078.73 allowed a remot... |
high | 8.8 | — | Google / chrome | 2026-10-27 | 2026-10-29 |
| CVE-2026-118345 Use after free in PDFium in Google Chrome prior to 156.0.8078.73 allowed a remot... |
high | 8.8 | — | Google / chrome | 2026-10-27 | 2026-10-28 |
| CVE-2026-118346 Use after free in Compositing in Google Chrome prior to 156.0.8078.73 allowed a... |
high | 8.8 | — | Google / chrome | 2026-10-27 | 2026-10-29 |
| CVE-2026-118347 Use after free in FileSystem in Google Chrome prior to 156.0.8078.73 allowed a r... |
high | 8.8 | — | Google / chrome | 2026-10-27 | 2026-10-29 |
| CVE-2026-118348 Improper input validation in Skia in Google Chrome prior to 156.0.8078.73 allowe... |
high | 8.8 | — | Google / chrome | 2026-10-27 | 2026-10-29 |
| CVE-2026-118349 Memory corruption in Payments in Google Chrome prior to 156.0.8078.73 allowed a... |
high | 8.8 | — | Google / chrome | 2026-10-27 | 2026-10-29 |
| CVE-2026-118338 Use after free in Animation in Google Chrome prior to 156.0.8078.73 allowed a re... |
high | 8.8 | — | Google / chrome | 2026-10-27 | 2026-10-29 |
| CVE-2026-118339 Use after free in Animation in Google Chrome prior to 156.0.8078.73 allowed a re... |
high | 8.8 | — | Google / chrome | 2026-10-27 | 2026-10-29 |
| CVE-2026-118328 Improper input validation in WebRTC in Google Chrome prior to 156.0.8078.73 allo... |
high | 8.8 | — | Google / chrome | 2026-10-27 | 2026-10-29 |
| CVE-2026-118329 Improper input validation in ANGLE in Google Chrome on on Mac prior to 156.0.807... |
high | 8.8 | — | Google / chrome | 2026-10-27 | 2026-10-29 |
| CVE-2026-118330 Use after free in Browser in Google Chrome on on Windows prior to 156.0.8078.73... |
high | 8.8 | — | Google / chrome | 2026-10-27 | 2026-10-29 |
| CVE-2026-118331 Improper input validation in FileAPI in Google Chrome prior to 156.0.8078.73 all... |
high | 8.8 | — | Google / chrome | 2026-10-27 | 2026-10-29 |
| CVE-2026-118334 Use after free in ImageCapture in Google Chrome prior to 156.0.8078.73 allowed a... |
high | 8.8 | — | Google / chrome | 2026-10-27 | 2026-10-29 |
| CVE-2026-118335 Improper input validation in Metrics in Google Chrome on on Mac prior to 156.0.8... |
high | 8.8 | — | — | 2026-10-27 | 2026-10-29 |
| CVE-2026-118336 Improper input validation in Headless in Google Chrome prior to 156.0.8078.73 al... |
high | 8.8 | — | Google / chrome | 2026-10-27 | 2026-10-29 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.