October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,068
Critical
1,296
High
5,672
Medium
6,054
Low
636
Severity not reported
3,410
In CISA KEV
19
Most affected vendors (by CPE data where available): microsoft (1303), google (744), oracle (154), ibm (140), adobe (128), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-118356 Use after free in WTF in Google Chrome prior to 156.0.8078.73 allowed a remote a... |
high | 8.8 | — | Google / chrome | 2026-10-27 | 2026-10-29 |
| CVE-2026-118357 Use after free in FileSystem in Google Chrome prior to 156.0.8078.73 allowed a r... |
high | 8.8 | — | Google / chrome | 2026-10-27 | 2026-10-29 |
| CVE-2026-118341 Use after free in Modularization in Google Chrome prior to 156.0.8078.73 allowed... |
high | 8.8 | — | Google / chrome | 2026-10-27 | 2026-10-29 |
| CVE-2026-118343 Improper input validation in ReadingList in Google Chrome prior to 156.0.8078.73... |
high | 8.8 | — | Google / chrome | 2026-10-27 | 2026-10-29 |
| CVE-2026-118344 Use after free in Layout in Google Chrome prior to 156.0.8078.73 allowed a remot... |
high | 8.8 | — | Google / chrome | 2026-10-27 | 2026-10-29 |
| CVE-2026-118345 Use after free in PDFium in Google Chrome prior to 156.0.8078.73 allowed a remot... |
high | 8.8 | — | Google / chrome | 2026-10-27 | 2026-10-28 |
| CVE-2026-118346 Use after free in Compositing in Google Chrome prior to 156.0.8078.73 allowed a... |
high | 8.8 | — | Google / chrome | 2026-10-27 | 2026-10-29 |
| CVE-2026-118347 Use after free in FileSystem in Google Chrome prior to 156.0.8078.73 allowed a r... |
high | 8.8 | — | Google / chrome | 2026-10-27 | 2026-10-29 |
| CVE-2026-118348 Improper input validation in Skia in Google Chrome prior to 156.0.8078.73 allowe... |
high | 8.8 | — | Google / chrome | 2026-10-27 | 2026-10-29 |
| CVE-2026-118349 Memory corruption in Payments in Google Chrome prior to 156.0.8078.73 allowed a... |
high | 8.8 | — | Google / chrome | 2026-10-27 | 2026-10-29 |
| CVE-2026-118338 Use after free in Animation in Google Chrome prior to 156.0.8078.73 allowed a re... |
high | 8.8 | — | Google / chrome | 2026-10-27 | 2026-10-29 |
| CVE-2026-118339 Use after free in Animation in Google Chrome prior to 156.0.8078.73 allowed a re... |
high | 8.8 | — | Google / chrome | 2026-10-27 | 2026-10-29 |
| CVE-2026-118328 Improper input validation in WebRTC in Google Chrome prior to 156.0.8078.73 allo... |
high | 8.8 | — | Google / chrome | 2026-10-27 | 2026-10-29 |
| CVE-2026-118329 Improper input validation in ANGLE in Google Chrome on on Mac prior to 156.0.807... |
high | 8.8 | — | Google / chrome | 2026-10-27 | 2026-10-29 |
| CVE-2026-118330 Use after free in Browser in Google Chrome on on Windows prior to 156.0.8078.73... |
high | 8.8 | — | Google / chrome | 2026-10-27 | 2026-10-29 |
| CVE-2026-118331 Improper input validation in FileAPI in Google Chrome prior to 156.0.8078.73 all... |
high | 8.8 | — | Google / chrome | 2026-10-27 | 2026-10-29 |
| CVE-2026-118334 Use after free in ImageCapture in Google Chrome prior to 156.0.8078.73 allowed a... |
high | 8.8 | — | Google / chrome | 2026-10-27 | 2026-10-29 |
| CVE-2026-118335 Improper input validation in Metrics in Google Chrome on on Mac prior to 156.0.8... |
high | 8.8 | — | — | 2026-10-27 | 2026-10-29 |
| CVE-2026-118336 Improper input validation in Headless in Google Chrome prior to 156.0.8078.73 al... |
high | 8.8 | — | Google / chrome | 2026-10-27 | 2026-10-29 |
| CVE-2026-118315 Improper input validation in SVG in Google Chrome prior to 156.0.8078.73 allowed... |
high | 8.8 | — | Google / chrome | 2026-10-27 | 2026-10-29 |
| CVE-2026-118317 Memory corruption in HTML in Google Chrome prior to 156.0.8078.73 allowed a remo... |
high | 8.8 | — | Google / chrome | 2026-10-27 | 2026-10-29 |
| CVE-2026-118320 Memory corruption in V8 in Google Chrome prior to 156.0.8078.73 allowed a remote... |
high | 8.8 | — | Google / chrome | 2026-10-27 | 2026-10-29 |
| CVE-2026-118327 Memory corruption in Media in Google Chrome prior to 156.0.8078.73 allowed a rem... |
high | 8.8 | — | Google / chrome | 2026-10-27 | 2026-10-29 |
| CVE-2026-118307 Use after free in Paint in Google Chrome prior to 156.0.8078.73 allowed a remote... |
high | 8.8 | — | Google / chrome | 2026-10-27 | 2026-10-29 |
| CVE-2026-118311 Memory corruption in Media in Google Chrome prior to 156.0.8078.73 allowed a rem... |
high | 8.8 | — | Google / chrome | 2026-10-27 | 2026-10-29 |
| CVE-2026-118313 Use after free in Video in Google Chrome prior to 156.0.8078.73 allowed a remote... |
high | 8.8 | — | Google / chrome | 2026-10-27 | 2026-10-29 |
| CVE-2026-118314 Improper input validation in UI in Google Chrome on on Android prior to 156.0.80... |
high | 8.8 | — | Google / chrome | 2026-10-27 | 2026-10-29 |
| CVE-2026-118304 Improper input validation in SVG in Google Chrome prior to 156.0.8078.73 allowed... |
high | 8.8 | — | Google / chrome | 2026-10-27 | 2026-10-29 |
| CVE-2026-62765 Access of resource using incompatible type ('type confusion') in Microsoft Edge... |
high | 7.5 | — | — | 2026-10-27 | 2026-10-30 |
| CVE-2026-57186 Asterisk is an open source private branch exchange and telephony toolkit. |
high | 7.5 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-85898 Access of resource using incompatible type ('type confusion') in Microsoft Edge... |
high | 8.8 | — | — | 2026-10-27 | 2026-10-29 |
| CVE-2026-83831 Double free in Microsoft Edge (Chromium-based) allows an unauthorized attacker t... |
high | 8.8 | — | — | 2026-10-27 | 2026-10-29 |
| CVE-2026-57195 Asterisk is an open source private branch exchange and telephony toolkit. |
high | 7.5 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-57200 Asterisk is an open source private branch exchange and telephony toolkit. |
high | 7.5 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-116688 CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture. |
high | 8.1 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-116690 MLflow is an open source AI engineering platform for agents, large language mode... |
high | 7.5 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-112355 The MembershipWorks plugin for WordPress before 6.17 contains an information dis... |
high | 7.5 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-112350 Sunhillo SureLine before 9.1.5 contains a path traversal vulnerability in the ra... |
high | 7.5 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-112351 Sunhillo SureLine before 9.1.5 contains an OS command injection vulnerability in... |
high | 8.8 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-115413 Missing token audience validation in the OAuth authentication mode of AWS API MC... |
high | 7.8 | — | — | 2026-10-27 | 2026-10-28 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.