CVEs published in October 2026
17,265 vulnerabilities, 1,627 critical, 21 exploited.
- google chromeImproper input validation in Command in Google Chrome prior to 156.0.8078.73 allowed a remote...9.6 Critical
- google chromeMemory corruption in Cache in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to...8.8 High
- google chromeMemory corruption in Skia in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to...8.8 High
- google chromeImproper access control in Forms in Google Chrome prior to 156.0.8078.73 allowed a remote...9.3 Critical
- google chromeUse after free in Paint in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to...8.8 High
- google chromeImproper input validation in Skia in Google Chrome prior to 156.0.8078.73 allowed a remote...8.8 High
- google chromeMemory corruption in Skia in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to...9.6 Critical
- google chromeImproper input validation in ANGLE in Google Chrome on on Mac prior to 156.0.8078.73 allowed a...8.8 High
- google chromeImproper input validation in Core in Google Chrome on on Android prior to 156.0.8078.73 allowed a...9.6 Critical
- google chromeMemory corruption in ANGLE in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to...4.3 Medium
- google chromeMemory corruption in V8 in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to...8.8 High
- google chromeMemory corruption in HTML in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to...8.8 High
- google chromeMemory corruption in Turbolev in Google Chrome prior to 156.0.8078.73 allowed a remote attacker...9.6 Critical
- google chromeUse after free in FileSystem in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to...8.8 High
- google chromeUse after free in Turbolev in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to...8.8 High
- google chromeUse after free in Animation in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to...8.8 High
- google chromeImproper access control in V8 in Google Chrome prior to 156.0.8078.73 allowed a remote attacker...4.3 Medium
- google chromeImproper input validation in Skia in Google Chrome prior to 156.0.8078.73 allowed a remote...8.8 High
- google chromeUse after free in Layout in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to...8.8 High
- google chromeImproper input validation in FileAPI in Google Chrome prior to 156.0.8078.73 allowed a remote...8.8 High
- google chromeMemory corruption in FileSystem in Google Chrome prior to 156.0.8078.73 allowed a remote attacker...9.6 Critical
- w3c websubWebSub: Reflected script execution through intent-verification challenges5.7 Medium
- jeromedevome grrGRR vulnerable to Arbitrary File Read and Deletion7.2 High
- jeromedevome grrGRR vulnerable to Remote Code Execution Via PHP Code Injection9.1 Critical
- jhuckaby cronicleCronicle: Non-admin uid/gid injection in create_event/update_event → run-as-arbitrary-user (incl. root) — sibling of CVE-2026-394018.8 High
- jeromedevome grrGRR has a Reflected XSS issue8.1 High
- netapp e-series santricity os controller software, ontap 9, storagegrid (formerly storagegrid webscale) +2 moreCVE-2026-22063 eMudhra CA Certificate Compromise in NetApp Products6.0 Medium
- thorvgThorVG: Out-of-bounds Read in SFNT/TTF Font Loader via Memory API4.3 Medium
- a2aproject a2a-jsa2aproject a2a-js Task Status Update result_manager.ts ResultManager.applyStatusUpdate race condition6.9 Medium
- asterisk, asterisk certified-asterisk +1 moreAsterisk: Asterisk app_sms.c copies externally controlled SMS lengths into fixed in-struct buffers2.3 Low
- asterisk, asterisk certified-asterisk +1 moreAsterisk: Local privilege escalation through ast_loggrabber's world-writable helper location6.9 Medium
- asterisk, asterisk certified-asterisk +1 moreAsterisk: SQL Injection in cel_pgsql and cel_tds via CELGenUserEvent eventtype Field7.0 High
- microsoft edge (chromium-based), edge chromium +1 moreMicrosoft Edge (Chromium-based) Remote Code Execution Vulnerability7.5 High
- asterisk, asterisk certified-asterisk +1 moreAsterisk: Stack buffer overflow in MWI NOTIFY Message-Account parsing8.2 High
- asterisk, asterisk certified-asterisk +1 moreAsterisk: Out-of-Bounds Write in Codec2 Decoder Due to Floor/Ceil Sample Count Mismatch6.0 Medium
- asterisk, asterisk certified-asterisk +1 moreAsterisk: CVE-2022-37325 fix is absent from current chan_ooh323 Q.931 party-number parser7.5 High
- golang.org/x/net golang.org/x/net/htmlCheck all ancestor namespace transitions when rendering raw text in html in golang.org/x/net6.1 Medium
- golang.org/x/net golang.org/x/net/htmlAvoid quadratic complexity when coalescing text nodes in html in golang.org/x/net7.5 High
- asterisk, asterisk certified-asterisk +1 moreAsterisk: ARI REST-over-WebSocket read-only bypass allows arbitrary module path load and conditional RCE7.5 High
- asterisk, asterisk certified-asterisk +1 moreAsterisk: NULL Pointer Dereference in HTTP AMI Digest Authentication7.5 High
- microsoft edge (chromium-based), edge chromium +1 moreMicrosoft Edge (Chromium-based) Remote Code Execution Vulnerability8.8 High
- microsoft edge (chromium-based), edge chromium +1 moreMicrosoft Edge (Chromium-based) Remote Code Execution Vulnerability8.8 High
- eugeny russhpageant: unbounded frame buffering on peer-controlled 4-byte length prefix (memory-exhaustion DoS)2.3 Low
- eugeny russhrussh: peer-declared zero maximum packet size permanently stalls channel writes (silent AsyncWrite hang)4.3 Medium
- eugeny russhrussh's SSH client is susceptible to unbounded allocations via EXT_INFO packets4.3 Medium
- eugeny russhrussh's SSH agent server is susceptible to unbound allocations via repeated SSH_AGENT_CONSTRAIN_CONFIRM messages3.3 Low
- rgrove crassCrass: Incorrect tokenization of bad URLs enables CSS sanitizer bypass5.3 Medium
- open-telemetry opentelemetry-pythonOpenTelemetry Python: Unbounded memory allocation in Jaeger baggage propagation6.3 Medium
- datadog dd-trace-jsdd-trace: ReDOS in URL query string obfuscation8.7 High
- mlflowMLflow: Remote code execution on unauthenticated MLflow servers via third-party scorer deserialization importing caller-placed artifact modules9.8 Critical
- Show moreLoading…