October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
21,899
Critical
3,119
High
7,046
Medium
6,890
Low
606
Severity not reported
4,238
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (722), google (413), ibm (321), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-70031 Heap-based buffer overflow in Windows iSCSI allows an unauthorized attacker to d... |
high | 7.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-70027 Heap-based buffer overflow in Windows Subsystem for Linux allows an authorized a... |
high | 7.8 | — | Microsoft / windows 10 21h2 | 2026-10-13 | 2026-10-16 |
| CVE-2026-70026 Use after free in Windows Secure Kernel Mode allows an authorized attacker to el... |
high | 7.0 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-16 |
| CVE-2026-70015 Use after free in Windows Local Security Authority Subsystem Service (LSASS) all... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-70014 Use after free in Windows Cryptographic Services allows an authorized attacker t... |
high | 7.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-69959 Out-of-bounds read in Windows Overlay Filter allows an authorized attacker to ex... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-85371 Use after free in Network Policy Server (NPS) allows an unauthorized attacker to... |
high | 8.1 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-69957 Integer overflow or wraparound in Windows Overlay Filter allows an authorized at... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-85365 Heap-based buffer overflow in Servicing Stack Updates allows an authorized attac... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-69952 Out-of-bounds read in Windows Overlay Filter allows an authorized attacker to el... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-69953 Buffer over-read in Windows Overlay Filter allows an authorized attacker to elev... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-96919 Use after free in Windows Broadcast DVR User Service allows an authorized attack... |
high | 7.0 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-16 |
| CVE-2026-96918 Improper access control in Windows NTFS allows an authorized attacker to elevate... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-96917 Heap-based buffer overflow in Windows PCI Bus Driver allows an authorized attack... |
high | 8.8 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-16 |
| CVE-2026-69950 Buffer over-read in Windows Overlay Filter allows an authorized attacker to elev... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-69949 Heap-based buffer overflow in Windows Client for NFS allows an authorized attack... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-109358 Edgeless Systems Contrast 1.8.0 before 1.24.1 contains an incorrect permissions... |
high | 7.8 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-110618 SmsForwarder through 3.5.0 contains a missing authentication vulnerability in it... |
high | 8.1 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-110648 @offactory/compress-fonts before 1.1.1 contains an OS command injection vulnerab... |
high | 7.8 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-69945 Missing authorization in Windows AppX Deployment Extensions allows an authorized... |
high | 8.8 | — | Microsoft / windows 10 21h2 | 2026-10-13 | 2026-10-16 |
| CVE-2026-96916 Heap-based buffer overflow in Windows NTFS allows an authorized attacker to elev... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-85372 Use after free in Windows Kernel allows an authorized attacker to elevate privil... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-85373 Heap-based buffer overflow in Windows Universal Plug and Play (UPnP) Device Host... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-85375 Use after free in Windows Universal Plug and Play (UPnP) Device Host allows an a... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-85376 Weak authentication in Windows Print Spooler Components allows an authorized att... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-85377 Access of resource using incompatible type ('type confusion') in Windows CD-ROM... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-85791 Heap-based buffer overflow in Windows Encrypting File System (EFS) allows an aut... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-109391 Square Squash through commit e73f280 contains an insecure deserialization vulner... |
high | 8.1 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-109394 Thirty bees through 1.7.0 contains an authentication bypass vulnerability in Pas... |
high | 7.4 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-109359 Contrast 1.8.0 before 1.24.1 contains an improper verification vulnerability in... |
high | 7.7 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-109423 NetEase Cloud Music client for Windows (cloudmusic.exe) versions 3.1.38 and 3.1.... |
high | 7.4 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-109557 EdgeEver through 1.112.0 contains a stored cross-site scripting vulnerability in... |
high | 8.7 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-109559 EdgeEver Desktop 1.6.26 through 1.112.0 contains a navigation allowlist bypass t... |
high | 8.7 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-109567 Rapyd Admin from 9.0.0 before 9.20.0 contains an improper privilege management v... |
high | 7.2 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-109569 sandboxed.sh through 1.3.0 contains a container escape vulnerability that allows... |
high | 8.8 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-53997 Netherman Portal del Hermano (portaldelhermano.es) before 2026-10-06 contains a... |
high | 7.4 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-35001 OpenS100 through commit 2b1dafc contains an integer overflow vulnerability in th... |
high | 7.0 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-110864 Better Auth from 1.5.0-beta.12 before 1.7.7 contains an authentication bypass vu... |
high | 7.4 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-0993 SODOLA SL902-SWTGW124AS firmware before 200.2.12 contains a buffer overflow vuln... |
high | 7.5 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-111356 MacCMS v10 through 2026.1000.4056 does not limit attempts on the six-digit passw... |
high | 7.4 | — | — | 2026-10-15 | 2026-10-16 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.