October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
21,937
Critical
3,121
High
7,064
Medium
6,901
Low
608
Severity not reported
4,243
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (722), google (413), ibm (321), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-105013 Deserialization of untrusted data in Microsoft Office SharePoint allows an autho... |
high | 7.4 | — | Microsoft / sharepoint server | 2026-10-13 | 2026-10-14 |
| CVE-2026-102866 Improper verification of cryptographic signature in Microsoft Office SharePoint... |
high | 8.1 | — | Microsoft / sharepoint server | 2026-10-13 | 2026-10-14 |
| CVE-2026-70267 Inclusion of functionality from untrusted control sphere in Microsoft Office Sha... |
high | 7.2 | — | Microsoft / sharepoint server | 2026-10-13 | 2026-10-14 |
| CVE-2026-70266 Improper neutralization of special elements used in an sql command ('sql injecti... |
high | 8.8 | — | Microsoft / sharepoint server | 2026-10-13 | 2026-10-14 |
| CVE-2026-70251 Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an auth... |
high | 7.5 | — | Microsoft / sharepoint server | 2026-10-13 | 2026-10-14 |
| CVE-2026-70246 Incorrect authorization in Microsoft Office SharePoint allows an authorized atta... |
high | 8.8 | — | Microsoft / sharepoint server | 2026-10-13 | 2026-10-14 |
| CVE-2026-70202 Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an auth... |
high | 7.5 | — | Microsoft / sharepoint server | 2026-10-13 | 2026-10-14 |
| CVE-2026-88166 Integer overflow or wraparound in Microsoft Office SharePoint allows an authoriz... |
high | 8.8 | — | Microsoft / sharepoint server | 2026-10-13 | 2026-10-14 |
| CVE-2026-88163 Integer overflow or wraparound in Microsoft Office SharePoint allows an authoriz... |
high | 8.8 | — | Microsoft / sharepoint server | 2026-10-13 | 2026-10-14 |
| CVE-2026-88155 Heap-based buffer overflow in Microsoft Office SharePoint allows an authorized a... |
high | 8.8 | — | Microsoft / sharepoint server | 2026-10-13 | 2026-10-14 |
| CVE-2026-85900 Deserialization of untrusted data in Microsoft Office SharePoint allows an autho... |
high | 8.8 | — | Microsoft / sharepoint server | 2026-10-13 | 2026-10-14 |
| CVE-2026-88206 Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an auth... |
high | 7.5 | — | Microsoft / sharepoint server | 2026-10-13 | 2026-10-14 |
| CVE-2026-88200 Privilege context switching error in Microsoft Office SharePoint allows an autho... |
high | 8.8 | — | Microsoft / sharepoint server | 2026-10-13 | 2026-10-14 |
| CVE-2026-88198 Missing authorization in Microsoft Office SharePoint allows an authorized attack... |
high | 8.8 | — | Microsoft / sharepoint server | 2026-10-13 | 2026-10-14 |
| CVE-2026-62906 Improper neutralization of special elements in data query logic in Microsoft Dis... |
high | 7.4 | — | Microsoft / discovery studio | 2026-09-03 | 2026-10-14 |
| CVE-2026-97009 Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized atta... |
high | 7.8 | — | Microsoft / 365 apps | 2026-10-13 | 2026-10-14 |
| CVE-2026-78446 Use after free in Windows Distributed File System (DFS) allows an authorized att... |
high | 7.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-10-07 |
| CVE-2026-69436 Heap-based buffer overflow in Windows State Repository Service allows an authori... |
high | 7.8 | — | Microsoft / windows 10 1809 | 2026-09-08 | 2026-10-07 |
| CVE-2026-65772 Deserialization of untrusted data in Microsoft Dynamics 365 allows an authorized... |
high | 8.8 | — | Microsoft / dynamics 365 | 2026-09-08 | 2026-10-07 |
| CVE-2026-57099 Allocation of resources without limits or throttling in ASP.NET Core allows an u... |
high | 7.5 | — | Microsoft / asp.net core odata | 2026-09-08 | 2026-10-05 |
| CVE-2026-55007 Double free in Microsoft Exchange Server allows an unauthorized attacker to exec... |
high | 8.1 | — | Microsoft / exchange server | 2026-09-08 | 2026-10-05 |
| CVE-2026-47297 Deserialization of untrusted data in SQL Server allows an unauthorized attacker... |
high | 8.1 | — | Microsoft / sql server 2019 | 2026-09-08 | 2026-10-02 |
| CVE-2026-58600 Heap-based buffer overflow in Microsoft Windows Codecs Library allows an unautho... |
high | 7.8 | — | Microsoft / hevc video extensions | 2026-09-08 | 2026-10-01 |
| CVE-2026-58599 Heap-based buffer overflow in Microsoft Windows Codecs Library allows an unautho... |
high | 7.8 | — | Microsoft / hevc video extensions | 2026-09-08 | 2026-10-01 |
| CVE-2026-69594 Heap-based buffer overflow in Microsoft Local Security Authority Server (lsasrv)... |
high | 7.8 | — | Microsoft / windows 11 24h2 | 2026-09-08 | 2026-10-01 |
| CVE-2026-69549 Out-of-bounds read in Virtual Hard Disk (VHD) Miniport Driver allows an authoriz... |
high | 7.0 | — | Microsoft / windows 10 1809 | 2026-09-08 | 2026-10-01 |
| CVE-2026-69546 Use after free in Active Directory Domain Services allows an unauthorized attack... |
high | 8.1 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-10-01 |
| CVE-2026-69541 Heap-based buffer overflow in Virtual Hard Disk (VHD) Miniport Driver allows an... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-10-01 |
| CVE-2026-69524 Use after free in Active Directory Domain Services allows an unauthorized attack... |
high | 8.1 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-10-01 |
| CVE-2026-70211 Out-of-bounds read in Windows Win32 Kernel Subsystem allows an authorized attack... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-31 |
| CVE-2026-85330 Incorrect authorization in Microsoft Edge for Android allows an unauthorized att... |
medium | 4.3 | — | Microsoft / edge | 2026-10-29 | 2026-10-31 |
| CVE-2026-88137 Files or directories accessible to external parties in WebDAV allows an authoriz... |
medium | 6.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-31 |
| CVE-2026-88158 Out-of-bounds read in Microsoft Digest Authentication allows an authorized attac... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-31 |
| CVE-2026-77911 Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to d... |
medium | 6.5 | — | Microsoft / 365 apps | 2026-09-08 | 2026-10-30 |
| CVE-2026-77491 Out-of-bounds read in Windows GDI allows an unauthorized attacker to disclose in... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-10-30 |
| CVE-2026-69609 Out-of-bounds read in Windows Win32K allows an authorized attacker to disclose i... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-10-30 |
| CVE-2026-69304 Improper handling of highly compressed data (data amplification) in ASP.NET Core... |
medium | 5.9 | — | Microsoft / asp.net core | 2026-09-08 | 2026-10-30 |
| CVE-2026-64918 Insufficiently protected credentials in Microsoft Office allows an unauthorized... |
medium | 6.5 | — | Microsoft / 365 apps | 2026-09-08 | 2026-10-30 |
| CVE-2026-58649 Origin validation error in .NET allows an unauthorized attacker to disclose info... |
medium | 6.5 | — | Microsoft / .net | 2026-09-08 | 2026-10-30 |
| CVE-2026-97782 Observable discrepancy in Microsoft Office SharePoint allows an authorized attac... |
medium | 6.8 | — | Microsoft / sharepoint server | 2026-10-13 | 2026-10-30 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.