October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
21,937
Critical
3,121
High
7,064
Medium
6,901
Low
608
Severity not reported
4,243
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (722), google (413), ibm (321), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-83648 Null pointer dereference in Active Directory Domain Services allows an authorize... |
medium | 6.5 | — | Microsoft / windows 10 21h2 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83875 Out-of-bounds read in HID Parser Library allows an authorized attacker to disclo... |
medium | 5.5 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83884 Out-of-bounds read in HID Parser Library allows an authorized attacker to disclo... |
medium | 5.5 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83887 Out-of-bounds read in HID Parser Library allows an authorized attacker to disclo... |
medium | 5.5 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83892 Out-of-bounds read in HID Parser Library allows an authorized attacker to disclo... |
medium | 5.5 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83898 Out-of-bounds read in HID Parser Library allows an authorized attacker to disclo... |
medium | 5.5 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83904 Out-of-bounds read in HID Parser Library allows an authorized attacker to disclo... |
medium | 5.5 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83905 Exposure of sensitive system information to an unauthorized control sphere in Wi... |
medium | 4.7 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83906 Incorrect implementation of authentication algorithm in Windows Shell allows an... |
medium | 6.5 | — | Microsoft / windows 11 23h2 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83907 Exposure of sensitive system information to an unauthorized control sphere in Wi... |
medium | 5.5 | — | Microsoft / windows 10 21h2 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83909 Exposure of sensitive system information to an unauthorized control sphere in Wi... |
medium | 4.7 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83646 Url redirection to untrusted site ('open redirect') in Active Directory Federati... |
medium | 5.4 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83933 Improper link resolution before file access ('link following') in Windows Update... |
medium | 5.5 | — | Microsoft / windows 10 21h2 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83764 Incorrect authorization in Windows Clipboard User Service allows an authorized a... |
medium | 5.5 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-29 |
| CVE-2026-85320 Use of uninitialized resource in Windows Print Spooler Components allows an auth... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83765 Out-of-bounds read in Windows DWM Core Library allows an authorized attacker to... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83766 Incorrect authorization in Windows Hyper-V allows an authorized attacker to bypa... |
medium | 4.2 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83786 Generation of error message containing sensitive information in Windows NTFS all... |
medium | 4.7 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83787 Insufficient verification of data authenticity in Windows DHCP Server allows an... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83788 Buffer over-read in Windows RNDIS allows an unauthorized attacker to disclose in... |
medium | 4.6 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-85866 Exposure of sensitive system information to an unauthorized control sphere in Wi... |
medium | 4.7 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83849 Out-of-bounds read in Windows Hello allows an authorized attacker to disclose in... |
medium | 5.5 | — | Microsoft / windows 10 21h2 | 2026-10-13 | 2026-10-29 |
| CVE-2026-66324 External control of file name or path in Microsoft Edge (Chromium-based) allows... |
medium | 6.5 | — | Microsoft / edge chromium | 2026-08-28 | 2026-10-28 |
| CVE-2026-66798 Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacke... |
medium | 4.3 | — | Microsoft / edge chromium | 2026-08-28 | 2026-10-28 |
| CVE-2026-66323 Improper neutralization of parameter/argument delimiters in Microsoft Edge (Chro... |
medium | 5.4 | — | Microsoft / edge chromium | 2026-08-28 | 2026-10-28 |
| CVE-2026-62904 Incorrect authorization in Microsoft Edge (Chromium-based) allows an unauthorize... |
medium | 5.4 | — | Microsoft / edge chromium | 2026-08-28 | 2026-10-28 |
| CVE-2026-85935 Buffer over-read in Windows USB Driver allows an authorized attacker to disclose... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-85938 Improper access control in Windows Broadcast DVR User Service allows an authoriz... |
medium | 5.5 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-28 |
| CVE-2026-85939 Weak authentication in Windows Kernel allows an authorized attacker to bypass a... |
medium | 5.3 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-62899 Inconsistent interpretation of http requests ('http request/response smuggling')... |
medium | 5.9 | — | Microsoft / visual studio 2022 | 2026-08-11 | 2026-10-28 |
| CVE-2026-62900 Improper removal of sensitive information before storage or transfer in .NET all... |
medium | 5.9 | — | Microsoft / visual studio 2022 | 2026-08-11 | 2026-10-28 |
| CVE-2026-62902 Inclusion of functionality from untrusted control sphere in .NET allows an unaut... |
medium | 6.5 | — | Microsoft / visual studio 2022 | 2026-08-11 | 2026-10-28 |
| CVE-2026-62740 Use of uninitialized resource in Windows Imaging Component allows an authorized... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-08-11 | 2026-10-28 |
| CVE-2026-57083 Use of uninitialized resource in Microsoft Windows Codecs Library allows an unau... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-07-14 | 2026-10-28 |
| CVE-2026-57084 Use of uninitialized resource in Windows File Explorer allows an unauthorized at... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-07-14 | 2026-10-28 |
| CVE-2026-50659 Improper encoding or escaping of output in .NET allows an authorized attacker to... |
medium | 6.5 | — | Microsoft / .net framework | 2026-07-14 | 2026-10-28 |
| CVE-2026-50526 Improper link resolution before file access ('link following') in .NET allows an... |
medium | 5.5 | — | Microsoft / .net | 2026-07-14 | 2026-10-28 |
| CVE-2026-40375 Missing authorization in Dynamics Business Central allows an authorized attacker... |
medium | 6.5 | — | Microsoft / dynamics 365 business central 2024 | 2026-08-11 | 2026-10-28 |
| CVE-2026-87709 Improper access control in Windows Host Guardian Service allows an authorized at... |
medium | 5.5 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-28 |
| CVE-2026-88140 Out-of-bounds read in Windows Key Storage Provider allows an authorized attacker... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.