October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
21,937
Critical
3,121
High
7,064
Medium
6,901
Low
608
Severity not reported
4,243
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (722), google (413), ibm (321), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2025-64672 Improper neutralization of input during web page generation ('cross-site scripti... |
critical | 9.0 | — | Microsoft / sharepoint server | 2025-12-09 | 2026-10-14 |
| CVE-2026-70300 Untrusted pointer dereference in Microsoft Office Word allows an unauthorized at... |
critical | 9.8 | — | Microsoft / 365 apps | 2026-10-13 | 2026-10-14 |
| CVE-2026-45495 Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability |
critical | 9.8 | — | Microsoft / edge chromium | 2026-05-18 | 2026-10-14 |
| CVE-2026-83711 Authorization bypass through user-controlled key in Microsoft Azure Active Direc... |
critical | 10.0 | — | Microsoft / azure active directory b2c | 2026-09-03 | 2026-10-14 |
| CVE-2026-70352 Missing authentication for critical function in Azure AI Language allows an unau... |
critical | 10.0 | — | Microsoft / azure ai language authoring | 2026-09-03 | 2026-10-14 |
| CVE-2025-59247 Azure PlayFab Elevation of Privilege Vulnerability |
critical | 9.8 | — | Microsoft / azure playfab | 2025-10-09 | 2026-10-08 |
| CVE-2025-59273 Improper access control in Azure Event Grid allows an unauthorized attacker to e... |
critical | 9.8 | — | Microsoft / azure event grid | 2025-10-23 | 2026-10-08 |
| CVE-2025-59503 Server-side request forgery (ssrf) in Azure Compute Gallery allows an unauthoriz... |
critical | 9.8 | — | Microsoft / azure compute resource provider | 2025-10-23 | 2026-10-08 |
| CVE-2026-65669 Improper neutralization of special elements in output used by a downstream compo... |
critical | 9.6 | — | Microsoft / sql server management studio | 2026-09-08 | 2026-10-07 |
| CVE-2026-62874 Insufficient verification of data authenticity in Azure Billing allows an unauth... |
critical | 9.8 | — | Microsoft / azure billing | 2026-09-18 | 2026-10-07 |
| CVE-2026-85908 Heap-based buffer overflow in Windows Win32K - GRFX allows an authorized attacke... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-31 |
| CVE-2026-83651 Out-of-bounds read in Windows GDI allows an unauthorized attacker to disclose in... |
high | 7.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-31 |
| CVE-2026-70271 Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker t... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-31 |
| CVE-2026-70106 Heap-based buffer overflow in Windows Kernel allows an authorized attacker to el... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-31 |
| CVE-2026-96192 Use after free in Microsoft Edge for iOS allows an unauthorized attacker to exec... |
high | 8.8 | — | Microsoft / edge | 2026-10-29 | 2026-10-31 |
| CVE-2026-85893 Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacke... |
high | 8.8 | — | Microsoft / edge chromium | 2026-09-15 | 2026-10-30 |
| CVE-2026-81396 Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized att... |
high | 7.8 | — | Microsoft / 365 apps | 2026-09-08 | 2026-10-30 |
| CVE-2026-78524 Out-of-bounds write in Microsoft Office allows an unauthorized attacker to execu... |
high | 8.8 | — | Microsoft / 365 apps | 2026-09-08 | 2026-10-30 |
| CVE-2026-73013 Heap-based buffer overflow in Windows Imaging Component allows an unauthorized a... |
high | 8.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-10-30 |
| CVE-2026-71328 Heap-based buffer overflow in Visual Studio allows an unauthorized attacker to e... |
high | 8.8 | — | Microsoft / visual studio 2022 | 2026-09-08 | 2026-10-30 |
| CVE-2026-70125 Microsoft Office Outlook Remote Code Execution Vulnerability |
high | 7.8 | — | Microsoft / 365 apps | 2026-09-23 | 2026-10-30 |
| CVE-2026-69806 Exposure of sensitive information to an unauthorized actor in .NET allows an aut... |
high | 7.0 | — | Microsoft / .net | 2026-09-08 | 2026-10-30 |
| CVE-2026-69767 Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to... |
high | 8.8 | — | Microsoft / 365 apps | 2026-09-08 | 2026-10-30 |
| CVE-2026-69610 Buffer over-read in Windows Win32K allows an authorized attacker to elevate priv... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-10-30 |
| CVE-2026-69576 Use after free in Graphic Fonts allows an authorized attacker to elevate privile... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-10-30 |
| CVE-2026-69556 Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attac... |
high | 8.8 | — | Microsoft / 365 apps | 2026-09-08 | 2026-10-30 |
| CVE-2026-69499 Integer overflow or wraparound in Windows Imaging Component allows an unauthoriz... |
high | 8.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-10-30 |
| CVE-2026-69439 Heap-based buffer overflow in .NET and Visual Studio allows an unauthorized atta... |
high | 8.8 | — | Microsoft / .net | 2026-09-08 | 2026-10-30 |
| CVE-2026-68880 Heap-based buffer overflow in Windows Win32K allows an authorized attacker to el... |
high | 8.0 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-10-30 |
| CVE-2026-62804 External control of file name or path in Microsoft Office Word allows an unautho... |
high | 7.8 | — | Microsoft / 365 apps | 2026-09-08 | 2026-10-30 |
| CVE-2026-83699 Stack-based buffer overflow in Windows Client-Side Caching (CSC) Service allows... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-30 |
| CVE-2026-83698 Heap-based buffer overflow in Windows Client-Side Caching (CSC) Service allows a... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-30 |
| CVE-2026-83696 Use after free in Windows Cloud Files Mini Filter Driver allows an authorized at... |
high | 7.0 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-30 |
| CVE-2026-83722 Use after free in Microsoft Local Security Authority Server (lsasrv) allows an a... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-30 |
| CVE-2026-69966 Integer overflow or wraparound in Microsoft Streaming Service allows an authoriz... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-70198 Use after free in Windows Push Notifications allows an authorized attacker to el... |
high | 7.0 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83666 Concurrent execution using shared resource with improper synchronization ('race... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83670 Out-of-bounds read in Function Discovery Service (fdwsd.dll) allows an unauthori... |
high | 7.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83674 Weak authentication in Active Directory Federation Services (AD FS) allows an un... |
high | 8.1 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83688 Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attac... |
high | 8.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.