October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
21,937
Critical
3,121
High
7,064
Medium
6,901
Low
608
Severity not reported
4,243
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (722), google (413), ibm (321), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-70173 Out-of-bounds read in Microsoft Windows Search Component allows an authorized at... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-70195 Use after free in Windows Ancillary Function Driver for WinSock allows an author... |
medium | 4.7 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-70201 Out-of-bounds read in Windows DHCP Server allows an authorized attacker to deny... |
medium | 5.5 | — | Microsoft / windows server 2012 | 2026-10-13 | 2026-10-28 |
| CVE-2026-83794 Out-of-bounds read in Windows Portable Device MTP Driver allows an authorized at... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-27 |
| CVE-2026-83798 Improper verification of cryptographic signature in Windows Update Stack allows... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-27 |
| CVE-2026-83835 Buffer over-read in Windows Common Log File System Driver allows an authorized a... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-27 |
| CVE-2026-103576 Url redirection to untrusted site ('open redirect') in Active Directory Federati... |
medium | 6.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-27 |
| CVE-2026-87698 Out-of-bounds read in Windows Remote Access Service Infrastructure allows an aut... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-27 |
| CVE-2026-105006 Use after free in HID class driver allows an unauthorized attacker to elevate pr... |
medium | 6.4 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-27 |
| CVE-2026-85909 Out-of-bounds read in Windows Universal Disk Format File System Driver (UDFS) al... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-26 |
| CVE-2026-85910 Buffer over-read in Windows StateRepository API allows an authorized attacker to... |
medium | 5.5 | — | Microsoft / windows 11 24h2 | 2026-10-13 | 2026-10-26 |
| CVE-2026-70011 Out-of-bounds read in Windows IP Over USB Service allows an authorized attacker... |
medium | 5.5 | — | Microsoft / windows 10 21h2 | 2026-10-13 | 2026-10-26 |
| CVE-2026-108462 Exposure of sensitive system information to an unauthorized control sphere in Wi... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-26 |
| CVE-2026-108466 Out-of-bounds read in Windows Kernel allows an unauthorized attacker to deny ser... |
medium | 5.3 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-26 |
| CVE-2026-69968 Relative path traversal in Windows Libarchive allows an unauthorized attacker to... |
medium | 6.5 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-26 |
| CVE-2026-69969 Improper link resolution before file access ('link following') in Windows AppX D... |
medium | 4.7 | — | Microsoft / windows 10 21h2 | 2026-10-13 | 2026-10-26 |
| CVE-2026-69971 Incorrect authorization in Windows Kernel-Mode Drivers allows an authorized atta... |
medium | 5.5 | — | Microsoft / windows 11 24h2 | 2026-10-13 | 2026-10-26 |
| CVE-2026-69973 Improper limitation of a pathname to a restricted directory ('path traversal') i... |
medium | 6.5 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-26 |
| CVE-2026-69974 Out-of-bounds read in Desktop Window Manager allows an authorized attacker to di... |
medium | 4.7 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-26 |
| CVE-2026-69978 Null pointer dereference in Windows VMSwitch allows an authorized attacker to de... |
medium | 5.5 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-26 |
| CVE-2026-69979 Improper protection of alternate path in Windows AppX Deployment Service allows... |
medium | 5.5 | — | Microsoft / windows 10 21h2 | 2026-10-13 | 2026-10-26 |
| CVE-2026-69982 Weak authentication in Active Directory Federation Services (AD FS) allows an un... |
medium | 5.9 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-26 |
| CVE-2026-59116 Use of a broken or risky cryptographic algorithm in Windows Remote Desktop allow... |
medium | 6.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-26 |
| CVE-2026-62687 Improper link resolution before file access ('link following') in Windows Backup... |
medium | 5.5 | — | Microsoft / windows 10 21h2 | 2026-10-13 | 2026-10-26 |
| CVE-2026-62879 Missing authentication for critical function in Windows SmartScreen allows an au... |
medium | 5.5 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-26 |
| CVE-2026-69635 Heap-based buffer overflow in Windows Installer allows an authorized attacker to... |
medium | 6.6 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-26 |
| CVE-2026-69640 Incorrect authorization in Windows Key Distribution Center allows an authorized... |
medium | 5.3 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-26 |
| CVE-2026-96910 Untrusted pointer dereference in Microsoft Windows Search Component allows an au... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-26 |
| CVE-2026-103567 Buffer over-read in Windows Broadcast DVR User Service allows an authorized atta... |
medium | 5.5 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-26 |
| CVE-2026-103578 Untrusted pointer dereference in Windows Kernel allows an unauthorized attacker... |
medium | 6.8 | — | Microsoft / windows 11 26h1 | 2026-10-13 | 2026-10-26 |
| CVE-2026-102221 No cwe for this issue in Windows Secure Boot allows an authorized attacker to by... |
medium | 4.4 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-26 |
| CVE-2026-83925 Use of uninitialized resource in Windows Kernel allows an authorized attacker to... |
medium | 4.7 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-26 |
| CVE-2026-83926 Improper certificate validation in Windows Hello allows an authorized attacker t... |
medium | 4.4 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-26 |
| CVE-2026-69506 Out-of-bounds read in Windows Key Storage Provider allows an authorized attacker... |
medium | 4.7 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-23 |
| CVE-2026-96303 Improperly implemented security check for standard in Microsoft PowerShell allow... |
medium | 6.5 | — | Microsoft / powershell | 2026-10-13 | 2026-10-22 |
| CVE-2026-85790 Use after free in Microsoft QUIC allows an unauthorized attacker to disclose inf... |
medium | 5.9 | — | Microsoft / windows 11 23h2 | 2026-10-13 | 2026-10-22 |
| CVE-2026-70170 Untrusted pointer dereference in Windows Kernel allows an authorized attacker to... |
medium | 6.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-22 |
| CVE-2026-70199 Exposure of sensitive system information to an unauthorized control sphere in Wi... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-22 |
| CVE-2026-70232 Exposure of sensitive system information to an unauthorized control sphere in Wi... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-22 |
| CVE-2026-70284 Use of uninitialized resource in Windows Win32 Kernel Subsystem allows an author... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-21 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.