October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
21,937
Critical
3,121
High
7,064
Medium
6,901
Low
608
Severity not reported
4,243
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (722), google (413), ibm (321), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-70288 Time-of-check time-of-use (toctou) race condition in Windows Win32 Kernel Subsys... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-21 |
| CVE-2026-70292 Out-of-bounds read in Windows Win32 Kernel Subsystem allows an authorized attack... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-21 |
| CVE-2026-70293 Use of uninitialized resource in Windows Win32 Kernel Subsystem allows an author... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-21 |
| CVE-2026-70294 Out-of-bounds read in Windows Win32 Kernel Subsystem allows an authorized attack... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-21 |
| CVE-2026-70295 Out-of-bounds read in Windows Win32 Kernel Subsystem allows an authorized attack... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-21 |
| CVE-2026-83774 Exposure of sensitive system information to an unauthorized control sphere in Wi... |
medium | 4.7 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-21 |
| CVE-2026-97783 Improper neutralization of input during web page generation ('cross-site scripti... |
medium | 6.1 | — | Microsoft / sharepoint server | 2026-10-13 | 2026-10-21 |
| CVE-2026-83870 Out-of-bounds read in Windows Aggregated Data Platform Service allows an authori... |
medium | 5.5 | — | Microsoft / windows 11 24h2 | 2026-10-13 | 2026-10-21 |
| CVE-2026-83854 Improper access control in Windows Notification allows an authorized attacker to... |
medium | 5.5 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-21 |
| CVE-2026-83864 Improper access control in Windows NTFS allows an authorized attacker to disclos... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-21 |
| CVE-2026-83865 Relative path traversal in Windows Internet (wininet.dll) allows an authorized a... |
medium | 4.7 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-21 |
| CVE-2026-70097 Concurrent execution using shared resource with improper synchronization ('race... |
medium | 5.6 | — | Microsoft / windows 11 24h2 | 2026-10-13 | 2026-10-21 |
| CVE-2026-83885 Inadequate encryption strength in Windows Virtualization-Based Security (VBS) En... |
medium | 5.6 | — | Microsoft / windows 11 24h2 | 2026-10-13 | 2026-10-21 |
| CVE-2026-83893 Exposure of sensitive system information to an unauthorized control sphere in Wi... |
medium | 5.5 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-21 |
| CVE-2026-83895 Heap-based buffer overflow in Windows Win32 Kernel Subsystem allows an unauthori... |
medium | 6.8 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-21 |
| CVE-2026-83897 Exposure of sensitive system information to an unauthorized control sphere in Wi... |
medium | 4.7 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-21 |
| CVE-2026-102206 Heap-based buffer overflow in Windows Portable Device MTP Driver allows an unaut... |
medium | 6.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-20 |
| CVE-2026-102198 Out-of-bounds read in Windows Remote Desktop Protocol allows an authorized attac... |
medium | 5.3 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-20 |
| CVE-2026-102199 Stack-based buffer overflow in Microsoft Windows Codecs Library allows an unauth... |
medium | 6.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-20 |
| CVE-2026-102186 Untrusted pointer dereference in Windows Network File System allows an authorize... |
medium | 4.7 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-20 |
| CVE-2026-102187 Use of uninitialized resource in Windows Kernel allows an authorized attacker to... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-20 |
| CVE-2026-102188 Untrusted pointer dereference in Windows Storage Port Driver allows an unauthori... |
medium | 6.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-20 |
| CVE-2026-108434 Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to d... |
medium | 6.5 | — | Microsoft / 365 apps | 2026-10-15 | 2026-10-20 |
| CVE-2026-108435 Untrusted pointer dereference in Microsoft Office Word allows an unauthorized at... |
medium | 6.5 | — | Microsoft / 365 apps | 2026-10-15 | 2026-10-20 |
| CVE-2026-108436 Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to d... |
medium | 6.5 | — | Microsoft / 365 apps | 2026-10-15 | 2026-10-20 |
| CVE-2026-108438 Use after free in Microsoft Office Word allows an unauthorized attacker to discl... |
medium | 6.5 | — | Microsoft / 365 apps | 2026-10-15 | 2026-10-20 |
| CVE-2026-88162 Improper authorization in Windows Encrypting File System (EFS) allows an authori... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-20 |
| CVE-2026-96300 Uncontrolled resource consumption in RPC Endpoint Mapper Service allows an unaut... |
medium | 5.9 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-20 |
| CVE-2026-96853 Time-of-check time-of-use (toctou) race condition in Windows Win32 Kernel Subsys... |
medium | 4.7 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-20 |
| CVE-2026-96854 Access of resource using incompatible type ('type confusion') in Windows Device... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-20 |
| CVE-2026-96855 Improper access control in Windows Modern Device Management (MDM) allows an auth... |
medium | 5.5 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-20 |
| CVE-2026-96857 Files or directories accessible to external parties in Windows Projected File Sy... |
medium | 5.5 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-20 |
| CVE-2026-108453 Out-of-bounds read in Microsoft Office PowerPoint allows an unauthorized attacke... |
medium | 6.5 | — | Microsoft / 365 apps | 2026-10-15 | 2026-10-19 |
| CVE-2026-108454 Buffer over-read in Microsoft Office PowerPoint allows an unauthorized attacker... |
medium | 6.5 | — | Microsoft / 365 apps | 2026-10-15 | 2026-10-19 |
| CVE-2026-108455 Out-of-bounds read in Microsoft Office PowerPoint allows an unauthorized attacke... |
medium | 6.5 | — | Microsoft / 365 apps | 2026-10-15 | 2026-10-19 |
| CVE-2026-84007 Out-of-bounds read in Remote Desktop Gateway Service allows an authorized attack... |
medium | 6.5 | — | Microsoft / windows server 2012 | 2026-10-13 | 2026-10-19 |
| CVE-2026-84009 Time-of-check time-of-use (toctou) race condition in Windows Projected File Syst... |
medium | 4.7 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-19 |
| CVE-2026-84011 Incorrect authorization in Windows SMB Client allows an authorized attacker to b... |
medium | 5.5 | — | Microsoft / windows 11 23h2 | 2026-10-13 | 2026-10-19 |
| CVE-2026-69999 Out-of-bounds read in Windows Update allows an authorized attacker to disclose i... |
medium | 5.5 | — | Microsoft / windows 11 23h2 | 2026-10-13 | 2026-10-19 |
| CVE-2026-85816 Out-of-bounds read in Windows Wi-Fi Driver allows an authorized attacker to disc... |
medium | 5.7 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.