October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
21,937
Critical
3,121
High
7,064
Medium
6,901
Low
608
Severity not reported
4,243
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (722), google (413), ibm (321), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-102865 Incorrect authorization in Microsoft Office SharePoint allows an authorized atta... |
medium | 6.5 | — | Microsoft / sharepoint server | 2026-10-13 | 2026-10-14 |
| CVE-2026-102864 Improper neutralization of input during web page generation ('cross-site scripti... |
medium | 4.6 | — | Microsoft / sharepoint server | 2026-10-13 | 2026-10-14 |
| CVE-2026-105720 Incorrect authorization in Microsoft Office SharePoint allows an authorized atta... |
medium | 4.3 | — | Microsoft / sharepoint server | 2026-10-13 | 2026-10-14 |
| CVE-2026-105719 Improper input validation in Microsoft Office SharePoint allows an authorized at... |
medium | 6.5 | — | Microsoft / sharepoint server | 2026-10-13 | 2026-10-14 |
| CVE-2026-105713 Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an auth... |
medium | 5.7 | — | Microsoft / sharepoint server | 2026-10-13 | 2026-10-14 |
| CVE-2026-70217 Improper access control in Microsoft Office SharePoint allows an authorized atta... |
medium | 4.9 | — | Microsoft / sharepoint server | 2026-10-13 | 2026-10-14 |
| CVE-2026-85932 Improper limitation of a pathname to a restricted directory ('path traversal') i... |
medium | 6.5 | — | Microsoft / sharepoint server | 2026-10-13 | 2026-10-14 |
| CVE-2026-70298 Improper limitation of a pathname to a restricted directory ('path traversal') i... |
medium | 6.5 | — | Microsoft / sharepoint server | 2026-10-13 | 2026-10-14 |
| CVE-2026-88209 Improper neutralization of input during web page generation ('cross-site scripti... |
medium | 4.6 | — | Microsoft / sharepoint server | 2026-10-13 | 2026-10-14 |
| CVE-2026-88208 Improper neutralization of input during web page generation ('cross-site scripti... |
medium | 4.6 | — | Microsoft / sharepoint server | 2026-10-13 | 2026-10-14 |
| CVE-2026-88190 Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to... |
medium | 6.5 | — | Microsoft / 365 apps | 2026-10-13 | 2026-10-14 |
| CVE-2026-88195 Buffer over-read in Microsoft Office Excel allows an unauthorized attacker to di... |
medium | 6.5 | — | Microsoft / 365 apps | 2026-10-13 | 2026-10-14 |
| CVE-2026-88201 Buffer over-read in Microsoft Office Excel allows an unauthorized attacker to di... |
medium | 6.5 | — | Microsoft / 365 apps | 2026-10-13 | 2026-10-14 |
| CVE-2026-97014 Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to... |
medium | 5.5 | — | Microsoft / 365 apps | 2026-10-13 | 2026-10-14 |
| CVE-2026-70219 Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to... |
medium | 6.5 | — | Microsoft / 365 apps | 2026-10-13 | 2026-10-14 |
| CVE-2026-88151 Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to... |
medium | 6.5 | — | Microsoft / 365 apps | 2026-10-13 | 2026-10-14 |
| CVE-2026-88153 Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to... |
medium | 6.5 | — | Microsoft / 365 apps | 2026-10-13 | 2026-10-14 |
| CVE-2026-88172 Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to... |
medium | 6.5 | — | Microsoft / 365 apps | 2026-10-13 | 2026-10-14 |
| CVE-2026-69562 Out-of-bounds read in SQL Server allows an unauthorized attacker to disclose inf... |
medium | 6.5 | — | Microsoft / sql server 2017 | 2026-09-08 | 2026-10-02 |
| CVE-2026-67630 Out-of-bounds read in SQL Server allows an authorized attacker to disclose infor... |
medium | 6.5 | — | Microsoft / sql server 2017 | 2026-09-08 | 2026-10-02 |
| CVE-2026-67629 Out-of-bounds read in SQL Server allows an authorized attacker to disclose infor... |
medium | 6.5 | — | Microsoft / sql server 2017 | 2026-09-08 | 2026-10-02 |
| CVE-2026-67624 Out-of-bounds read in SQL Server allows an authorized attacker to disclose infor... |
medium | 6.5 | — | Microsoft / sql server 2019 | 2026-09-08 | 2026-10-02 |
| CVE-2026-58616 Concurrent execution using shared resource with improper synchronization ('race... |
low | 3.0 | — | Microsoft / edge chromium | 2026-08-28 | 2026-10-28 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.