October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
21,937
Critical
3,121
High
7,064
Medium
6,901
Low
608
Severity not reported
4,243
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (722), google (413), ibm (321), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-69399 Azure Arc Elevation of Privilege Vulnerability |
critical | 9.9 | — | Microsoft / azure arc | 2026-09-17 | 2026-10-31 |
| CVE-2026-83693 Heap-based buffer overflow in Windows Error Reporting allows an unauthorized att... |
critical | 9.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83517 Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unaut... |
critical | 9.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83519 Heap-based buffer overflow in Windows Error Reporting allows an unauthorized att... |
critical | 9.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83578 Integer underflow (wrap or wraparound) in Windows PowerShell allows an unauthori... |
critical | 9.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83748 Heap-based buffer overflow in Windows Error Reporting allows an unauthorized att... |
critical | 9.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83523 Heap-based buffer overflow in Windows Image Acquisition allows an unauthorized a... |
critical | 9.8 | — | Microsoft / windows 11 24h2 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83910 Out-of-bounds write in RPC Runtime allows an unauthorized attacker to execute co... |
critical | 9.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-47304 Improper verification of cryptographic signature in .NET allows an unauthorized... |
critical | 9.8 | — | Microsoft / .net framework | 2026-07-14 | 2026-10-28 |
| CVE-2026-83789 Heap-based buffer overflow in Windows SMB Client allows an unauthorized attacker... |
critical | 9.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-70153 Heap-based buffer overflow in Microsoft PostScript Printer Driver allows an unau... |
critical | 9.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-70147 Heap-based buffer overflow in Microsoft PostScript Printer Driver allows an unau... |
critical | 9.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-70262 Heap-based buffer overflow in WebDAV allows an unauthorized attacker to elevate... |
critical | 9.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-70275 Untrusted pointer dereference in Windows CD-ROM Driver allows an unauthorized at... |
critical | 9.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-70157 Heap-based buffer overflow in Windows System Information Console allows an unaut... |
critical | 9.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-96864 Double free in Microsoft Failover Cluster Virtual Driver allows an unauthorized... |
critical | 9.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-85928 Heap-based buffer overflow in Windows Volume Manager Extension Driver allows an... |
critical | 9.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-105008 No cwe for this issue in Windows Schannel allows an unauthorized attacker to per... |
critical | 9.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-27 |
| CVE-2026-26150 Server-side request forgery (ssrf) in Microsoft Purview allows an unauthorized a... |
critical | 10.0 | — | Microsoft / purview ediscovery | 2026-04-23 | 2026-10-26 |
| CVE-2026-33819 Deserialization of untrusted data in Microsoft Bing allows an unauthorized attac... |
critical | 9.8 | — | Microsoft / bing | 2026-04-23 | 2026-10-26 |
| CVE-2026-35435 Improper access control in Azure AI Foundry M365 published agents allows an unau... |
critical | 10.0 | — | Microsoft / azure ai foundry | 2026-05-07 | 2026-10-26 |
| CVE-2026-33821 Improper privilege management in Microsoft Dynamics 365 Customer Insights allows... |
critical | 9.9 | — | Microsoft / dynamics 365 customer insights | 2026-05-12 | 2026-10-26 |
| CVE-2026-105723 Untrusted pointer dereference in Windows Distributed File System (DFS) allows an... |
critical | 9.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-26 |
| CVE-2026-69634 Heap-based buffer overflow in Windows iSCSI allows an unauthorized attacker to e... |
critical | 9.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-26 |
| CVE-2026-69639 Heap-based buffer overflow in Windows Libarchive allows an unauthorized attacker... |
critical | 9.8 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-26 |
| CVE-2026-105010 Use after free in Microsoft Windows Search Component allows an unauthorized atta... |
critical | 9.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-26 |
| CVE-2026-26145 Improper access control in Azure Synapse allows an authorized attacker to elevat... |
critical | 9.8 | — | Microsoft / azure synapse | 2026-07-02 | 2026-10-25 |
| CVE-2026-41106 Url redirection to untrusted site ('open redirect') in M365 Copilot allows an un... |
critical | 9.3 | — | Microsoft / 365 copilot | 2026-07-02 | 2026-10-25 |
| CVE-2026-57983 Improper authorization in Microsoft Edge (Chromium-based) allows an unauthorized... |
critical | 10.0 | — | Microsoft / edge chromium | 2026-07-03 | 2026-10-25 |
| CVE-2026-58617 Improper access control in Microsoft 365 Copilot for iOS allows an unauthorized... |
critical | 9.8 | — | Microsoft / 365 copilot | 2026-07-14 | 2026-10-24 |
| CVE-2026-62836 Improper restriction of communication channel to intended endpoints in Azure SQL... |
critical | 10.0 | — | Microsoft / azure sql managed instance | 2026-08-07 | 2026-10-24 |
| CVE-2026-57104 Improper neutralization of input during web page generation ('cross-site scripti... |
critical | 9.6 | — | Microsoft / azure storage explorer | 2026-08-11 | 2026-10-24 |
| CVE-2026-65768 Improper limitation of a pathname to a restricted directory ('path traversal') i... |
critical | 9.8 | — | Microsoft / teams | 2026-08-11 | 2026-10-24 |
| CVE-2026-56160 Improper authorization in Azure Red Hat OpenShift (ARO) allows an authorized att... |
critical | 9.9 | — | Microsoft / azure red hat openshift | 2026-07-24 | 2026-10-24 |
| CVE-2026-58275 Missing authorization in Azure DNS allows an unauthorized attacker to elevate pr... |
critical | 9.8 | — | Microsoft / azure dns | 2026-07-24 | 2026-10-24 |
| CVE-2026-62825 Improper authentication in Azure Key Vault allows an unauthorized attacker to el... |
critical | 9.8 | — | Microsoft / azure key vault | 2026-07-24 | 2026-10-24 |
| CVE-2026-58630 Improper access control in Azure App Service allows an unauthorized attacker to... |
critical | 9.8 | — | Microsoft / azure app service for linux | 2026-07-24 | 2026-10-24 |
| CVE-2026-66321 Access of resource using incompatible type ('type confusion') in Microsoft Edge... |
critical | 9.6 | — | Microsoft / edge chromium | 2026-08-04 | 2026-10-23 |
| CVE-2026-83888 Buffer over-read in Windows CD-ROM Driver allows an unauthorized attacker to ele... |
critical | 9.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-21 |
| CVE-2026-102210 Heap-based buffer overflow in Windows Text Shaping allows an unauthorized attack... |
critical | 9.8 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-20 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.