October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,481
Critical
1,390
High
6,087
Medium
6,446
Low
659
Severity not reported
2,899
In CISA KEV
21
Most affected vendors (by CPE data where available): microsoft (1359), google (759), oracle (376), apple (282), ibm (149), adobe (138), apache (73), imagemagick (72), broadcom (61), freerdp (60)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-102191 Heap-based buffer overflow in Windows Storage allows an authorized attacker to e... |
high | 7.0 | — | Microsoft / windows 11 23h2 | 2026-10-13 | 2026-10-20 |
| CVE-2026-102192 Integer underflow (wrap or wraparound) in Windows Failover Cluster allows an una... |
high | 7.5 | — | Microsoft / windows server 2019 | 2026-10-13 | 2026-10-20 |
| CVE-2026-102193 Use after free in Windows Broadcast DVR User Service allows an authorized attack... |
high | 7.0 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-20 |
| CVE-2026-100220 Heap-based buffer overflow in Windows Media Video Decoder allows an unauthorized... |
high | 8.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-20 |
| CVE-2026-100225 Heap-based buffer overflow in Windows Storage allows an authorized attacker to e... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-20 |
| CVE-2026-100211 Use after free in Microsoft Office Excel allows an unauthorized attacker to exec... |
high | 8.8 | — | Microsoft / 365 apps | 2026-10-13 | 2026-10-15 |
| CVE-2026-100212 Use after free in Microsoft Office Excel allows an unauthorized attacker to exec... |
high | 8.8 | — | Microsoft / 365 apps | 2026-10-13 | 2026-10-15 |
| CVE-2026-100215 Heap-based buffer overflow in Microsoft Graphics Component allows an unauthorize... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-20 |
| CVE-2026-100216 Stack-based buffer overflow in Windows Storage allows an authorized attacker to... |
high | 7.0 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-20 |
| CVE-2026-100217 Improper privilege management in Windows Group Policy allows an authorized attac... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-20 |
| CVE-2026-100218 Use after free in Remote Desktop Gateway Service allows an unauthorized attacker... |
high | 8.1 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-20 |
| CVE-2026-100203 Heap-based buffer overflow in Windows Update Service allows an authorized attack... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-20 |
| CVE-2026-100209 Use after free in Microsoft Office Excel allows an unauthorized attacker to exec... |
high | 8.8 | — | Microsoft / 365 apps | 2026-10-13 | 2026-10-15 |
| CVE-2026-100210 Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized atta... |
high | 8.8 | — | Microsoft / 365 apps | 2026-10-13 | 2026-10-15 |
| CVE-2026-100200 Use after free in Windows Update Service allows an authorized attacker to elevat... |
high | 7.0 | — | Microsoft / windows 11 23h2 | 2026-10-13 | 2026-10-20 |
| CVE-2026-100201 Heap-based buffer overflow in Windows Client License Service allows an authorize... |
high | 7.0 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-20 |
| CVE-2026-69435 Missing authorization in Azure SRE Agent allows an authorized attacker to elevat... |
high | 8.1 | — | Microsoft / azure sre agent | 2026-10-08 | 2026-10-15 |
| CVE-2026-96940 Weak authentication in Microsoft Exchange Server allows an authorized attacker t... |
high | 8.8 | — | Microsoft / exchange server | 2026-10-02 | 2026-10-15 |
| CVE-2026-69446 Incorrect authorization in Microsoft Edge (Chromium-based) allows an authorized... |
medium | 4.4 | — | Microsoft / edge chromium | 2026-10-30 | 2026-11-03 |
| CVE-2026-88090 Access of resource using incompatible type ('type confusion') in Microsoft Edge... |
medium | 5.4 | — | Microsoft / edge chromium | 2026-10-29 | 2026-11-03 |
| CVE-2026-88078 Improper verification of cryptographic signature in Microsoft Edge (Chromium-bas... |
medium | 4.3 | — | Microsoft / edge chromium | 2026-10-29 | 2026-11-03 |
| CVE-2026-85330 Incorrect authorization in Microsoft Edge for Android allows an unauthorized att... |
medium | 4.3 | — | Microsoft / edge | 2026-10-29 | 2026-10-31 |
| CVE-2026-20942 Improper restriction of rendered ui layers or frames in Microsoft Edge (Chromium... |
medium | 4.3 | — | Microsoft / edge chromium | 2026-10-29 | 2026-11-03 |
| CVE-2026-108453 Out-of-bounds read in Microsoft Office PowerPoint allows an unauthorized attacke... |
medium | 6.5 | — | Microsoft / 365 apps | 2026-10-15 | 2026-10-19 |
| CVE-2026-108454 Buffer over-read in Microsoft Office PowerPoint allows an unauthorized attacker... |
medium | 6.5 | — | Microsoft / 365 apps | 2026-10-15 | 2026-10-19 |
| CVE-2026-108455 Out-of-bounds read in Microsoft Office PowerPoint allows an unauthorized attacke... |
medium | 6.5 | — | Microsoft / 365 apps | 2026-10-15 | 2026-10-19 |
| CVE-2026-108436 Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to d... |
medium | 6.5 | — | Microsoft / 365 apps | 2026-10-15 | 2026-10-20 |
| CVE-2026-108438 Use after free in Microsoft Office Word allows an unauthorized attacker to discl... |
medium | 6.5 | — | Microsoft / 365 apps | 2026-10-15 | 2026-10-20 |
| CVE-2026-108434 Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to d... |
medium | 6.5 | — | Microsoft / 365 apps | 2026-10-15 | 2026-10-20 |
| CVE-2026-108435 Untrusted pointer dereference in Microsoft Office Word allows an unauthorized at... |
medium | 6.5 | — | Microsoft / 365 apps | 2026-10-15 | 2026-10-20 |
| CVE-2026-88085 Heap-based buffer overflow in SQL Server allows an authorized attacker to elevat... |
medium | 6.4 | — | Microsoft / sql server 2017 | 2026-10-13 | 2026-11-02 |
| CVE-2026-88089 Heap-based buffer overflow in SQL Server allows an authorized attacker to execut... |
medium | 6.7 | — | Microsoft / sql server 2017 | 2026-10-13 | 2026-11-02 |
| CVE-2026-83945 Heap-based buffer overflow in SQL Server allows an authorized attacker to execut... |
medium | 6.6 | — | Microsoft / sql server 2022 | 2026-10-13 | 2026-11-02 |
| CVE-2026-70189 Heap-based buffer overflow in SQL Server allows an authorized attacker to execut... |
medium | 6.7 | — | Microsoft / sql server 2017 | 2026-10-13 | 2026-11-02 |
| CVE-2026-97844 Out-of-bounds read in DNS Server allows an authorized attacker to disclose infor... |
medium | 6.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-97839 Out-of-bounds read in DNS Server allows an authorized attacker to disclose infor... |
medium | 6.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-97840 Out-of-bounds read in DNS Server allows an authorized attacker to disclose infor... |
medium | 6.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-97841 Out-of-bounds read in DNS Server allows an authorized attacker to disclose infor... |
medium | 6.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-97842 Out-of-bounds read in DNS Server allows an authorized attacker to disclose infor... |
medium | 6.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-97843 Out-of-bounds read in DNS Server allows an authorized attacker to disclose infor... |
medium | 6.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.