October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,481
Critical
1,390
High
6,087
Medium
6,446
Low
659
Severity not reported
2,899
In CISA KEV
21
Most affected vendors (by CPE data where available): microsoft (1359), google (759), oracle (376), apple (282), ibm (149), adobe (138), apache (73), imagemagick (72), broadcom (61), freerdp (60)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-88169 Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to d... |
medium | 6.5 | — | Microsoft / 365 apps | 2026-10-13 | 2026-10-15 |
| CVE-2026-88172 Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to... |
medium | 6.5 | — | Microsoft / 365 apps | 2026-10-13 | 2026-10-14 |
| CVE-2026-88158 Out-of-bounds read in Microsoft Digest Authentication allows an authorized attac... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-31 |
| CVE-2026-88162 Improper authorization in Windows Encrypting File System (EFS) allows an authori... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-20 |
| CVE-2026-88151 Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to... |
medium | 6.5 | — | Microsoft / 365 apps | 2026-10-13 | 2026-10-14 |
| CVE-2026-88153 Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to... |
medium | 6.5 | — | Microsoft / 365 apps | 2026-10-13 | 2026-10-14 |
| CVE-2026-88154 Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to... |
medium | 6.5 | — | Microsoft / 365 apps | 2026-10-13 | 2026-10-15 |
| CVE-2026-88137 Files or directories accessible to external parties in WebDAV allows an authoriz... |
medium | 6.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-31 |
| CVE-2026-88140 Out-of-bounds read in Windows Key Storage Provider allows an authorized attacker... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-88129 Out-of-bounds read in DNS Server allows an authorized attacker to deny service o... |
medium | 6.5 | — | Microsoft / windows server 2012 | 2026-10-13 | 2026-10-16 |
| CVE-2026-88130 Out-of-bounds read in DNS Server allows an authorized attacker to deny service o... |
medium | 6.5 | — | Microsoft / windows server 2012 | 2026-10-13 | 2026-10-16 |
| CVE-2026-88123 Out-of-bounds read in DNS Server allows an authorized attacker to deny service o... |
medium | 6.5 | — | Microsoft / windows server 2012 | 2026-10-13 | 2026-10-16 |
| CVE-2026-88125 Out-of-bounds read in DNS Server allows an authorized attacker to deny service o... |
medium | 6.5 | — | Microsoft / windows server 2012 | 2026-10-13 | 2026-10-16 |
| CVE-2026-88122 Out-of-bounds read in DNS Server allows an authorized attacker to deny service o... |
medium | 6.5 | — | Microsoft / windows server 2012 | 2026-10-13 | 2026-10-16 |
| CVE-2026-88099 Uncaught exception in Windows Failover Cluster allows an unauthorized attacker t... |
medium | 5.9 | — | Microsoft / windows server 2019 | 2026-10-13 | 2026-10-16 |
| CVE-2026-87714 Missing authorization in WebDAV allows an authorized attacker to bypass a securi... |
medium | 6.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-87709 Improper access control in Windows Host Guardian Service allows an authorized at... |
medium | 5.5 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-28 |
| CVE-2026-87698 Out-of-bounds read in Windows Remote Access Service Infrastructure allows an aut... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-27 |
| CVE-2026-85935 Buffer over-read in Windows USB Driver allows an authorized attacker to disclose... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-85938 Improper access control in Windows Broadcast DVR User Service allows an authoriz... |
medium | 5.5 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-28 |
| CVE-2026-85939 Weak authentication in Windows Kernel allows an authorized attacker to bypass a... |
medium | 5.3 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-85932 Improper limitation of a pathname to a restricted directory ('path traversal') i... |
medium | 6.5 | — | Microsoft / sharepoint server | 2026-10-13 | 2026-10-14 |
| CVE-2026-85910 Buffer over-read in Windows StateRepository API allows an authorized attacker to... |
medium | 5.5 | — | Microsoft / windows 11 24h2 | 2026-10-13 | 2026-10-26 |
| CVE-2026-85916 Exposure of private personal information to an unauthorized actor in Azure Activ... |
medium | 5.5 | — | Microsoft / windows 11 23h2 | 2026-10-13 | 2026-10-16 |
| CVE-2026-85909 Out-of-bounds read in Windows Universal Disk Format File System Driver (UDFS) al... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-26 |
| CVE-2026-85865 Improper authentication in Windows DHCP Server allows an authorized attacker to... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-85866 Exposure of sensitive system information to an unauthorized control sphere in Wi... |
medium | 4.7 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-29 |
| CVE-2026-85857 Insertion of sensitive information into log file in Windows Kernel-Mode Drivers... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-85859 Null pointer dereference in Windows Message Queuing Queue Manager allows an auth... |
medium | 6.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-85852 Out-of-bounds read in Windows Management Instrumentation allows an authorized at... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-85841 Use after free in Windows DHCP Server allows an authorized attacker to execute c... |
medium | 6.6 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-85847 Out-of-bounds read in Windows Print Spooler Components allows an unauthorized at... |
medium | 6.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-85840 Files or directories accessible to external parties in Windows Event Viewer allo... |
medium | 6.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-85830 Out-of-bounds read in Windows Installer allows an authorized attacker to disclos... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-85831 Heap-based buffer overflow in Windows Biometric Service allows an authorized att... |
medium | 5.5 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-29 |
| CVE-2026-85815 Out-of-bounds read in Windows Device Association Service allows an authorized at... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-85816 Out-of-bounds read in Windows Wi-Fi Driver allows an authorized attacker to disc... |
medium | 5.7 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-85821 Out-of-bounds read in Windows Universal Disk Format File System Driver (UDFS) al... |
medium | 6.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-85812 Files or directories accessible to external parties in Windows Bind Filter Drive... |
medium | 5.5 | — | Microsoft / windows 10 21h2 | 2026-10-13 | 2026-10-16 |
| CVE-2026-85805 Improperly implemented security check for standard in Windows PowerShell allows... |
medium | 6.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.