October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,481
Critical
1,390
High
6,087
Medium
6,446
Low
659
Severity not reported
2,899
In CISA KEV
21
Most affected vendors (by CPE data where available): microsoft (1359), google (759), oracle (376), apple (282), ibm (149), adobe (138), apache (73), imagemagick (72), broadcom (61), freerdp (60)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-88155 Heap-based buffer overflow in Microsoft Office SharePoint allows an authorized a... |
high | 8.8 | — | Microsoft / sharepoint server | 2026-10-13 | 2026-10-14 |
| CVE-2026-88157 Heap-based buffer overflow in OpenSSH for Windows allows an unauthorized attacke... |
high | 8.8 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-28 |
| CVE-2026-88144 Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to... |
high | 8.8 | — | Microsoft / 365 apps | 2026-10-13 | 2026-10-15 |
| CVE-2026-88145 Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized atta... |
high | 8.8 | — | Microsoft / 365 apps | 2026-10-13 | 2026-10-15 |
| CVE-2026-88146 Concurrent execution using shared resource with improper synchronization ('race... |
high | 7.0 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-28 |
| CVE-2026-88147 Heap-based buffer overflow in Windows Secure Socket Tunneling Protocol (SSTP) al... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-88149 Double free in Windows Ancillary Function Driver for WinSock allows an authorize... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-88150 Use of uninitialized resource in Microsoft Office Word allows an unauthorized at... |
high | 8.8 | — | Microsoft / 365 apps | 2026-10-13 | 2026-10-15 |
| CVE-2026-88136 Improper resolution of path equivalence in WebDAV allows an authorized attacker... |
high | 8.8 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-88139 Use after free in Windows Kernel allows an authorized attacker to elevate privil... |
high | 7.0 | — | Microsoft / windows 11 24h2 | 2026-10-13 | 2026-10-28 |
| CVE-2026-88141 Use after free in Windows Kernel allows an authorized attacker to elevate privil... |
high | 7.0 | — | Microsoft / windows 11 23h2 | 2026-10-13 | 2026-10-28 |
| CVE-2026-88142 Use after free in Windows Background Intelligent Transfer Service (BITS) allows... |
high | 8.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-88143 Heap-based buffer overflow in Windows Storage Spaces Controller allows an author... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-88133 Improper authorization in Windows Portable Device Enumerator Service allows an a... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-88134 Use after free in Windows Kernel allows an authorized attacker to elevate privil... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-88135 Improper access control in WebDAV allows an authorized attacker to elevate privi... |
high | 7.8 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-88124 Use after free in Windows Installer allows an authorized attacker to elevate pri... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-88126 Untrusted pointer dereference in WebDAV allows an authorized attacker to elevate... |
high | 7.8 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-88127 Use after free in Windows SMB Server allows an authorized attacker to elevate pr... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-88128 Heap-based buffer overflow in Windows DWM Core Library allows an authorized atta... |
high | 7.8 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-28 |
| CVE-2026-88117 Use after free in Windows DHCP Server allows an unauthorized attacker to execute... |
high | 8.1 | — | Microsoft / windows server 2012 | 2026-10-13 | 2026-10-28 |
| CVE-2026-88118 Integer overflow or wraparound in Windows Background Intelligent Transfer Servic... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-88119 Use after free in Windows DHCP Server allows an unauthorized attacker to execute... |
high | 8.1 | — | Microsoft / windows server 2012 | 2026-10-13 | 2026-10-28 |
| CVE-2026-88120 Use after free in Windows DHCP Server allows an unauthorized attacker to execute... |
high | 8.1 | — | Microsoft / windows server 2012 | 2026-10-13 | 2026-10-28 |
| CVE-2026-88121 Use after free in Windows Background Intelligent Transfer Service (BITS) allows... |
high | 8.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-88110 Heap-based buffer overflow in Windows Graphics Kernel allows an authorized attac... |
high | 7.0 | — | Microsoft / windows 11 24h2 | 2026-10-13 | 2026-10-28 |
| CVE-2026-88112 Untrusted pointer dereference in DNS Server allows an unauthorized attacker to e... |
high | 8.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-88113 Use after free in Windows Broadcast DVR User Service allows an authorized attack... |
high | 7.0 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-28 |
| CVE-2026-88114 Untrusted pointer dereference in DNS Server allows an unauthorized attacker to e... |
high | 8.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-88115 Out-of-bounds read in Windows Server for NFS allows an unauthorized attacker to... |
high | 8.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-88116 Untrusted pointer dereference in DNS Server allows an unauthorized attacker to e... |
high | 8.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-88101 Weak authentication in Microsoft Input Method Editor (IME) allows an authorized... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-17 |
| CVE-2026-88103 Use after free in Windows Broadcast DVR User Service allows an authorized attack... |
high | 7.0 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-16 |
| CVE-2026-88105 Use after free in Windows Broadcast DVR User Service allows an authorized attack... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-88106 Use after free in Windows Cloud Files Mini Filter Driver allows an authorized at... |
high | 7.0 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-28 |
| CVE-2026-88107 Use after free in Windows Cloud Files Mini Filter Driver allows an authorized at... |
high | 7.0 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-28 |
| CVE-2026-88109 Use after free in Microsoft Office Click-To-Run allows an authorized attacker to... |
high | 7.8 | — | Microsoft / 365 apps | 2026-10-13 | 2026-10-15 |
| CVE-2026-88093 Heap-based buffer overflow in Desktop Window Manager allows an authorized attack... |
high | 7.8 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-16 |
| CVE-2026-88094 Improper neutralization of special elements in output used by a downstream compo... |
high | 8.1 | — | Microsoft / azure-storage-blob-batch | 2026-10-13 | 2026-11-03 |
| CVE-2026-88096 Concurrent execution using shared resource with improper synchronization ('race... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.