October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,481
Critical
1,390
High
6,087
Medium
6,446
Low
659
Severity not reported
2,899
In CISA KEV
21
Most affected vendors (by CPE data where available): microsoft (1359), google (759), oracle (376), apple (282), ibm (149), adobe (138), apache (73), imagemagick (72), broadcom (61), freerdp (60)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-85367 Use after free in Windows Cash Drawer Protocol Provider allows an authorized att... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-85368 Heap-based buffer overflow in Windows TCP/IP allows an authorized attacker to el... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-85369 Out-of-bounds read in Windows Hyper-V allows an authorized attacker to elevate p... |
high | 8.8 | — | Microsoft / windows 10 21h2 | 2026-10-13 | 2026-10-28 |
| CVE-2026-85370 Use after free in WebDAV allows an authorized attacker to elevate privileges loc... |
high | 7.0 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-85371 Use after free in Network Policy Server (NPS) allows an unauthorized attacker to... |
high | 8.1 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-85361 Use after free in Windows Installer allows an authorized attacker to elevate pri... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-85362 Release of invalid pointer or reference in Windows Management Instrumentation al... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-85363 Integer overflow or wraparound in .NET Framework allows an unauthorized attacker... |
high | 8.8 | — | — | 2026-10-13 | 2026-10-22 |
| CVE-2026-85364 Use after free in Windows Installer allows an authorized attacker to elevate pri... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-85365 Heap-based buffer overflow in Servicing Stack Updates allows an authorized attac... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-85366 Heap-based buffer overflow in Windows Installer allows an authorized attacker to... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-85355 Inclusion of functionality from untrusted control sphere in Windows Common Log F... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-85356 Out-of-bounds read in Windows Volume Manager Extension Driver allows an authoriz... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-85357 Concurrent execution using shared resource with improper synchronization ('race... |
high | 7.0 | — | Microsoft / windows 11 23h2 | 2026-10-13 | 2026-10-28 |
| CVE-2026-85358 Heap-based buffer overflow in Windows Installer allows an authorized attacker to... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-85359 Improper control of generation of code ('code injection') in Windows Performance... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-85341 Heap-based buffer overflow in Windows USB Video Driver allows an authorized atta... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-85342 Use after free in Windows Device Association Service allows an authorized attack... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-85343 Improper link resolution before file access ('link following') in Windows Hyper-... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-85352 Use after free in Windows Device Association Service allows an authorized attack... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-85353 Out-of-bounds read in Windows Print Spooler Components allows an unauthorized at... |
high | 7.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-85354 Use after free in Windows Error Reporting allows an authorized attacker to eleva... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-85334 Out-of-bounds read in Windows Message Queuing Queue Manager allows an unauthoriz... |
high | 7.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-85338 Out-of-bounds read in Microsoft Graphics Component allows an authorized attacker... |
high | 7.8 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-17 |
| CVE-2026-85339 Remote Code Execution in Windows Routing and Remote Access Service (RRAS) allows... |
high | 8.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-85340 Use after free in Microsoft Office Click-To-Run allows an authorized attacker to... |
high | 7.8 | — | Microsoft / 365 apps | 2026-10-13 | 2026-10-15 |
| CVE-2026-85329 Concurrent execution using shared resource with improper synchronization ('race... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-85332 Use after free in Windows Device Association Service allows an authorized attack... |
high | 7.8 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-16 |
| CVE-2026-85333 Concurrent execution using shared resource with improper synchronization ('race... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-85327 Heap-based buffer overflow in Windows Print Spooler Components allows an authori... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-85328 Weak authentication in Windows Projected File System allows an authorized attack... |
high | 7.0 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-16 |
| CVE-2026-85319 Allocation of resources without limits or throttling in Active Directory Federat... |
high | 7.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-85321 Allocation of resources without limits or throttling in Active Directory Federat... |
high | 7.5 | — | Microsoft / windows server 2012 | 2026-10-13 | 2026-10-29 |
| CVE-2026-85322 Use of uninitialized resource in Windows Routing and Remote Access Service (RRAS... |
high | 7.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-85324 Memory allocation with excessive size value in Active Directory Federation Servi... |
high | 7.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-84017 Null pointer dereference in Windows Routing and Remote Access Service (RRAS) all... |
high | 7.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-19 |
| CVE-2026-84018 Use after free in Windows Print Spooler Components allows an authorized attacker... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-19 |
| CVE-2026-84019 Use after free in Windows Advanced Rasterization Platform allows an authorized a... |
high | 7.0 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-19 |
| CVE-2026-84020 Use after free in Windows Routing and Remote Access Service (RRAS) allows an aut... |
high | 7.0 | — | Microsoft / windows 10 21h2 | 2026-10-13 | 2026-10-19 |
| CVE-2026-85318 Heap-based buffer overflow in Servicing Stack Updates allows an authorized attac... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.