October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,481
Critical
1,390
High
6,087
Medium
6,446
Low
659
Severity not reported
2,899
In CISA KEV
21
Most affected vendors (by CPE data where available): microsoft (1359), google (759), oracle (376), apple (282), ibm (149), adobe (138), apache (73), imagemagick (72), broadcom (61), freerdp (60)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-70202 Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an auth... |
high | 7.5 | — | Microsoft / sharepoint server | 2026-10-13 | 2026-10-14 |
| CVE-2026-70205 Access of resource using incompatible type ('type confusion') in Windows Ancilla... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-70207 Heap-based buffer overflow in Network Policy Server (NPS) allows an authorized a... |
high | 7.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-70190 Improper link resolution before file access ('link following') in .NET allows an... |
high | 7.3 | — | — | 2026-10-13 | 2026-10-22 |
| CVE-2026-70197 Out-of-bounds write in .NET allows an unauthorized attacker to execute code over... |
high | 8.1 | — | — | 2026-10-13 | 2026-10-25 |
| CVE-2026-70198 Use after free in Windows Push Notifications allows an authorized attacker to el... |
high | 7.0 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-29 |
| CVE-2026-70179 Authentication bypass by spoofing in ASP.NET Core allows an authorized attacker... |
high | 7.5 | — | — | 2026-10-13 | 2026-10-22 |
| CVE-2026-70181 Allocation of resources without limits or throttling in ASP.NET Core allows an u... |
high | 7.5 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-70183 Concurrent execution using shared resource with improper synchronization ('race... |
high | 7.5 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-70184 Improper resolution of path equivalence in Windows Backup Engine allows an autho... |
high | 7.8 | — | Microsoft / windows 10 21h2 | 2026-10-13 | 2026-10-28 |
| CVE-2026-70185 Protection mechanism failure in Windows PowerShell allows an authorized attacker... |
high | 8.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-70186 Deadlock in ASP.NET Core allows an unauthorized attacker to deny service over a... |
high | 7.5 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-70187 Use after free in Remote Desktop Gateway Service allows an unauthorized attacker... |
high | 8.1 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-70172 Untrusted pointer dereference in Windows NTFS allows an authorized attacker to e... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-70174 Improperly implemented security check for standard in .NET allows an unauthorize... |
high | 8.8 | — | — | 2026-10-13 | 2026-10-22 |
| CVE-2026-70175 Improper authentication in ASP.NET Core allows an unauthorized attacker to eleva... |
high | 8.1 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-70176 Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker t... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-22 |
| CVE-2026-70177 Numeric truncation error in Microsoft Windows Search Component allows an authori... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-70164 Use after free in Windows TCP/IP allows an authorized attacker to elevate privil... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-70167 Access of resource using incompatible type ('type confusion') in DNS Server allo... |
high | 8.8 | — | Microsoft / windows server 2022 | 2026-10-13 | 2026-10-16 |
| CVE-2026-70168 Use after free in Windows Ancillary Function Driver for WinSock allows an author... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-70169 Concurrent execution using shared resource with improper synchronization ('race... |
high | 7.0 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-28 |
| CVE-2026-70158 Remote Code Execution in Windows Routing and Remote Access Service (RRAS) allows... |
high | 8.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-70159 Allocation of resources without limits or throttling in ASP.NET Core allows an u... |
high | 7.5 | — | — | 2026-10-13 | 2026-10-22 |
| CVE-2026-70160 Use after free in Windows Kernel allows an authorized attacker to elevate privil... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-22 |
| CVE-2026-70161 Improper limitation of a pathname to a restricted directory ('path traversal') i... |
high | 7.3 | — | — | 2026-10-13 | 2026-10-22 |
| CVE-2026-70163 Allocation of resources without limits or throttling in OpenSSH for Windows allo... |
high | 7.5 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-28 |
| CVE-2026-70149 Exposure of sensitive information to an unauthorized actor in Windows Client Sid... |
high | 8.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-70150 Use after free in Microsoft Windows Search Component allows an authorized attack... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-70151 Use after free in Windows Direct Composition allows an authorized attacker to el... |
high | 7.8 | — | Microsoft / windows 10 21h2 | 2026-10-13 | 2026-10-28 |
| CVE-2026-70155 Missing release of memory after effective lifetime in Windows DNS allows an unau... |
high | 7.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-70156 Use after free in Microsoft Windows Search Component allows an authorized attack... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-70142 Untrusted search path in Windows Update Service allows an authorized attacker to... |
high | 7.8 | — | Microsoft / windows 11 23h2 | 2026-10-13 | 2026-10-28 |
| CVE-2026-70143 Heap-based buffer overflow in Windows Network File System allows an authorized a... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-70144 Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker t... |
high | 7.0 | — | Microsoft / windows 11 23h2 | 2026-10-13 | 2026-10-22 |
| CVE-2026-70136 Use after free in Microsoft Windows Search Component allows an authorized attack... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-70138 Heap-based buffer overflow in Windows OLE allows an authorized attacker to eleva... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-70139 Heap-based buffer overflow in Windows Update Service allows an authorized attack... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-70140 Use after free in Windows Audio Service allows an authorized attacker to elevate... |
high | 7.0 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-28 |
| CVE-2026-70131 Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unaut... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.