October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,481
Critical
1,390
High
6,087
Medium
6,446
Low
659
Severity not reported
2,899
In CISA KEV
21
Most affected vendors (by CPE data where available): microsoft (1359), google (759), oracle (382), apple (282), ibm (149), adobe (138), apache (73), imagemagick (72), broadcom (61), freerdp (60)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-105596 Heap-based buffer overflow in Microsoft Office Access allows an unauthorized att... |
high | 8.8 | — | Microsoft / 365 apps | 2026-10-13 | 2026-10-15 |
| CVE-2026-105597 Heap-based buffer overflow in Microsoft Office Access allows an unauthorized att... |
high | 8.8 | — | Microsoft / 365 apps | 2026-10-13 | 2026-10-15 |
| CVE-2026-105598 Heap-based buffer overflow in Microsoft Office Access allows an unauthorized att... |
high | 8.8 | — | Microsoft / 365 apps | 2026-10-13 | 2026-10-15 |
| CVE-2026-105599 Heap-based buffer overflow in Microsoft Office PowerPoint allows an unauthorized... |
high | 7.5 | — | Microsoft / 365 apps | 2026-10-13 | 2026-10-15 |
| CVE-2026-105009 Incorrect default permissions in Windows Server Update Service allows an authori... |
high | 7.5 | — | Microsoft / windows server 2012 | 2026-10-13 | 2026-10-26 |
| CVE-2026-105013 Deserialization of untrusted data in Microsoft Office SharePoint allows an autho... |
high | 7.4 | — | Microsoft / sharepoint server | 2026-10-13 | 2026-10-14 |
| CVE-2026-104937 Shopware version 6.7 allows the upload of attacker‑controlled HTML files and ser... |
high | 8.1 | — | — | 2026-10-13 | 2026-10-20 |
| CVE-2026-105003 Heap-based buffer overflow in HID class driver allows an authorized attacker to... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-27 |
| CVE-2026-105004 Out-of-bounds read in Windows Overlay Filter allows an authorized attacker to el... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-26 |
| CVE-2026-105005 Out-of-bounds write in Windows Schannel allows an unauthorized attacker to execu... |
high | 8.1 | — | Microsoft / windows 11 26h1 | 2026-10-13 | 2026-10-26 |
| CVE-2026-105007 An elevation of privilege vulnerability exists in the Network Driver Interface S... |
high | 8.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-27 |
| CVE-2026-104342 Adobe Framemaker is affected by a Use After Free vulnerability that could result... |
high | 7.8 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-104344 Adobe Framemaker is affected by a Heap-based Buffer Overflow vulnerability that... |
high | 7.8 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-104875 Ente provides end-to-end encrypted cloud services and security tools. |
high | 7.1 | — | — | 2026-10-13 | 2026-10-29 |
| CVE-2026-103966 Adobe Framemaker is affected by a Heap-based Buffer Overflow vulnerability that... |
high | 7.8 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-103967 Adobe Framemaker is affected by an out-of-bounds write vulnerability that could... |
high | 7.8 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-104340 Adobe Framemaker is affected by a Heap-based Buffer Overflow vulnerability that... |
high | 7.8 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-104341 Adobe Framemaker is affected by an out-of-bounds write vulnerability that could... |
high | 7.8 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-103569 Out-of-bounds read in Windows IKE Extension allows an unauthorized attacker to d... |
high | 7.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-26 |
| CVE-2026-103572 Improper control of generation of code ('code injection') in Visual Studio Tools... |
high | 8.8 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-103575 Use after free in Remote Desktop Client allows an unauthorized attacker to execu... |
high | 8.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-27 |
| CVE-2026-103577 Insecure default variable initialization in Microsoft QUIC allows an unauthorize... |
high | 7.5 | — | Microsoft / windows 11 23h2 | 2026-10-13 | 2026-10-27 |
| CVE-2026-103555 Heap-based buffer overflow in Virtual Hard Disk (VHD) Miniport Driver allows an... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-27 |
| CVE-2026-103558 Deadlock in Windows Routing and Remote Access Service (RRAS) allows an unauthori... |
high | 7.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-26 |
| CVE-2026-103565 Use after free in Windows Broadcast DVR User Service allows an authorized attack... |
high | 7.0 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-26 |
| CVE-2026-103568 Concurrent execution using shared resource with improper synchronization ('race... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-26 |
| CVE-2026-102866 Improper verification of cryptographic signature in Microsoft Office SharePoint... |
high | 8.1 | — | Microsoft / sharepoint server | 2026-10-13 | 2026-10-14 |
| CVE-2026-102869 Access of resource using incompatible type ('type confusion') in .NET and Visual... |
high | 8.8 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-102870 Improper control of generation of code ('code injection') in ASP.NET Core allows... |
high | 8.8 | — | — | 2026-10-13 | 2026-10-25 |
| CVE-2026-103553 Out-of-bounds read in Windows Partition Management Driver allows an authorized a... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-26 |
| CVE-2026-103554 Use after free in Windows Broadcast DVR User Service allows an authorized attack... |
high | 7.0 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-26 |
| CVE-2026-102857 Heap-based buffer overflow in Microsoft Office Visio allows an unauthorized atta... |
high | 8.8 | — | Microsoft / 365 apps | 2026-10-13 | 2026-10-15 |
| CVE-2026-102858 Heap-based buffer overflow in Microsoft Office OneNote allows an unauthorized at... |
high | 8.8 | — | Microsoft / microsoft 365 | 2026-10-13 | 2026-10-15 |
| CVE-2026-102860 Improper access control in Microsoft Office SharePoint allows an authorized atta... |
high | 8.8 | — | Microsoft / sharepoint server | 2026-10-13 | 2026-10-14 |
| CVE-2026-102861 Missing authorization in Microsoft Office SharePoint allows an authorized attack... |
high | 8.8 | — | Microsoft / sharepoint server | 2026-10-13 | 2026-10-14 |
| CVE-2026-102862 Incorrect authorization in Microsoft Office SharePoint allows an authorized atta... |
high | 8.8 | — | Microsoft / sharepoint server | 2026-10-13 | 2026-10-14 |
| CVE-2026-102863 Improper control of generation of code ('code injection') in Microsoft Office Sh... |
high | 8.8 | — | Microsoft / sharepoint server | 2026-10-13 | 2026-10-14 |
| CVE-2026-102599 Socket.IO enables bidirectional and low-latency communication for every platform... |
high | 7.5 | — | — | 2026-10-13 | 2026-10-17 |
| CVE-2026-102849 Heap-based buffer overflow in Microsoft Office Access allows an unauthorized att... |
high | 8.8 | — | Microsoft / 365 apps | 2026-10-13 | 2026-10-15 |
| CVE-2026-102850 Heap-based buffer overflow in Microsoft Office Access allows an unauthorized att... |
high | 8.8 | — | Microsoft / 365 apps | 2026-10-13 | 2026-10-15 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.