October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,481
Critical
1,390
High
6,087
Medium
6,446
Low
659
Severity not reported
2,899
In CISA KEV
21
Most affected vendors (by CPE data where available): microsoft (1359), google (759), oracle (376), apple (282), ibm (149), adobe (138), apache (73), imagemagick (72), broadcom (61), freerdp (60)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-96909 Heap-based buffer overflow in Windows BitLocker allows an unauthorized attacker... |
critical | 9.8 | — | Microsoft / windows 11 23h2 | 2026-10-13 | 2026-10-16 |
| CVE-2026-96864 Double free in Microsoft Failover Cluster Virtual Driver allows an unauthorized... |
critical | 9.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-96320 Heap-based buffer overflow in Windows DHCP Server allows an unauthorized attacke... |
critical | 9.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-96252 Improper verification of cryptographic signature in Active Directory Federation... |
critical | 9.1 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-20 |
| CVE-2026-96219 Out-of-bounds write in Windows Local Security Authority Subsystem Service (LSASS... |
critical | 9.8 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-11-03 |
| CVE-2026-96096 Heap-based buffer overflow in Windows Media Player allows an unauthorized attack... |
critical | 9.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-96113 Heap-based buffer overflow in DNS Server allows an unauthorized attacker to exec... |
critical | 9.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-91013 Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability... |
critical | 9.3 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-92464 Adobe Commerce is affected by an Improper Input Validation vulnerability that co... |
critical | 9.1 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-92909 Adobe Commerce is affected by an Incorrect Authorization vulnerability that coul... |
critical | 9.8 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-88178 Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to... |
critical | 9.8 | — | Microsoft / 365 apps | 2026-10-13 | 2026-10-15 |
| CVE-2026-88156 Stack-based buffer overflow in Microsoft Office Outlook allows an unauthorized a... |
critical | 9.8 | — | Microsoft / 365 apps | 2026-10-13 | 2026-10-15 |
| CVE-2026-88102 Use after free in Windows Failover Cluster allows an unauthorized attacker to ex... |
critical | 9.8 | — | Microsoft / windows server 2019 | 2026-10-13 | 2026-10-16 |
| CVE-2026-88092 Inconsistent interpretation of http requests ('http request/response smuggling')... |
critical | 9.4 | — | Microsoft / asp.net core | 2026-10-13 | 2026-10-16 |
| CVE-2026-85928 Heap-based buffer overflow in Windows Volume Manager Extension Driver allows an... |
critical | 9.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-85818 Improper verification of cryptographic signature in Windows Schannel allows an u... |
critical | 9.0 | — | Microsoft / windows 11 23h2 | 2026-10-13 | 2026-10-16 |
| CVE-2026-85809 Remote Code Execution in Windows Routing and Remote Access Service (RRAS) allows... |
critical | 9.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-85814 Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unaut... |
critical | 9.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-85806 Integer underflow (wrap or wraparound) in Network Policy Server (NPS) allows an... |
critical | 9.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-85792 Remote Code Execution in Windows Routing and Remote Access Service (RRAS) allows... |
critical | 9.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-84015 Heap-based buffer overflow in Remote Access Point-to-Point Protocol (PPP) EAP-TL... |
critical | 9.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-19 |
| CVE-2026-83935 Heap-based buffer overflow in Microsoft XML allows an unauthorized attacker to e... |
critical | 9.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-19 |
| CVE-2026-83910 Out-of-bounds write in RPC Runtime allows an unauthorized attacker to execute co... |
critical | 9.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83888 Buffer over-read in Windows CD-ROM Driver allows an unauthorized attacker to ele... |
critical | 9.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-21 |
| CVE-2026-83869 Integer underflow (wrap or wraparound) in DNS Server allows an unauthorized atta... |
critical | 9.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-83789 Heap-based buffer overflow in Windows SMB Client allows an unauthorized attacker... |
critical | 9.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-83782 Heap-based buffer overflow in Windows Shell allows an unauthorized attacker to e... |
critical | 9.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-11-02 |
| CVE-2026-83780 Use after free in Windows CCFFilter Driver allows an unauthorized attacker to ex... |
critical | 9.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-11-02 |
| CVE-2026-83770 Heap-based buffer overflow in Windows Text Shaping allows an unauthorized attack... |
critical | 9.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-11-02 |
| CVE-2026-83748 Heap-based buffer overflow in Windows Error Reporting allows an unauthorized att... |
critical | 9.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83693 Heap-based buffer overflow in Windows Error Reporting allows an unauthorized att... |
critical | 9.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83578 Integer underflow (wrap or wraparound) in Windows PowerShell allows an unauthori... |
critical | 9.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83523 Heap-based buffer overflow in Windows Image Acquisition allows an unauthorized a... |
critical | 9.8 | — | Microsoft / windows 11 24h2 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83517 Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unaut... |
critical | 9.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83519 Heap-based buffer overflow in Windows Error Reporting allows an unauthorized att... |
critical | 9.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-70300 Untrusted pointer dereference in Microsoft Office Word allows an unauthorized at... |
critical | 9.8 | — | Microsoft / 365 apps | 2026-10-13 | 2026-10-14 |
| CVE-2026-70291 Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized at... |
critical | 9.8 | — | Microsoft / 365 apps | 2026-10-13 | 2026-10-15 |
| CVE-2026-70279 Improper neutralization of input during web page generation ('cross-site scripti... |
critical | 9.3 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-70275 Untrusted pointer dereference in Windows CD-ROM Driver allows an unauthorized at... |
critical | 9.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-70262 Heap-based buffer overflow in WebDAV allows an unauthorized attacker to elevate... |
critical | 9.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.