October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 29, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
22,229
Critical
3,102
High
7,094
Medium
6,630
Low
674
Severity not reported
4,729
In CISA KEV
188
Most affected vendors (by CPE data where available): microsoft (1176), google (780), ibm (323), mozilla (182), oracle (154), adobe (137), linux (126), apache (116), broadcom (113), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-47304 Improper verification of cryptographic signature in .NET allows an unauthorized... |
critical | 9.8 | — | Microsoft / .net framework | 2026-07-14 | 2026-10-28 |
| CVE-2026-83789 Heap-based buffer overflow in Windows SMB Client allows an unauthorized attacker... |
critical | 9.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-70153 Heap-based buffer overflow in Microsoft PostScript Printer Driver allows an unau... |
critical | 9.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-70147 Heap-based buffer overflow in Microsoft PostScript Printer Driver allows an unau... |
critical | 9.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-70262 Heap-based buffer overflow in WebDAV allows an unauthorized attacker to elevate... |
critical | 9.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-70275 Untrusted pointer dereference in Windows CD-ROM Driver allows an unauthorized at... |
critical | 9.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-70157 Heap-based buffer overflow in Windows System Information Console allows an unaut... |
critical | 9.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-96864 Double free in Microsoft Failover Cluster Virtual Driver allows an unauthorized... |
critical | 9.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-85928 Heap-based buffer overflow in Windows Volume Manager Extension Driver allows an... |
critical | 9.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-105008 No cwe for this issue in Windows Schannel allows an unauthorized attacker to per... |
critical | 9.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-27 |
| CVE-2026-26150 Server-side request forgery (ssrf) in Microsoft Purview allows an unauthorized a... |
critical | 10.0 | — | Microsoft / purview ediscovery | 2026-04-23 | 2026-10-26 |
| CVE-2026-33819 Deserialization of untrusted data in Microsoft Bing allows an unauthorized attac... |
critical | 9.8 | — | Microsoft / bing | 2026-04-23 | 2026-10-26 |
| CVE-2026-35435 Improper access control in Azure AI Foundry M365 published agents allows an unau... |
critical | 10.0 | — | Microsoft / azure ai foundry | 2026-05-07 | 2026-10-26 |
| CVE-2026-33821 Improper privilege management in Microsoft Dynamics 365 Customer Insights allows... |
critical | 9.9 | — | Microsoft / dynamics 365 customer insights | 2026-05-12 | 2026-10-26 |
| CVE-2026-105723 Untrusted pointer dereference in Windows Distributed File System (DFS) allows an... |
critical | 9.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-26 |
| CVE-2026-69634 Heap-based buffer overflow in Windows iSCSI allows an unauthorized attacker to e... |
critical | 9.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-26 |
| CVE-2026-69639 Heap-based buffer overflow in Windows Libarchive allows an unauthorized attacker... |
critical | 9.8 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-26 |
| CVE-2026-105010 Use after free in Microsoft Windows Search Component allows an unauthorized atta... |
critical | 9.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-26 |
| CVE-2026-26145 Improper access control in Azure Synapse allows an authorized attacker to elevat... |
critical | 9.8 | — | Microsoft / azure synapse | 2026-07-02 | 2026-10-25 |
| CVE-2026-41106 Url redirection to untrusted site ('open redirect') in M365 Copilot allows an un... |
critical | 9.3 | — | Microsoft / 365 copilot | 2026-07-02 | 2026-10-25 |
| CVE-2026-57983 Improper authorization in Microsoft Edge (Chromium-based) allows an unauthorized... |
critical | 10.0 | — | Microsoft / edge chromium | 2026-07-03 | 2026-10-25 |
| CVE-2026-58617 Improper access control in Microsoft 365 Copilot for iOS allows an unauthorized... |
critical | 9.8 | — | Microsoft / 365 copilot | 2026-07-14 | 2026-10-24 |
| CVE-2026-62836 Improper restriction of communication channel to intended endpoints in Azure SQL... |
critical | 10.0 | — | Microsoft / azure sql managed instance | 2026-08-07 | 2026-10-24 |
| CVE-2026-57104 Improper neutralization of input during web page generation ('cross-site scripti... |
critical | 9.6 | — | Microsoft / azure storage explorer | 2026-08-11 | 2026-10-24 |
| CVE-2026-65768 Improper limitation of a pathname to a restricted directory ('path traversal') i... |
critical | 9.8 | — | Microsoft / teams | 2026-08-11 | 2026-10-24 |
| CVE-2026-56160 Improper authorization in Azure Red Hat OpenShift (ARO) allows an authorized att... |
critical | 9.9 | — | Microsoft / azure red hat openshift | 2026-07-24 | 2026-10-24 |
| CVE-2026-58275 Missing authorization in Azure DNS allows an unauthorized attacker to elevate pr... |
critical | 9.8 | — | Microsoft / azure dns | 2026-07-24 | 2026-10-24 |
| CVE-2026-62825 Improper authentication in Azure Key Vault allows an unauthorized attacker to el... |
critical | 9.8 | — | Microsoft / azure key vault | 2026-07-24 | 2026-10-24 |
| CVE-2026-58630 Improper access control in Azure App Service allows an unauthorized attacker to... |
critical | 9.8 | — | Microsoft / azure app service for linux | 2026-07-24 | 2026-10-24 |
| CVE-2026-66321 Access of resource using incompatible type ('type confusion') in Microsoft Edge... |
critical | 9.6 | — | Microsoft / edge chromium | 2026-08-04 | 2026-10-23 |
| CVE-2026-83888 Buffer over-read in Windows CD-ROM Driver allows an unauthorized attacker to ele... |
critical | 9.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-21 |
| CVE-2026-102210 Heap-based buffer overflow in Windows Text Shaping allows an unauthorized attack... |
critical | 9.8 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-20 |
| CVE-2026-100202 Use after free in Windows Message Queuing Queue Manager allows an unauthorized a... |
critical | 9.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-20 |
| CVE-2026-100219 Use after free in Microsoft QUIC allows an unauthorized attacker to execute code... |
critical | 9.8 | — | Microsoft / windows 11 23h2 | 2026-10-13 | 2026-10-20 |
| CVE-2026-100222 Heap-based buffer overflow in Network Policy Server (NPS) allows an unauthorized... |
critical | 9.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-20 |
| CVE-2026-96252 Improper verification of cryptographic signature in Active Directory Federation... |
critical | 9.1 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-20 |
| CVE-2026-83935 Heap-based buffer overflow in Microsoft XML allows an unauthorized attacker to e... |
critical | 9.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-19 |
| CVE-2026-84015 Heap-based buffer overflow in Remote Access Point-to-Point Protocol (PPP) EAP-TL... |
critical | 9.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-19 |
| CVE-2026-69883 Use after free in Windows iSCSI allows an unauthorized attacker to execute code... |
critical | 9.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-19 |
| CVE-2025-54914 Azure Networking Elevation of Privilege Vulnerability |
critical | 9.8 | — | Microsoft / azure networking | 2025-09-04 | 2026-10-18 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.