October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 29, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
22,229
Critical
3,102
High
7,094
Medium
6,630
Low
674
Severity not reported
4,729
In CISA KEV
188
Most affected vendors (by CPE data where available): microsoft (1176), google (780), ibm (323), mozilla (182), oracle (154), adobe (137), linux (126), apache (116), broadcom (113), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-88219 Untrusted pointer dereference in RPC Runtime allows an unauthorized attacker to... |
high | 8.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-20 |
| CVE-2026-96246 Out-of-bounds read in Network Policy Server (NPS) allows an unauthorized attacke... |
high | 7.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-20 |
| CVE-2026-96856 Heap-based buffer overflow in Windows Management Instrumentation allows an autho... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-20 |
| CVE-2026-108443 Off-by-one error in Microsoft Office Word allows an unauthorized attacker to exe... |
high | 8.8 | — | Microsoft / 365 apps | 2026-10-15 | 2026-10-19 |
| CVE-2026-108444 Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker t... |
high | 8.8 | — | Microsoft / 365 apps | 2026-10-15 | 2026-10-19 |
| CVE-2026-108445 Stack-based buffer overflow in Microsoft Office Word allows an unauthorized atta... |
high | 8.8 | — | Microsoft / 365 apps | 2026-10-15 | 2026-10-19 |
| CVE-2026-108446 Use after free in Microsoft Office Excel allows an unauthorized attacker to exec... |
high | 8.8 | — | Microsoft / 365 apps | 2026-10-15 | 2026-10-19 |
| CVE-2026-108447 Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attac... |
high | 8.8 | — | Microsoft / 365 apps | 2026-10-15 | 2026-10-19 |
| CVE-2026-108448 Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized at... |
high | 7.5 | — | Microsoft / 365 apps | 2026-10-15 | 2026-10-19 |
| CVE-2026-108449 Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attac... |
high | 8.8 | — | Microsoft / 365 apps | 2026-10-15 | 2026-10-19 |
| CVE-2026-108450 Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attac... |
high | 8.8 | — | Microsoft / 365 apps | 2026-10-15 | 2026-10-19 |
| CVE-2026-108451 Numeric truncation error in Microsoft Office Word allows an unauthorized attacke... |
high | 8.8 | — | Microsoft / 365 apps | 2026-10-15 | 2026-10-19 |
| CVE-2026-108452 Improper limitation of a pathname to a restricted directory ('path traversal') i... |
high | 8.8 | — | Microsoft / sharepoint server | 2026-10-15 | 2026-10-19 |
| CVE-2026-70012 Use after free in Remote Desktop Client allows an unauthorized attacker to execu... |
high | 7.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-19 |
| CVE-2026-83934 Stack-based buffer overflow in Windows GDI+ allows an unauthorized attacker to e... |
high | 8.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-19 |
| CVE-2026-84012 Double free in Remote Desktop Gateway Service allows an unauthorized attacker to... |
high | 8.1 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-19 |
| CVE-2026-84013 Use after free in Windows Telephony Server allows an authorized attacker to elev... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-19 |
| CVE-2026-84014 Heap-based buffer overflow in Windows Device Association Service allows an autho... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-19 |
| CVE-2026-84016 Out-of-bounds write in Windows EAPHost Service allows an authorized attacker to... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-19 |
| CVE-2026-84017 Null pointer dereference in Windows Routing and Remote Access Service (RRAS) all... |
high | 7.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-19 |
| CVE-2026-84018 Use after free in Windows Print Spooler Components allows an authorized attacker... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-19 |
| CVE-2026-84019 Use after free in Windows Advanced Rasterization Platform allows an authorized a... |
high | 7.0 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-19 |
| CVE-2026-84020 Use after free in Windows Routing and Remote Access Service (RRAS) allows an aut... |
high | 7.0 | — | Microsoft / windows 10 21h2 | 2026-10-13 | 2026-10-19 |
| CVE-2026-69880 Access of resource using incompatible type ('type confusion') in Desktop Window... |
high | 7.8 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-19 |
| CVE-2026-69882 Untrusted search path in Windows Update allows an authorized attacker to elevate... |
high | 7.8 | — | Microsoft / windows 11 23h2 | 2026-10-13 | 2026-10-19 |
| CVE-2026-69991 Use after free in Remote Desktop Client allows an unauthorized attacker to execu... |
high | 7.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-19 |
| CVE-2026-69992 Use after free in Windows Remote Desktop Services allows an unauthorized attacke... |
high | 7.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-19 |
| CVE-2026-69994 Use after free in Remote Desktop Client allows an unauthorized attacker to execu... |
high | 7.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-19 |
| CVE-2026-69995 Use after free in Remote Desktop Client allows an unauthorized attacker to execu... |
high | 7.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-19 |
| CVE-2026-69996 Use after free in Remote Desktop Client allows an unauthorized attacker to execu... |
high | 7.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-19 |
| CVE-2026-69997 Use after free in Remote Desktop Client allows an unauthorized attacker to execu... |
high | 7.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-19 |
| CVE-2026-69998 Use after free in Remote Desktop Client allows an unauthorized attacker to execu... |
high | 7.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-19 |
| CVE-2026-70004 Use after free in Remote Desktop Client allows an unauthorized attacker to execu... |
high | 7.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-19 |
| CVE-2026-70013 Use after free in Windows iSCSI allows an unauthorized attacker to execute code... |
high | 8.1 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-19 |
| CVE-2026-88101 Weak authentication in Microsoft Input Method Editor (IME) allows an authorized... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-17 |
| CVE-2026-85338 Out-of-bounds read in Microsoft Graphics Component allows an authorized attacker... |
high | 7.8 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-17 |
| CVE-2026-96915 Integer overflow or wraparound in Windows Kernel-Mode Drivers allows an authoriz... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-85817 Reliance on untrusted inputs in a security decision in Windows PowerShell allows... |
high | 8.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-85820 Use after free in Windows Universal Disk Format File System Driver (UDFS) allows... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-85822 Heap-based buffer overflow in Windows exFAT File System allows an authorized att... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.