October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 29, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
22,229
Critical
3,102
High
7,094
Medium
6,630
Low
674
Severity not reported
4,729
In CISA KEV
188
Most affected vendors (by CPE data where available): microsoft (1176), google (780), ibm (323), mozilla (182), oracle (154), adobe (137), linux (126), apache (116), broadcom (113), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2025-62207 Azure Monitor Elevation of Privilege Vulnerability |
critical | 9.8 | — | Microsoft / azure monitor | 2025-11-20 | 2026-10-18 |
| CVE-2025-64655 Improper authorization in Dynamics OmniChannel SDK Storage Containers allows an... |
critical | 9.8 | — | Microsoft / dynamics omnichannel sdk storage containers | 2025-11-20 | 2026-10-18 |
| CVE-2025-64656 Out-of-bounds read in Application Gateway allows an unauthorized attacker to ele... |
critical | 9.8 | — | Microsoft / azure application gateway | 2025-11-26 | 2026-10-18 |
| CVE-2026-62834 Improper verification of cryptographic signature in Azure Data Factory allows an... |
critical | 9.8 | — | Microsoft / azure data factory | 2026-08-20 | 2026-10-18 |
| CVE-2026-85818 Improper verification of cryptographic signature in Windows Schannel allows an u... |
critical | 9.0 | — | Microsoft / windows 11 23h2 | 2026-10-13 | 2026-10-16 |
| CVE-2026-85806 Integer underflow (wrap or wraparound) in Network Policy Server (NPS) allows an... |
critical | 9.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-85809 Remote Code Execution in Windows Routing and Remote Access Service (RRAS) allows... |
critical | 9.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-96924 Untrusted pointer dereference in Windows OLE allows an unauthorized attacker to... |
critical | 9.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-85814 Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unaut... |
critical | 9.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-70024 Stack-based buffer overflow in Windows Internet Information Services allows an u... |
critical | 9.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-85792 Remote Code Execution in Windows Routing and Remote Access Service (RRAS) allows... |
critical | 9.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-69886 Heap-based buffer overflow in Windows Imaging Component allows an unauthorized a... |
critical | 9.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-97816 Use after free in OpenSSH for Windows allows an unauthorized attacker to execute... |
critical | 9.8 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-16 |
| CVE-2026-97814 Heap-based buffer overflow in Windows Text Shaping allows an unauthorized attack... |
critical | 9.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-97815 Heap-based buffer overflow in Windows Error Reporting allows an unauthorized att... |
critical | 9.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-97805 Out-of-bounds read in Windows Partition Management Driver allows an unauthorized... |
critical | 9.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-96219 Out-of-bounds write in Windows Local Security Authority Subsystem Service (LSASS... |
critical | 9.8 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-16 |
| CVE-2026-96096 Heap-based buffer overflow in Windows Media Player allows an unauthorized attack... |
critical | 9.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-83869 Integer underflow (wrap or wraparound) in DNS Server allows an unauthorized atta... |
critical | 9.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-88092 Inconsistent interpretation of http requests ('http request/response smuggling')... |
critical | 9.4 | — | Microsoft / asp.net core | 2026-10-13 | 2026-10-16 |
| CVE-2026-88102 Use after free in Windows Failover Cluster allows an unauthorized attacker to ex... |
critical | 9.8 | — | Microsoft / windows server 2019 | 2026-10-13 | 2026-10-16 |
| CVE-2026-96320 Heap-based buffer overflow in Windows DHCP Server allows an unauthorized attacke... |
critical | 9.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-96909 Heap-based buffer overflow in Windows BitLocker allows an unauthorized attacker... |
critical | 9.8 | — | Microsoft / windows 11 23h2 | 2026-10-13 | 2026-10-16 |
| CVE-2026-96113 Heap-based buffer overflow in DNS Server allows an unauthorized attacker to exec... |
critical | 9.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-96934 Use after free in Windows DHCP Server allows an unauthorized attacker to execute... |
critical | 9.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-88178 Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to... |
critical | 9.8 | — | Microsoft / 365 apps | 2026-10-13 | 2026-10-15 |
| CVE-2026-88156 Stack-based buffer overflow in Microsoft Office Outlook allows an unauthorized a... |
critical | 9.8 | — | Microsoft / 365 apps | 2026-10-13 | 2026-10-15 |
| CVE-2026-70291 Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized at... |
critical | 9.8 | — | Microsoft / 365 apps | 2026-10-13 | 2026-10-15 |
| CVE-2026-88131 Deserialization of untrusted data in Microsoft Dataverse allows an unauthorized... |
critical | 9.8 | — | Microsoft / dataverse | 2026-10-08 | 2026-10-15 |
| CVE-2026-96207 Improper certificate validation in Microsoft Partner Center allows an unauthoriz... |
critical | 10.0 | — | Microsoft / partner center | 2026-10-08 | 2026-10-15 |
| CVE-2026-70242 Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized at... |
critical | 9.8 | — | Microsoft / 365 apps | 2026-10-13 | 2026-10-15 |
| CVE-2026-97016 Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized at... |
critical | 9.8 | — | Microsoft / 365 apps | 2026-10-13 | 2026-10-15 |
| CVE-2026-97749 Double free in Microsoft Office Outlook allows an unauthorized attacker to execu... |
critical | 9.8 | — | Microsoft / 365 apps | 2026-10-13 | 2026-10-15 |
| CVE-2026-57090 Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unaut... |
critical | 9.8 | — | Microsoft / windows 10 1607 | 2026-07-14 | 2026-10-14 |
| CVE-2025-64672 Improper neutralization of input during web page generation ('cross-site scripti... |
critical | 9.0 | — | Microsoft / sharepoint server | 2025-12-09 | 2026-10-14 |
| CVE-2026-70300 Untrusted pointer dereference in Microsoft Office Word allows an unauthorized at... |
critical | 9.8 | — | Microsoft / 365 apps | 2026-10-13 | 2026-10-14 |
| CVE-2026-45495 Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability |
critical | 9.8 | — | Microsoft / edge chromium | 2026-05-18 | 2026-10-14 |
| CVE-2026-83711 Authorization bypass through user-controlled key in Microsoft Azure Active Direc... |
critical | 10.0 | — | Microsoft / azure active directory b2c | 2026-09-03 | 2026-10-14 |
| CVE-2026-70352 Missing authentication for critical function in Azure AI Language allows an unau... |
critical | 10.0 | — | Microsoft / azure ai language authoring | 2026-09-03 | 2026-10-14 |
| CVE-2025-59247 Azure PlayFab Elevation of Privilege Vulnerability |
critical | 9.8 | — | Microsoft / azure playfab | 2025-10-09 | 2026-10-08 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.