October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
24,538
Critical
3,296
High
7,954
Medium
7,627
Low
740
Severity not reported
4,921
In CISA KEV
191
Most affected vendors (by CPE data where available): microsoft (1424), google (825), linux (722), ibm (323), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (116), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-88126 Untrusted pointer dereference in WebDAV allows an authorized attacker to elevate... |
high | 7.8 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-88114 Untrusted pointer dereference in DNS Server allows an unauthorized attacker to e... |
high | 8.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-88116 Untrusted pointer dereference in DNS Server allows an unauthorized attacker to e... |
high | 8.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-88105 Use after free in Windows Broadcast DVR User Service allows an authorized attack... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-88112 Untrusted pointer dereference in DNS Server allows an unauthorized attacker to e... |
high | 8.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-88096 Concurrent execution using shared resource with improper synchronization ('race... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-88098 Untrusted pointer dereference in Windows Security Support Provider Interface all... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-88103 Use after free in Windows Broadcast DVR User Service allows an authorized attack... |
high | 7.0 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-16 |
| CVE-2026-88091 Deserialization of untrusted data in Windows Management Instrumentation allows a... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-88093 Heap-based buffer overflow in Desktop Window Manager allows an authorized attack... |
high | 7.8 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-16 |
| CVE-2026-88072 Improper access control in Windows Host Guardian Service allows an authorized at... |
high | 7.8 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-16 |
| CVE-2026-88073 Use after free in Windows Graphics Kernel allows an authorized attacker to eleva... |
high | 7.8 | — | Microsoft / windows 10 21h2 | 2026-10-13 | 2026-10-16 |
| CVE-2026-88076 Null pointer dereference in Windows Installer allows an authorized attacker to e... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-88080 Use after free in Windows Installer allows an authorized attacker to elevate pri... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-87713 Use after free in Windows Bluetooth Port Driver allows an unauthorized attacker... |
high | 7.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-87715 Use after free in Windows Installer allows an authorized attacker to elevate pri... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-87716 Heap-based buffer overflow in Windows Storage Spaces Controller allows an unauth... |
high | 7.5 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-16 |
| CVE-2026-88070 Out-of-bounds read in Windows BitLocker allows an authorized attacker to elevate... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-87710 Improper access control in Microsoft Local Security Authority Server (lsasrv) al... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-87711 Stack-based buffer overflow in Windows Installer allows an authorized attacker t... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-87712 Use after free in Windows Quality of Service (QoS) Packet Scheduler allows an au... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-85903 Untrusted pointer dereference in DNS Server allows an unauthorized attacker to e... |
high | 8.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-85827 Heap-based buffer overflow in WebDAV allows an authorized attacker to elevate pr... |
high | 7.0 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-85370 Use after free in WebDAV allows an authorized attacker to elevate privileges loc... |
high | 7.0 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-85362 Release of invalid pointer or reference in Windows Management Instrumentation al... |
high | 7.0 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-83889 Release of invalid pointer or reference in DNS Server allows an authorized attac... |
high | 8.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-83779 Heap-based buffer overflow in Windows Installer allows an authorized attacker to... |
high | 7.8 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-83783 Heap-based buffer overflow in Windows Management Instrumentation allows an autho... |
high | 7.8 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-83775 Concurrent execution using shared resource with improper synchronization ('race... |
high | 7.0 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-83777 Heap-based buffer overflow in Windows Bluetooth Service allows an unauthorized a... |
high | 8.8 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-83778 Heap-based buffer overflow in Microsoft Internet Messaging API allows an unautho... |
high | 8.8 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-83642 Access of resource using incompatible type ('type confusion') in DNS Server allo... |
high | 8.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-70255 Heap-based buffer overflow in Desktop Window Manager allows an authorized attack... |
high | 7.8 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-69963 Heap-based buffer overflow in Microsoft Streaming Service allows an authorized a... |
high | 7.8 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-69964 Use after free in Microsoft Streaming Service allows an authorized attacker to e... |
high | 7.0 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-69867 Out-of-bounds read in SQLite allows an authorized attacker to elevate privileges... |
high | 7.8 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-69736 Concurrent execution using shared resource with improper synchronization ('race... |
high | 7.0 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-19935 The Bluetooth LE host queues received L2CAP connection-oriented channel (CoC) da... |
high | 7.5 | — | — | 2026-10-11 | 2026-10-16 |
| CVE-2026-15102 ADP Desktop SDK contains a vulnerability where sensitive information is transmit... |
high | 7.5 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-19673 ethernet_recv() in subsys/net/l2/ethernet/ethernet.c validates only that the fir... |
high | 7.1 | — | — | 2026-10-14 | 2026-10-16 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.