October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 29, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
22,229
Critical
3,102
High
7,094
Medium
6,630
Low
674
Severity not reported
4,729
In CISA KEV
188
Most affected vendors (by CPE data where available): microsoft (1176), google (780), ibm (323), mozilla (182), oracle (154), adobe (137), linux (126), apache (116), broadcom (113), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-57099 Allocation of resources without limits or throttling in ASP.NET Core allows an u... |
high | 7.5 | — | Microsoft / asp.net core odata | 2026-09-08 | 2026-10-05 |
| CVE-2026-55007 Double free in Microsoft Exchange Server allows an unauthorized attacker to exec... |
high | 8.1 | — | Microsoft / exchange server | 2026-09-08 | 2026-10-05 |
| CVE-2026-47297 Deserialization of untrusted data in SQL Server allows an unauthorized attacker... |
high | 8.1 | — | Microsoft / sql server 2019 | 2026-09-08 | 2026-10-02 |
| CVE-2026-58600 Heap-based buffer overflow in Microsoft Windows Codecs Library allows an unautho... |
high | 7.8 | — | Microsoft / hevc video extensions | 2026-09-08 | 2026-10-01 |
| CVE-2026-58599 Heap-based buffer overflow in Microsoft Windows Codecs Library allows an unautho... |
high | 7.8 | — | Microsoft / hevc video extensions | 2026-09-08 | 2026-10-01 |
| CVE-2026-69594 Heap-based buffer overflow in Microsoft Local Security Authority Server (lsasrv)... |
high | 7.8 | — | Microsoft / windows 11 24h2 | 2026-09-08 | 2026-10-01 |
| CVE-2026-69576 Use after free in Graphic Fonts allows an authorized attacker to elevate privile... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-10-01 |
| CVE-2026-69549 Out-of-bounds read in Virtual Hard Disk (VHD) Miniport Driver allows an authoriz... |
high | 7.0 | — | Microsoft / windows 10 1809 | 2026-09-08 | 2026-10-01 |
| CVE-2026-69546 Use after free in Active Directory Domain Services allows an unauthorized attack... |
high | 8.1 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-10-01 |
| CVE-2026-69541 Heap-based buffer overflow in Virtual Hard Disk (VHD) Miniport Driver allows an... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-10-01 |
| CVE-2026-69524 Use after free in Active Directory Domain Services allows an unauthorized attack... |
high | 8.1 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-10-01 |
| CVE-2026-66324 External control of file name or path in Microsoft Edge (Chromium-based) allows... |
medium | 6.5 | — | Microsoft / edge chromium | 2026-08-28 | 2026-10-28 |
| CVE-2026-66798 Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacke... |
medium | 4.3 | — | Microsoft / edge chromium | 2026-08-28 | 2026-10-28 |
| CVE-2026-66323 Improper neutralization of parameter/argument delimiters in Microsoft Edge (Chro... |
medium | 5.4 | — | Microsoft / edge chromium | 2026-08-28 | 2026-10-28 |
| CVE-2026-62904 Incorrect authorization in Microsoft Edge (Chromium-based) allows an unauthorize... |
medium | 5.4 | — | Microsoft / edge chromium | 2026-08-28 | 2026-10-28 |
| CVE-2026-85935 Buffer over-read in Windows USB Driver allows an authorized attacker to disclose... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-85938 Improper access control in Windows Broadcast DVR User Service allows an authoriz... |
medium | 5.5 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-28 |
| CVE-2026-85939 Weak authentication in Windows Kernel allows an authorized attacker to bypass a... |
medium | 5.3 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-62899 Inconsistent interpretation of http requests ('http request/response smuggling')... |
medium | 5.9 | — | Microsoft / visual studio 2022 | 2026-08-11 | 2026-10-28 |
| CVE-2026-62900 Improper removal of sensitive information before storage or transfer in .NET all... |
medium | 5.9 | — | Microsoft / visual studio 2022 | 2026-08-11 | 2026-10-28 |
| CVE-2026-62902 Inclusion of functionality from untrusted control sphere in .NET allows an unaut... |
medium | 6.5 | — | Microsoft / visual studio 2022 | 2026-08-11 | 2026-10-28 |
| CVE-2026-62740 Use of uninitialized resource in Windows Imaging Component allows an authorized... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-08-11 | 2026-10-28 |
| CVE-2026-57083 Use of uninitialized resource in Microsoft Windows Codecs Library allows an unau... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-07-14 | 2026-10-28 |
| CVE-2026-57084 Use of uninitialized resource in Windows File Explorer allows an unauthorized at... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-07-14 | 2026-10-28 |
| CVE-2026-50659 Improper encoding or escaping of output in .NET allows an authorized attacker to... |
medium | 6.5 | — | Microsoft / .net framework | 2026-07-14 | 2026-10-28 |
| CVE-2026-50526 Improper link resolution before file access ('link following') in .NET allows an... |
medium | 5.5 | — | Microsoft / .net | 2026-07-14 | 2026-10-28 |
| CVE-2026-40375 Missing authorization in Dynamics Business Central allows an authorized attacker... |
medium | 6.5 | — | Microsoft / dynamics 365 business central 2024 | 2026-08-11 | 2026-10-28 |
| CVE-2026-87709 Improper access control in Windows Host Guardian Service allows an authorized at... |
medium | 5.5 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-28 |
| CVE-2026-88140 Out-of-bounds read in Windows Key Storage Provider allows an authorized attacker... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-83636 Null pointer dereference in Windows Hyper-V allows an authorized attacker to den... |
medium | 6.5 | — | Microsoft / windows 10 21h2 | 2026-10-13 | 2026-10-28 |
| CVE-2026-83582 Use after free in Windows Graphics Kernel allows an authorized attacker to discl... |
medium | 4.7 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-96858 Missing authentication for critical function in Windows Security Account Manager... |
medium | 5.5 | — | Microsoft / windows 10 21h2 | 2026-10-13 | 2026-10-28 |
| CVE-2026-96859 Out-of-bounds read in Windows Imaging Component allows an authorized attacker to... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-96860 Out-of-bounds read in Windows USB Print Driver allows an authorized attacker to... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-83573 Integer overflow or wraparound in Windows Kernel Mode Driver allows an unauthori... |
medium | 6.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-83565 Buffer over-read in Windows Encrypting File System (EFS) allows an authorized at... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-83500 Url redirection to untrusted site ('open redirect') in Windows BitLocker allows... |
medium | 6.1 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-83504 Time-of-check time-of-use (toctou) race condition in Windows SmartScreen allows... |
medium | 4.7 | — | Microsoft / windows 11 23h2 | 2026-10-13 | 2026-10-28 |
| CVE-2026-83507 Improper link resolution before file access ('link following') in Windows Update... |
medium | 5.5 | — | Microsoft / windows 10 21h2 | 2026-10-13 | 2026-10-28 |
| CVE-2026-81964 Use of hard-coded credentials in Windows Update Orchestrator Service allows an a... |
medium | 5.5 | — | Microsoft / windows 10 21h2 | 2026-10-13 | 2026-10-28 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.