October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 29, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
22,229
Critical
3,102
High
7,094
Medium
6,630
Low
674
Severity not reported
4,729
In CISA KEV
188
Most affected vendors (by CPE data where available): microsoft (1176), google (780), ibm (323), mozilla (182), oracle (154), adobe (137), linux (126), apache (116), broadcom (113), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-85910 Buffer over-read in Windows StateRepository API allows an authorized attacker to... |
medium | 5.5 | — | Microsoft / windows 11 24h2 | 2026-10-13 | 2026-10-26 |
| CVE-2026-70011 Out-of-bounds read in Windows IP Over USB Service allows an authorized attacker... |
medium | 5.5 | — | Microsoft / windows 10 21h2 | 2026-10-13 | 2026-10-26 |
| CVE-2026-108462 Exposure of sensitive system information to an unauthorized control sphere in Wi... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-26 |
| CVE-2026-108466 Out-of-bounds read in Windows Kernel allows an unauthorized attacker to deny ser... |
medium | 5.3 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-26 |
| CVE-2026-69968 Relative path traversal in Windows Libarchive allows an unauthorized attacker to... |
medium | 6.5 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-26 |
| CVE-2026-69969 Improper link resolution before file access ('link following') in Windows AppX D... |
medium | 4.7 | — | Microsoft / windows 10 21h2 | 2026-10-13 | 2026-10-26 |
| CVE-2026-69971 Incorrect authorization in Windows Kernel-Mode Drivers allows an authorized atta... |
medium | 5.5 | — | Microsoft / windows 11 24h2 | 2026-10-13 | 2026-10-26 |
| CVE-2026-69973 Improper limitation of a pathname to a restricted directory ('path traversal') i... |
medium | 6.5 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-26 |
| CVE-2026-69974 Out-of-bounds read in Desktop Window Manager allows an authorized attacker to di... |
medium | 4.7 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-26 |
| CVE-2026-69978 Null pointer dereference in Windows VMSwitch allows an authorized attacker to de... |
medium | 5.5 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-26 |
| CVE-2026-69979 Improper protection of alternate path in Windows AppX Deployment Service allows... |
medium | 5.5 | — | Microsoft / windows 10 21h2 | 2026-10-13 | 2026-10-26 |
| CVE-2026-69982 Weak authentication in Active Directory Federation Services (AD FS) allows an un... |
medium | 5.9 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-26 |
| CVE-2026-59116 Use of a broken or risky cryptographic algorithm in Windows Remote Desktop allow... |
medium | 6.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-26 |
| CVE-2026-62687 Improper link resolution before file access ('link following') in Windows Backup... |
medium | 5.5 | — | Microsoft / windows 10 21h2 | 2026-10-13 | 2026-10-26 |
| CVE-2026-62879 Missing authentication for critical function in Windows SmartScreen allows an au... |
medium | 5.5 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-26 |
| CVE-2026-69635 Heap-based buffer overflow in Windows Installer allows an authorized attacker to... |
medium | 6.6 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-26 |
| CVE-2026-69640 Incorrect authorization in Windows Key Distribution Center allows an authorized... |
medium | 5.3 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-26 |
| CVE-2026-96910 Untrusted pointer dereference in Microsoft Windows Search Component allows an au... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-26 |
| CVE-2026-103567 Buffer over-read in Windows Broadcast DVR User Service allows an authorized atta... |
medium | 5.5 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-26 |
| CVE-2026-103578 Untrusted pointer dereference in Windows Kernel allows an unauthorized attacker... |
medium | 6.8 | — | Microsoft / windows 11 26h1 | 2026-10-13 | 2026-10-26 |
| CVE-2026-102221 No cwe for this issue in Windows Secure Boot allows an authorized attacker to by... |
medium | 4.4 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-26 |
| CVE-2026-83925 Use of uninitialized resource in Windows Kernel allows an authorized attacker to... |
medium | 4.7 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-26 |
| CVE-2026-83926 Improper certificate validation in Windows Hello allows an authorized attacker t... |
medium | 4.4 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-26 |
| CVE-2026-69506 Out-of-bounds read in Windows Key Storage Provider allows an authorized attacker... |
medium | 4.7 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-23 |
| CVE-2026-96303 Improperly implemented security check for standard in Microsoft PowerShell allow... |
medium | 6.5 | — | Microsoft / powershell | 2026-10-13 | 2026-10-22 |
| CVE-2026-85790 Use after free in Microsoft QUIC allows an unauthorized attacker to disclose inf... |
medium | 5.9 | — | Microsoft / windows 11 23h2 | 2026-10-13 | 2026-10-22 |
| CVE-2026-70170 Untrusted pointer dereference in Windows Kernel allows an authorized attacker to... |
medium | 6.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-22 |
| CVE-2026-70199 Exposure of sensitive system information to an unauthorized control sphere in Wi... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-22 |
| CVE-2026-70211 Out-of-bounds read in Windows Win32 Kernel Subsystem allows an authorized attack... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-22 |
| CVE-2026-70232 Exposure of sensitive system information to an unauthorized control sphere in Wi... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-22 |
| CVE-2026-70284 Use of uninitialized resource in Windows Win32 Kernel Subsystem allows an author... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-21 |
| CVE-2026-70288 Time-of-check time-of-use (toctou) race condition in Windows Win32 Kernel Subsys... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-21 |
| CVE-2026-70292 Out-of-bounds read in Windows Win32 Kernel Subsystem allows an authorized attack... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-21 |
| CVE-2026-70293 Use of uninitialized resource in Windows Win32 Kernel Subsystem allows an author... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-21 |
| CVE-2026-70294 Out-of-bounds read in Windows Win32 Kernel Subsystem allows an authorized attack... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-21 |
| CVE-2026-70295 Out-of-bounds read in Windows Win32 Kernel Subsystem allows an authorized attack... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-21 |
| CVE-2026-83774 Exposure of sensitive system information to an unauthorized control sphere in Wi... |
medium | 4.7 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-21 |
| CVE-2026-97783 Improper neutralization of input during web page generation ('cross-site scripti... |
medium | 6.1 | — | Microsoft / sharepoint server | 2026-10-13 | 2026-10-21 |
| CVE-2026-83870 Out-of-bounds read in Windows Aggregated Data Platform Service allows an authori... |
medium | 5.5 | — | Microsoft / windows 11 24h2 | 2026-10-13 | 2026-10-21 |
| CVE-2026-83854 Improper access control in Windows Notification allows an authorized attacker to... |
medium | 5.5 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-21 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.