October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 29, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
22,229
Critical
3,102
High
7,094
Medium
6,630
Low
674
Severity not reported
4,729
In CISA KEV
188
Most affected vendors (by CPE data where available): microsoft (1176), google (780), ibm (323), mozilla (182), oracle (154), adobe (137), linux (126), apache (116), broadcom (113), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-83864 Improper access control in Windows NTFS allows an authorized attacker to disclos... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-21 |
| CVE-2026-83865 Relative path traversal in Windows Internet (wininet.dll) allows an authorized a... |
medium | 4.7 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-21 |
| CVE-2026-70097 Concurrent execution using shared resource with improper synchronization ('race... |
medium | 5.6 | — | Microsoft / windows 11 24h2 | 2026-10-13 | 2026-10-21 |
| CVE-2026-83885 Inadequate encryption strength in Windows Virtualization-Based Security (VBS) En... |
medium | 5.6 | — | Microsoft / windows 11 24h2 | 2026-10-13 | 2026-10-21 |
| CVE-2026-83893 Exposure of sensitive system information to an unauthorized control sphere in Wi... |
medium | 5.5 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-21 |
| CVE-2026-83895 Heap-based buffer overflow in Windows Win32 Kernel Subsystem allows an unauthori... |
medium | 6.8 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-21 |
| CVE-2026-83897 Exposure of sensitive system information to an unauthorized control sphere in Wi... |
medium | 4.7 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-21 |
| CVE-2026-102206 Heap-based buffer overflow in Windows Portable Device MTP Driver allows an unaut... |
medium | 6.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-20 |
| CVE-2026-102198 Out-of-bounds read in Windows Remote Desktop Protocol allows an authorized attac... |
medium | 5.3 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-20 |
| CVE-2026-102199 Stack-based buffer overflow in Microsoft Windows Codecs Library allows an unauth... |
medium | 6.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-20 |
| CVE-2026-102186 Untrusted pointer dereference in Windows Network File System allows an authorize... |
medium | 4.7 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-20 |
| CVE-2026-102187 Use of uninitialized resource in Windows Kernel allows an authorized attacker to... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-20 |
| CVE-2026-102188 Untrusted pointer dereference in Windows Storage Port Driver allows an unauthori... |
medium | 6.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-20 |
| CVE-2026-108434 Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to d... |
medium | 6.5 | — | Microsoft / 365 apps | 2026-10-15 | 2026-10-20 |
| CVE-2026-108435 Untrusted pointer dereference in Microsoft Office Word allows an unauthorized at... |
medium | 6.5 | — | Microsoft / 365 apps | 2026-10-15 | 2026-10-20 |
| CVE-2026-108436 Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to d... |
medium | 6.5 | — | Microsoft / 365 apps | 2026-10-15 | 2026-10-20 |
| CVE-2026-108438 Use after free in Microsoft Office Word allows an unauthorized attacker to discl... |
medium | 6.5 | — | Microsoft / 365 apps | 2026-10-15 | 2026-10-20 |
| CVE-2026-88162 Improper authorization in Windows Encrypting File System (EFS) allows an authori... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-20 |
| CVE-2026-96300 Uncontrolled resource consumption in RPC Endpoint Mapper Service allows an unaut... |
medium | 5.9 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-20 |
| CVE-2026-96853 Time-of-check time-of-use (toctou) race condition in Windows Win32 Kernel Subsys... |
medium | 4.7 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-20 |
| CVE-2026-96854 Access of resource using incompatible type ('type confusion') in Windows Device... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-20 |
| CVE-2026-96855 Improper access control in Windows Modern Device Management (MDM) allows an auth... |
medium | 5.5 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-20 |
| CVE-2026-96857 Files or directories accessible to external parties in Windows Projected File Sy... |
medium | 5.5 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-20 |
| CVE-2026-108453 Out-of-bounds read in Microsoft Office PowerPoint allows an unauthorized attacke... |
medium | 6.5 | — | Microsoft / 365 apps | 2026-10-15 | 2026-10-19 |
| CVE-2026-108454 Buffer over-read in Microsoft Office PowerPoint allows an unauthorized attacker... |
medium | 6.5 | — | Microsoft / 365 apps | 2026-10-15 | 2026-10-19 |
| CVE-2026-108455 Out-of-bounds read in Microsoft Office PowerPoint allows an unauthorized attacke... |
medium | 6.5 | — | Microsoft / 365 apps | 2026-10-15 | 2026-10-19 |
| CVE-2026-84007 Out-of-bounds read in Remote Desktop Gateway Service allows an authorized attack... |
medium | 6.5 | — | Microsoft / windows server 2012 | 2026-10-13 | 2026-10-19 |
| CVE-2026-84009 Time-of-check time-of-use (toctou) race condition in Windows Projected File Syst... |
medium | 4.7 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-19 |
| CVE-2026-84011 Incorrect authorization in Windows SMB Client allows an authorized attacker to b... |
medium | 5.5 | — | Microsoft / windows 11 23h2 | 2026-10-13 | 2026-10-19 |
| CVE-2026-69999 Out-of-bounds read in Windows Update allows an authorized attacker to disclose i... |
medium | 5.5 | — | Microsoft / windows 11 23h2 | 2026-10-13 | 2026-10-19 |
| CVE-2026-85816 Out-of-bounds read in Windows Wi-Fi Driver allows an authorized attacker to disc... |
medium | 5.7 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-85821 Out-of-bounds read in Windows Universal Disk Format File System Driver (UDFS) al... |
medium | 6.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-85805 Improperly implemented security check for standard in Windows PowerShell allows... |
medium | 6.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-96921 Access of resource using incompatible type ('type confusion') in Windows Message... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-96925 Integer underflow (wrap or wraparound) in Windows NTFS allows an authorized atta... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-96926 Missing authorization in DNS Server allows an authorized attacker to perform tam... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-96927 Out-of-bounds read in Windows NTFS allows an authorized attacker to disclose inf... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-85812 Files or directories accessible to external parties in Windows Bind Filter Drive... |
medium | 5.5 | — | Microsoft / windows 10 21h2 | 2026-10-13 | 2026-10-16 |
| CVE-2026-85815 Out-of-bounds read in Windows Device Association Service allows an authorized at... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-96321 Out-of-bounds read in Remote Desktop Display Driver allows an authorized attacke... |
medium | 5.5 | — | Microsoft / windows 10 21h2 | 2026-10-13 | 2026-10-16 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.