October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 29, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
22,229
Critical
3,102
High
7,094
Medium
6,630
Low
674
Severity not reported
4,729
In CISA KEV
188
Most affected vendors (by CPE data where available): microsoft (1176), google (780), ibm (323), mozilla (182), oracle (154), adobe (137), linux (126), apache (116), broadcom (113), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-96846 Out-of-bounds read in WebDAV allows an authorized attacker to disclose informati... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-96848 Buffer over-read in Windows Win32 Kernel Subsystem allows an authorized attacker... |
medium | 5.5 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-16 |
| CVE-2026-96849 Use of uninitialized resource in Windows Kernel-Mode Drivers allows an authorize... |
medium | 5.5 | — | Microsoft / windows 11 26h1 | 2026-10-13 | 2026-10-16 |
| CVE-2026-96850 Use of uninitialized resource in Windows Modern Device Management (MDM) allows a... |
medium | 5.5 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-16 |
| CVE-2026-96851 Buffer over-read in Windows Management Instrumentation allows an authorized atta... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-108129 Out-of-bounds read in DNS Server allows an authorized attacker to disclose infor... |
medium | 6.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-108128 Out-of-bounds read in DNS Server allows an authorized attacker to disclose infor... |
medium | 6.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-108127 Out-of-bounds read in DNS Server allows an authorized attacker to disclose infor... |
medium | 6.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-70044 Out-of-bounds read in Microsoft Windows Media Foundation allows an unauthorized... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-70041 Buffer over-read in Windows CD-ROM Driver allows an authorized attacker to discl... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-70025 Use after free in Windows Netlogon allows an authorized attacker to deny service... |
medium | 6.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-70017 Access of resource using incompatible type ('type confusion') in Windows Secure... |
medium | 5.5 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-16 |
| CVE-2026-69958 Heap-based buffer overflow in Windows Overlay Filter allows an unauthorized atta... |
medium | 6.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-69955 Out-of-bounds read in Windows Client for NFS allows an unauthorized attacker to... |
medium | 6.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-69954 Buffer over-read in Windows Overlay Filter allows an authorized attacker to disc... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-85337 Out-of-bounds read in Remote Desktop Client allows an unauthorized attacker to d... |
medium | 6.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-69947 Heap-based buffer overflow in Windows Overlay Filter allows an unauthorized atta... |
medium | 6.8 | — | Microsoft / windows 10 21h2 | 2026-10-13 | 2026-10-16 |
| CVE-2026-85336 Out-of-bounds read in Windows Device Association Service allows an authorized at... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-69940 Out-of-bounds read in Windows Client for NFS allows an unauthorized attacker to... |
medium | 6.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-85374 Out-of-bounds read in Windows Installer allows an authorized attacker to disclos... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-85793 Exposure of sensitive system information to an unauthorized control sphere in Wi... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-85794 Out-of-bounds read in Windows Routing and Remote Access Service (RRAS) allows an... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-85331 Out-of-bounds read in Windows Device Association Service allows an authorized at... |
medium | 6.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-69914 Out-of-bounds read in Windows AppX Deployment Service allows an authorized attac... |
medium | 5.5 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-16 |
| CVE-2026-69905 Missing authorization in Windows AppX Deployment Service allows an authorized at... |
medium | 5.5 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-16 |
| CVE-2026-69902 Untrusted pointer dereference in Windows NTFS allows an authorized attacker to e... |
medium | 6.7 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-85916 Exposure of private personal information to an unauthorized actor in Azure Activ... |
medium | 5.5 | — | Microsoft / windows 11 23h2 | 2026-10-13 | 2026-10-16 |
| CVE-2026-85323 Weak authentication in Network Device Enrollment Service (NDES) allows an author... |
medium | 6.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-69919 Out-of-bounds read in Windows Cryptographic Services allows an authorized attack... |
medium | 5.5 | — | Microsoft / windows 11 24h2 | 2026-10-13 | 2026-10-16 |
| CVE-2026-103560 Improper authorization in DNS Server allows an authorized attacker to perform ta... |
medium | 5.5 | — | Microsoft / windows server 2012 | 2026-10-13 | 2026-10-16 |
| CVE-2026-70071 Improper verification of cryptographic signature in DNS Server allows an authori... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-70074 Out-of-bounds read in Windows DNS allows an authorized attacker to disclose info... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-70083 Incorrect authorization in DNS Server allows an authorized attacker to perform t... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-70087 Incorrect authorization in DNS Server allows an authorized attacker to bypass a... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-70085 Missing authorization in DNS Server allows an authorized attacker to perform tam... |
medium | 5.5 | — | Microsoft / windows server 2012 | 2026-10-13 | 2026-10-16 |
| CVE-2026-70119 Out-of-bounds read in Windows DNS allows an authorized attacker to execute code... |
medium | 6.5 | — | Microsoft / windows server 2022 | 2026-10-13 | 2026-10-16 |
| CVE-2026-70166 Out-of-bounds read in Windows DNS allows an authorized attacker to deny service... |
medium | 6.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-97844 Out-of-bounds read in DNS Server allows an authorized attacker to disclose infor... |
medium | 6.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-97839 Out-of-bounds read in DNS Server allows an authorized attacker to disclose infor... |
medium | 6.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-97840 Out-of-bounds read in DNS Server allows an authorized attacker to disclose infor... |
medium | 6.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.