October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
23,707
Critical
3,235
High
7,704
Medium
7,359
Low
705
Severity not reported
4,704
In CISA KEV
188
Most affected vendors (by CPE data where available): microsoft (1424), google (825), linux (722), ibm (323), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-83747 Out-of-bounds read in Windows Error Reporting allows an authorized attacker to d... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-110078 Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) v... |
medium | 5.4 | — | Adobe / experience manager | 2026-10-13 | 2026-10-29 |
| CVE-2026-83755 Use of uninitialized resource in Windows Win32K allows an authorized attacker to... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83706 Use after free in Windows NTFS allows an authorized attacker to elevate privileg... |
medium | 6.7 | — | Microsoft / windows 11 24h2 | 2026-10-13 | 2026-10-29 |
| CVE-2026-86915 A race condition was addressed with improved locking. |
medium | 4.7 | — | Apple / macos | 2026-10-20 | 2026-10-29 |
| CVE-2026-86928 A path handling issue was addressed with improved validation. |
medium | 5.5 | — | Apple / macos | 2026-10-20 | 2026-10-29 |
| CVE-2026-86932 An authorization issue was addressed with improved state management. |
medium | 5.5 | — | Apple / macos | 2026-10-20 | 2026-10-29 |
| CVE-2026-86940 This issue was addressed by removing the vulnerable code. |
medium | 5.5 | — | Apple / macos | 2026-10-20 | 2026-10-29 |
| CVE-2026-86979 A privacy issue was addressed with improved checks. |
medium | 5.5 | — | Apple / macos | 2026-10-20 | 2026-10-29 |
| CVE-2026-83686 Out-of-bounds read in Microsoft Windows Search Component allows an authorized at... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83664 Access of resource using incompatible type ('type confusion') in Windows Portabl... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83668 Out-of-bounds read in Windows WLAN Service allows an authorized attacker to disc... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83671 Out-of-bounds read in Windows Hyper-V allows an authorized attacker to disclose... |
medium | 6.5 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83672 Exposure of sensitive system information to an unauthorized control sphere in Wi... |
medium | 4.7 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83521 Out-of-bounds read in Windows IKE Extension allows an authorized attacker to dis... |
medium | 6.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83656 Missing authentication for critical function in Windows Modern Device Management... |
medium | 4.7 | — | Microsoft / windows 10 21h2 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83658 Improper access control in Windows Error Reporting allows an authorized attacker... |
medium | 5.5 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83657 Weak authentication in Windows Modern Device Management (MDM) allows an authoriz... |
medium | 5.5 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83649 Out-of-bounds read in Windows Local Security Authority Subsystem Service (LSASS)... |
medium | 6.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83648 Null pointer dereference in Active Directory Domain Services allows an authorize... |
medium | 6.5 | — | Microsoft / windows 10 21h2 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83875 Out-of-bounds read in HID Parser Library allows an authorized attacker to disclo... |
medium | 5.5 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83884 Out-of-bounds read in HID Parser Library allows an authorized attacker to disclo... |
medium | 5.5 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83887 Out-of-bounds read in HID Parser Library allows an authorized attacker to disclo... |
medium | 5.5 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83892 Out-of-bounds read in HID Parser Library allows an authorized attacker to disclo... |
medium | 5.5 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83898 Out-of-bounds read in HID Parser Library allows an authorized attacker to disclo... |
medium | 5.5 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83904 Out-of-bounds read in HID Parser Library allows an authorized attacker to disclo... |
medium | 5.5 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83905 Exposure of sensitive system information to an unauthorized control sphere in Wi... |
medium | 4.7 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83906 Incorrect implementation of authentication algorithm in Windows Shell allows an... |
medium | 6.5 | — | Microsoft / windows 11 23h2 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83907 Exposure of sensitive system information to an unauthorized control sphere in Wi... |
medium | 5.5 | — | Microsoft / windows 10 21h2 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83909 Exposure of sensitive system information to an unauthorized control sphere in Wi... |
medium | 4.7 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83646 Url redirection to untrusted site ('open redirect') in Active Directory Federati... |
medium | 5.4 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-91245 Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware... |
medium | 6.5 | — | — | 2026-10-20 | 2026-10-29 |
| CVE-2026-91246 Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware... |
medium | 6.1 | — | — | 2026-10-20 | 2026-10-29 |
| CVE-2026-91248 Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware... |
medium | 5.3 | — | — | 2026-10-20 | 2026-10-29 |
| CVE-2026-97073 Missing Authorization vulnerability in myCred myCred mycred allows Exploiting In... |
medium | 5.3 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-91244 Vulnerability in the Oracle Solaris product of Oracle Systems (component: Servic... |
medium | 4.7 | — | — | 2026-10-20 | 2026-10-29 |
| CVE-2026-82411 Open Object provides an API and admin interface to manage objects and object typ... |
medium | 6.5 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-74048 Not Failing Securely ('Failing Open') vulnerability in Apache Tomcat. |
medium | 6.5 | — | — | 2026-10-20 | 2026-10-29 |
| CVE-2026-74049 Execution After Redirect (EAR) vulnerability in Apache Tomcat. |
medium | 6.1 | — | — | 2026-10-20 | 2026-10-29 |
| CVE-2026-55606 odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. |
medium | 6.5 | — | — | 2026-10-23 | 2026-10-29 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.