October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 29, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
16,212
Critical
1,207
High
5,399
Medium
5,736
Low
600
Severity not reported
3,270
In CISA KEV
17
Most affected vendors (by CPE data where available): microsoft (1078), google (711), ibm (140), oracle (117), adobe (110), broadcom (61), apache (45), freerdp (42), linuxfoundation (41), dell (40)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-100211 Use after free in Microsoft Office Excel allows an unauthorized attacker to exec... |
high | 8.8 | — | Microsoft / 365 apps | 2026-10-13 | 2026-10-15 |
| CVE-2026-100212 Use after free in Microsoft Office Excel allows an unauthorized attacker to exec... |
high | 8.8 | — | Microsoft / 365 apps | 2026-10-13 | 2026-10-15 |
| CVE-2026-100215 Heap-based buffer overflow in Microsoft Graphics Component allows an unauthorize... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-20 |
| CVE-2026-100216 Stack-based buffer overflow in Windows Storage allows an authorized attacker to... |
high | 7.0 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-20 |
| CVE-2026-100217 Improper privilege management in Windows Group Policy allows an authorized attac... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-20 |
| CVE-2026-100218 Use after free in Remote Desktop Gateway Service allows an unauthorized attacker... |
high | 8.1 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-20 |
| CVE-2026-100203 Heap-based buffer overflow in Windows Update Service allows an authorized attack... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-20 |
| CVE-2026-100209 Use after free in Microsoft Office Excel allows an unauthorized attacker to exec... |
high | 8.8 | — | Microsoft / 365 apps | 2026-10-13 | 2026-10-15 |
| CVE-2026-100210 Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized atta... |
high | 8.8 | — | Microsoft / 365 apps | 2026-10-13 | 2026-10-15 |
| CVE-2026-100200 Use after free in Windows Update Service allows an authorized attacker to elevat... |
high | 7.0 | — | Microsoft / windows 11 23h2 | 2026-10-13 | 2026-10-20 |
| CVE-2026-100201 Heap-based buffer overflow in Windows Client License Service allows an authorize... |
high | 7.0 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-20 |
| CVE-2026-69435 Missing authorization in Azure SRE Agent allows an authorized attacker to elevat... |
high | 8.1 | — | Microsoft / azure sre agent | 2026-10-08 | 2026-10-15 |
| CVE-2026-96940 Weak authentication in Microsoft Exchange Server allows an authorized attacker t... |
high | 8.8 | — | Microsoft / exchange server | 2026-10-02 | 2026-10-15 |
| CVE-2026-108453 Out-of-bounds read in Microsoft Office PowerPoint allows an unauthorized attacke... |
medium | 6.5 | — | Microsoft / 365 apps | 2026-10-15 | 2026-10-19 |
| CVE-2026-108454 Buffer over-read in Microsoft Office PowerPoint allows an unauthorized attacker... |
medium | 6.5 | — | Microsoft / 365 apps | 2026-10-15 | 2026-10-19 |
| CVE-2026-108455 Out-of-bounds read in Microsoft Office PowerPoint allows an unauthorized attacke... |
medium | 6.5 | — | Microsoft / 365 apps | 2026-10-15 | 2026-10-19 |
| CVE-2026-108436 Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to d... |
medium | 6.5 | — | Microsoft / 365 apps | 2026-10-15 | 2026-10-20 |
| CVE-2026-108438 Use after free in Microsoft Office Word allows an unauthorized attacker to discl... |
medium | 6.5 | — | Microsoft / 365 apps | 2026-10-15 | 2026-10-20 |
| CVE-2026-108434 Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to d... |
medium | 6.5 | — | Microsoft / 365 apps | 2026-10-15 | 2026-10-20 |
| CVE-2026-108435 Untrusted pointer dereference in Microsoft Office Word allows an unauthorized at... |
medium | 6.5 | — | Microsoft / 365 apps | 2026-10-15 | 2026-10-20 |
| CVE-2026-97844 Out-of-bounds read in DNS Server allows an authorized attacker to disclose infor... |
medium | 6.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-97839 Out-of-bounds read in DNS Server allows an authorized attacker to disclose infor... |
medium | 6.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-97840 Out-of-bounds read in DNS Server allows an authorized attacker to disclose infor... |
medium | 6.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-97841 Out-of-bounds read in DNS Server allows an authorized attacker to disclose infor... |
medium | 6.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-97842 Out-of-bounds read in DNS Server allows an authorized attacker to disclose infor... |
medium | 6.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-97843 Out-of-bounds read in DNS Server allows an authorized attacker to disclose infor... |
medium | 6.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-97833 Out-of-bounds read in DNS Server allows an authorized attacker to disclose infor... |
medium | 6.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-97834 Out-of-bounds read in DNS Server allows an authorized attacker to disclose infor... |
medium | 6.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-97835 Out-of-bounds read in DNS Server allows an authorized attacker to disclose infor... |
medium | 6.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-97836 Out-of-bounds read in DNS Server allows an authorized attacker to disclose infor... |
medium | 6.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-97837 Out-of-bounds read in DNS Server allows an authorized attacker to disclose infor... |
medium | 6.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-97838 Out-of-bounds read in DNS Server allows an authorized attacker to disclose infor... |
medium | 6.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-97828 Buffer over-read in DNS Server allows an authorized attacker to disclose informa... |
medium | 6.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-97829 Out-of-bounds read in DNS Server allows an authorized attacker to disclose infor... |
medium | 6.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-97831 Out-of-bounds read in DNS Server allows an authorized attacker to disclose infor... |
medium | 6.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-97832 Out-of-bounds read in DNS Server allows an authorized attacker to disclose infor... |
medium | 6.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-97823 Out-of-bounds read in DNS Server allows an authorized attacker to disclose infor... |
medium | 6.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-97824 Out-of-bounds read in DNS Server allows an authorized attacker to disclose infor... |
medium | 6.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-97825 Out-of-bounds read in DNS Server allows an authorized attacker to disclose infor... |
medium | 6.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-97826 Out-of-bounds read in DNS Server allows an authorized attacker to disclose infor... |
medium | 6.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.