October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 29, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
16,209
Critical
1,207
High
5,399
Medium
5,736
Low
600
Severity not reported
3,267
In CISA KEV
17
Most affected vendors (by CPE data where available): microsoft (1078), google (711), ibm (140), oracle (117), adobe (110), broadcom (61), apache (45), freerdp (42), linuxfoundation (41), dell (40)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-70148 Improper authorization in Windows Broadcast DVR User Service allows an authorize... |
medium | 6.5 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-28 |
| CVE-2026-70135 Out-of-bounds read in Windows Remote POS Driver allows an authorized attacker to... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-70137 Improper access control in Windows Remote Access Connection Manager allows an au... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-70128 Out-of-bounds read in HID Parser Library allows an authorized attacker to disclo... |
medium | 5.5 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-28 |
| CVE-2026-70119 Out-of-bounds read in Windows DNS allows an authorized attacker to execute code... |
medium | 6.5 | — | Microsoft / windows server 2022 | 2026-10-13 | 2026-10-16 |
| CVE-2026-70122 Time-of-check time-of-use (toctou) race condition in Windows Broadcast DVR User... |
medium | 6.5 | — | Microsoft / windows 10 21h2 | 2026-10-13 | 2026-10-28 |
| CVE-2026-70116 Stack-based buffer overflow in Windows Resilient File System (ReFS) allows an un... |
medium | 4.2 | — | Microsoft / windows 11 24h2 | 2026-10-13 | 2026-10-28 |
| CVE-2026-70097 Concurrent execution using shared resource with improper synchronization ('race... |
medium | 5.6 | — | Microsoft / windows 11 24h2 | 2026-10-13 | 2026-10-21 |
| CVE-2026-70085 Missing authorization in DNS Server allows an authorized attacker to perform tam... |
medium | 5.5 | — | Microsoft / windows server 2012 | 2026-10-13 | 2026-10-16 |
| CVE-2026-70087 Incorrect authorization in DNS Server allows an authorized attacker to bypass a... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-70090 Use of uninitialized resource in Windows Netlogon allows an authorized attacker... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-70075 Time-of-check time-of-use (toctou) race condition in Windows Virtualization-Base... |
medium | 4.4 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-28 |
| CVE-2026-70077 Use after free in Windows Kernel allows an authorized attacker to disclose infor... |
medium | 4.7 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-70083 Incorrect authorization in DNS Server allows an authorized attacker to perform t... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-70084 Improper access control in Windows Projected File System allows an authorized at... |
medium | 5.5 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-28 |
| CVE-2026-70071 Improper verification of cryptographic signature in DNS Server allows an authori... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-70072 Allocation of resources without limits or throttling in Windows Netlogon allows... |
medium | 6.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-70074 Out-of-bounds read in Windows DNS allows an authorized attacker to disclose info... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-70063 Out-of-bounds read in Windows Kernel allows an authorized attacker to disclose i... |
medium | 4.7 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-70055 Exposure of sensitive system information to an unauthorized control sphere in Wi... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-70057 Incorrect authorization in Windows Routing and Remote Access Service (RRAS) allo... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-70044 Out-of-bounds read in Microsoft Windows Media Foundation allows an unauthorized... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-70041 Buffer over-read in Windows CD-ROM Driver allows an authorized attacker to discl... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-70017 Access of resource using incompatible type ('type confusion') in Windows Secure... |
medium | 5.5 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-16 |
| CVE-2026-70025 Use after free in Windows Netlogon allows an authorized attacker to deny service... |
medium | 6.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-70011 Out-of-bounds read in Windows IP Over USB Service allows an authorized attacker... |
medium | 5.5 | — | Microsoft / windows 10 21h2 | 2026-10-13 | 2026-10-26 |
| CVE-2026-69999 Out-of-bounds read in Windows Update allows an authorized attacker to disclose i... |
medium | 5.5 | — | Microsoft / windows 11 23h2 | 2026-10-13 | 2026-10-19 |
| CVE-2026-70005 Weak authentication in Active Directory Federation Services (AD FS) allows an un... |
medium | 5.9 | — | Microsoft / windows server 2019 | 2026-10-13 | 2026-10-28 |
| CVE-2026-69974 Out-of-bounds read in Desktop Window Manager allows an authorized attacker to di... |
medium | 4.7 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-26 |
| CVE-2026-69978 Null pointer dereference in Windows VMSwitch allows an authorized attacker to de... |
medium | 5.5 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-26 |
| CVE-2026-69979 Improper protection of alternate path in Windows AppX Deployment Service allows... |
medium | 5.5 | — | Microsoft / windows 10 21h2 | 2026-10-13 | 2026-10-26 |
| CVE-2026-69982 Weak authentication in Active Directory Federation Services (AD FS) allows an un... |
medium | 5.9 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-26 |
| CVE-2026-69968 Relative path traversal in Windows Libarchive allows an unauthorized attacker to... |
medium | 6.5 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-26 |
| CVE-2026-69969 Improper link resolution before file access ('link following') in Windows AppX D... |
medium | 4.7 | — | Microsoft / windows 10 21h2 | 2026-10-13 | 2026-10-26 |
| CVE-2026-69971 Incorrect authorization in Windows Kernel-Mode Drivers allows an authorized atta... |
medium | 5.5 | — | Microsoft / windows 11 24h2 | 2026-10-13 | 2026-10-26 |
| CVE-2026-69973 Improper limitation of a pathname to a restricted directory ('path traversal') i... |
medium | 6.5 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-26 |
| CVE-2026-69958 Heap-based buffer overflow in Windows Overlay Filter allows an unauthorized atta... |
medium | 6.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-69954 Buffer over-read in Windows Overlay Filter allows an authorized attacker to disc... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-69955 Out-of-bounds read in Windows Client for NFS allows an unauthorized attacker to... |
medium | 6.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-69940 Out-of-bounds read in Windows Client for NFS allows an unauthorized attacker to... |
medium | 6.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.