October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 29, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
16,209
Critical
1,207
High
5,399
Medium
5,736
Low
600
Severity not reported
3,267
In CISA KEV
17
Most affected vendors (by CPE data where available): microsoft (1078), google (711), ibm (140), oracle (117), adobe (110), broadcom (61), apache (45), freerdp (42), linuxfoundation (41), dell (40)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-69947 Heap-based buffer overflow in Windows Overlay Filter allows an unauthorized atta... |
medium | 6.8 | — | Microsoft / windows 10 21h2 | 2026-10-13 | 2026-10-16 |
| CVE-2026-69919 Out-of-bounds read in Windows Cryptographic Services allows an authorized attack... |
medium | 5.5 | — | Microsoft / windows 11 24h2 | 2026-10-13 | 2026-10-16 |
| CVE-2026-69922 Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to... |
medium | 6.5 | — | Microsoft / 365 apps | 2026-10-13 | 2026-10-14 |
| CVE-2026-69905 Missing authorization in Windows AppX Deployment Service allows an authorized at... |
medium | 5.5 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-16 |
| CVE-2026-69914 Out-of-bounds read in Windows AppX Deployment Service allows an authorized attac... |
medium | 5.5 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-16 |
| CVE-2026-69902 Untrusted pointer dereference in Windows NTFS allows an authorized attacker to e... |
medium | 6.7 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-69644 Exposure of sensitive system information to an unauthorized control sphere in Wi... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-69635 Heap-based buffer overflow in Windows Installer allows an authorized attacker to... |
medium | 6.6 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-26 |
| CVE-2026-69640 Incorrect authorization in Windows Key Distribution Center allows an authorized... |
medium | 5.3 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-26 |
| CVE-2026-69506 Out-of-bounds read in Windows Key Storage Provider allows an authorized attacker... |
medium | 4.7 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-23 |
| CVE-2026-62687 Improper link resolution before file access ('link following') in Windows Backup... |
medium | 5.5 | — | Microsoft / windows 10 21h2 | 2026-10-13 | 2026-10-26 |
| CVE-2026-62879 Missing authentication for critical function in Windows SmartScreen allows an au... |
medium | 5.5 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-26 |
| CVE-2026-59116 Use of a broken or risky cryptographic algorithm in Windows Remote Desktop allow... |
medium | 6.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-26 |
| CVE-2026-108462 Exposure of sensitive system information to an unauthorized control sphere in Wi... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-26 |
| CVE-2026-108466 Out-of-bounds read in Windows Kernel allows an unauthorized attacker to deny ser... |
medium | 5.3 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-26 |
| CVE-2026-108127 Out-of-bounds read in DNS Server allows an authorized attacker to disclose infor... |
medium | 6.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-108128 Out-of-bounds read in DNS Server allows an authorized attacker to disclose infor... |
medium | 6.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-108129 Out-of-bounds read in DNS Server allows an authorized attacker to disclose infor... |
medium | 6.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-105720 Incorrect authorization in Microsoft Office SharePoint allows an authorized atta... |
medium | 4.3 | — | Microsoft / sharepoint server | 2026-10-13 | 2026-10-14 |
| CVE-2026-105713 Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an auth... |
medium | 5.7 | — | Microsoft / sharepoint server | 2026-10-13 | 2026-10-14 |
| CVE-2026-105719 Improper input validation in Microsoft Office SharePoint allows an authorized at... |
medium | 6.5 | — | Microsoft / sharepoint server | 2026-10-13 | 2026-10-14 |
| CVE-2026-105006 Use after free in HID class driver allows an unauthorized attacker to elevate pr... |
medium | 6.4 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-27 |
| CVE-2026-103576 Url redirection to untrusted site ('open redirect') in Active Directory Federati... |
medium | 6.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-27 |
| CVE-2026-103578 Untrusted pointer dereference in Windows Kernel allows an unauthorized attacker... |
medium | 6.8 | — | Microsoft / windows 11 26h1 | 2026-10-13 | 2026-10-26 |
| CVE-2026-103560 Improper authorization in DNS Server allows an authorized attacker to perform ta... |
medium | 5.5 | — | Microsoft / windows server 2012 | 2026-10-13 | 2026-10-16 |
| CVE-2026-103567 Buffer over-read in Windows Broadcast DVR User Service allows an authorized atta... |
medium | 5.5 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-26 |
| CVE-2026-102865 Incorrect authorization in Microsoft Office SharePoint allows an authorized atta... |
medium | 6.5 | — | Microsoft / sharepoint server | 2026-10-13 | 2026-10-14 |
| CVE-2026-102867 Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to d... |
medium | 6.5 | — | Microsoft / 365 apps | 2026-10-13 | 2026-10-14 |
| CVE-2026-102859 Improper neutralization of input during web page generation ('cross-site scripti... |
medium | 4.6 | — | Microsoft / sharepoint server | 2026-10-13 | 2026-10-14 |
| CVE-2026-102864 Improper neutralization of input during web page generation ('cross-site scripti... |
medium | 4.6 | — | Microsoft / sharepoint server | 2026-10-13 | 2026-10-14 |
| CVE-2026-102221 No cwe for this issue in Windows Secure Boot allows an authorized attacker to by... |
medium | 4.4 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-26 |
| CVE-2026-102206 Heap-based buffer overflow in Windows Portable Device MTP Driver allows an unaut... |
medium | 6.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-20 |
| CVE-2026-102198 Out-of-bounds read in Windows Remote Desktop Protocol allows an authorized attac... |
medium | 5.3 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-20 |
| CVE-2026-102199 Stack-based buffer overflow in Microsoft Windows Codecs Library allows an unauth... |
medium | 6.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-20 |
| CVE-2026-102187 Use of uninitialized resource in Windows Kernel allows an authorized attacker to... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-20 |
| CVE-2026-102188 Untrusted pointer dereference in Windows Storage Port Driver allows an unauthori... |
medium | 6.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-20 |
| CVE-2026-102186 Untrusted pointer dereference in Windows Network File System allows an authorize... |
medium | 4.7 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-20 |
| CVE-2026-83947 Missing authorization in Azure Event Grid allows an authorized attacker to perfo... |
medium | 6.5 | — | Microsoft / azure event grid | 2026-10-08 | 2026-10-15 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.