October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 29, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
16,209
Critical
1,207
High
5,399
Medium
5,736
Low
600
Severity not reported
3,267
In CISA KEV
17
Most affected vendors (by CPE data where available): microsoft (1078), google (711), ibm (140), oracle (117), adobe (110), broadcom (61), apache (45), freerdp (42), linuxfoundation (41), dell (40)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-96305 Use after free in Windows Installer allows an authorized attacker to elevate pri... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-96306 Out-of-bounds read in Windows Sysmain Service allows an authorized attacker to e... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-96307 Use after free in Windows Installer allows an authorized attacker to elevate pri... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-96250 Use after free in Windows USB Print Driver allows an authorized attacker to elev... |
high | 7.0 | — | Microsoft / windows 10 21h2 | 2026-10-13 | 2026-10-16 |
| CVE-2026-96251 Reliance on untrusted inputs in a security decision in Microsoft PowerShell allo... |
high | 8.8 | — | Microsoft / powershell | 2026-10-13 | 2026-10-22 |
| CVE-2026-96253 Use after free in Windows USB Print Driver allows an authorized attacker to elev... |
high | 7.0 | — | Microsoft / windows 10 21h2 | 2026-10-13 | 2026-10-16 |
| CVE-2026-96254 Use after free in Windows USB Print Driver allows an authorized attacker to elev... |
high | 7.0 | — | Microsoft / windows 10 21h2 | 2026-10-13 | 2026-10-16 |
| CVE-2026-96301 Use after free in Windows USB Print Driver allows an authorized attacker to elev... |
high | 7.0 | — | Microsoft / windows 10 21h2 | 2026-10-13 | 2026-10-16 |
| CVE-2026-96245 Out-of-bounds read in Windows Routing and Remote Access Service (RRAS) allows an... |
high | 7.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-96246 Out-of-bounds read in Network Policy Server (NPS) allows an unauthorized attacke... |
high | 7.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-20 |
| CVE-2026-96248 Stack-based buffer overflow in Windows Host Guardian Service allows an unauthori... |
high | 7.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-96249 Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker t... |
high | 7.8 | — | Microsoft / windows 11 24h2 | 2026-10-13 | 2026-10-16 |
| CVE-2026-96243 Improper link resolution before file access ('link following') in Windows Wallet... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-96244 Use after free in Windows Internal System User Profile allows an authorized atta... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-96222 Improper certificate validation in Active Directory Federation Services (AD FS)... |
high | 7.4 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-22 |
| CVE-2026-96223 Use after free in Windows Hyper-V allows an authorized attacker to elevate privi... |
high | 7.8 | — | Microsoft / windows 11 24h2 | 2026-10-13 | 2026-10-16 |
| CVE-2026-96215 Concurrent execution using shared resource with improper synchronization ('race... |
high | 7.0 | — | Microsoft / windows 11 24h2 | 2026-10-13 | 2026-10-16 |
| CVE-2026-96216 Use after free in Windows Kernel allows an authorized attacker to elevate privil... |
high | 7.0 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-16 |
| CVE-2026-96217 Heap-based buffer overflow in Windows NTFS allows an authorized attacker to elev... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-96220 Improper control of generation of code ('code injection') in Windows Assigned Ac... |
high | 7.8 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-16 |
| CVE-2026-96186 Deserialization of untrusted data in Microsoft Windows Media Foundation allows a... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-96209 Out-of-bounds read in Windows Network File System allows an authorized attacker... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-96044 No cwe for this issue in Microsoft Office SharePoint allows an authorized attack... |
high | 8.8 | — | Microsoft / sharepoint server | 2026-10-13 | 2026-10-16 |
| CVE-2026-96071 Heap-based buffer overflow in Windows Media allows an unauthorized attacker to e... |
high | 7.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-96118 Out-of-bounds read in Windows Graphics Kernel allows an authorized attacker to e... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-88204 Improper neutralization of input during web page generation ('cross-site scripti... |
high | 7.3 | — | Microsoft / sharepoint server | 2026-10-13 | 2026-10-14 |
| CVE-2026-88206 Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an auth... |
high | 7.5 | — | Microsoft / sharepoint server | 2026-10-13 | 2026-10-14 |
| CVE-2026-88207 Heap-based buffer overflow in Microsoft Office PowerPoint allows an unauthorized... |
high | 7.5 | — | Microsoft / 365 apps | 2026-10-13 | 2026-10-15 |
| CVE-2026-88210 Reliance on untrusted inputs in a security decision in Microsoft Office Word all... |
high | 7.8 | — | Microsoft / 365 apps | 2026-10-13 | 2026-10-15 |
| CVE-2026-88219 Untrusted pointer dereference in RPC Runtime allows an unauthorized attacker to... |
high | 8.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-20 |
| CVE-2026-88196 Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker t... |
high | 8.8 | — | Microsoft / 365 apps | 2026-10-13 | 2026-10-15 |
| CVE-2026-88197 Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker t... |
high | 8.8 | — | Microsoft / 365 apps | 2026-10-13 | 2026-10-15 |
| CVE-2026-88198 Missing authorization in Microsoft Office SharePoint allows an authorized attack... |
high | 8.8 | — | Microsoft / sharepoint server | 2026-10-13 | 2026-10-14 |
| CVE-2026-88200 Privilege context switching error in Microsoft Office SharePoint allows an autho... |
high | 8.8 | — | Microsoft / sharepoint server | 2026-10-13 | 2026-10-14 |
| CVE-2026-88202 Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attac... |
high | 8.8 | — | Microsoft / 365 apps | 2026-10-13 | 2026-10-15 |
| CVE-2026-88189 Out-of-bounds read in Windows DWM Core Library allows an authorized attacker to... |
high | 7.8 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-16 |
| CVE-2026-88191 Improper link resolution before file access ('link following') in Microsoft Wind... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-88193 Heap-based buffer overflow in Microsoft Scripting Engine allows an authorized at... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-20 |
| CVE-2026-88194 Out-of-bounds read in Windows DWM Core Library allows an authorized attacker to... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-88182 Use after free in Microsoft Windows Search Component allows an authorized attack... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.