October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 29, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
16,209
Critical
1,207
High
5,399
Medium
5,736
Low
600
Severity not reported
3,267
In CISA KEV
17
Most affected vendors (by CPE data where available): microsoft (1078), google (711), ibm (140), oracle (117), adobe (110), broadcom (61), apache (45), freerdp (42), linuxfoundation (41), dell (40)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-88110 Heap-based buffer overflow in Windows Graphics Kernel allows an authorized attac... |
high | 7.0 | — | Microsoft / windows 11 24h2 | 2026-10-13 | 2026-10-28 |
| CVE-2026-88112 Untrusted pointer dereference in DNS Server allows an unauthorized attacker to e... |
high | 8.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-88113 Use after free in Windows Broadcast DVR User Service allows an authorized attack... |
high | 7.0 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-28 |
| CVE-2026-88114 Untrusted pointer dereference in DNS Server allows an unauthorized attacker to e... |
high | 8.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-88115 Out-of-bounds read in Windows Server for NFS allows an unauthorized attacker to... |
high | 8.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-88116 Untrusted pointer dereference in DNS Server allows an unauthorized attacker to e... |
high | 8.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-88101 Weak authentication in Microsoft Input Method Editor (IME) allows an authorized... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-17 |
| CVE-2026-88103 Use after free in Windows Broadcast DVR User Service allows an authorized attack... |
high | 7.0 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-16 |
| CVE-2026-88105 Use after free in Windows Broadcast DVR User Service allows an authorized attack... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-88106 Use after free in Windows Cloud Files Mini Filter Driver allows an authorized at... |
high | 7.0 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-28 |
| CVE-2026-88107 Use after free in Windows Cloud Files Mini Filter Driver allows an authorized at... |
high | 7.0 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-28 |
| CVE-2026-88109 Use after free in Microsoft Office Click-To-Run allows an authorized attacker to... |
high | 7.8 | — | Microsoft / 365 apps | 2026-10-13 | 2026-10-15 |
| CVE-2026-88093 Heap-based buffer overflow in Desktop Window Manager allows an authorized attack... |
high | 7.8 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-16 |
| CVE-2026-88096 Concurrent execution using shared resource with improper synchronization ('race... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-88098 Untrusted pointer dereference in Windows Security Support Provider Interface all... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-88100 Use after free in Windows Storage Spaces Controller allows an authorized attacke... |
high | 7.8 | — | Microsoft / windows 11 24h2 | 2026-10-13 | 2026-10-16 |
| CVE-2026-88073 Use after free in Windows Graphics Kernel allows an authorized attacker to eleva... |
high | 7.8 | — | Microsoft / windows 10 21h2 | 2026-10-13 | 2026-10-16 |
| CVE-2026-88074 Integer overflow or wraparound in Windows Virtualization-Based Security (VBS) En... |
high | 7.8 | — | Microsoft / windows 11 23h2 | 2026-10-13 | 2026-10-16 |
| CVE-2026-88075 Improper neutralization of special elements used in an sql command ('sql injecti... |
high | 8.8 | — | Microsoft / configuration manager 2503 | 2026-10-13 | 2026-10-16 |
| CVE-2026-88076 Null pointer dereference in Windows Installer allows an authorized attacker to e... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-88079 Null pointer dereference in Windows MIDI Service Module allows an authorized att... |
high | 7.0 | — | Microsoft / windows 11 24h2 | 2026-10-13 | 2026-10-16 |
| CVE-2026-88080 Use after free in Windows Installer allows an authorized attacker to elevate pri... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-88091 Deserialization of untrusted data in Windows Management Instrumentation allows a... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-87715 Use after free in Windows Installer allows an authorized attacker to elevate pri... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-87716 Heap-based buffer overflow in Windows Storage Spaces Controller allows an unauth... |
high | 7.5 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-16 |
| CVE-2026-88070 Out-of-bounds read in Windows BitLocker allows an authorized attacker to elevate... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-88071 Double free in Windows Hyper-V allows an authorized attacker to elevate privileg... |
high | 7.8 | — | Microsoft / windows 11 23h2 | 2026-10-13 | 2026-10-16 |
| CVE-2026-88072 Improper access control in Windows Host Guardian Service allows an authorized at... |
high | 7.8 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-16 |
| CVE-2026-87710 Improper access control in Microsoft Local Security Authority Server (lsasrv) al... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-87711 Stack-based buffer overflow in Windows Installer allows an authorized attacker t... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-87712 Use after free in Windows Quality of Service (QoS) Packet Scheduler allows an au... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-87713 Use after free in Windows Bluetooth Port Driver allows an unauthorized attacker... |
high | 7.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-87702 Integer overflow or wraparound in Windows Resource Management (MRM) allows an au... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-87704 Use after free in Windows Installer allows an authorized attacker to elevate pri... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-87705 Improper verification of source of a communication channel in Windows Hyper-V al... |
high | 7.4 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-87706 Heap-based buffer overflow in Windows Storage Spaces Controller allows an author... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-87707 Heap-based buffer overflow in Windows Fax and Scan Service allows an authorized... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-87708 Use after free in Windows Installer allows an authorized attacker to elevate pri... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-87695 Inclusion of functionality from untrusted control sphere in Microsoft Exchange S... |
high | 7.8 | — | Microsoft / exchange server | 2026-10-13 | 2026-10-27 |
| CVE-2026-87696 Improper verification of cryptographic signature in Microsoft Exchange Server al... |
high | 7.5 | — | Microsoft / exchange server | 2026-10-13 | 2026-10-27 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.