October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,457
Critical
1,335
High
5,835
Medium
6,249
Low
648
Severity not reported
3,390
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1307), google (756), oracle (156), ibm (140), adobe (138), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-103837 Substance3D - Stager is affected by an out-of-bounds write vulnerability that co... |
high | 7.8 | — | Adobe / substance 3d stager | 2026-10-13 | 2026-10-19 |
| CVE-2026-103838 Substance3D - Stager is affected by an out-of-bounds write vulnerability that co... |
high | 7.8 | — | Adobe / substance 3d stager | 2026-10-13 | 2026-10-19 |
| CVE-2026-103839 Substance3D - Stager is affected by an out-of-bounds write vulnerability that co... |
high | 7.8 | — | Adobe / substance 3d stager | 2026-10-13 | 2026-10-19 |
| CVE-2026-103840 Substance3D - Stager is affected by an out-of-bounds read vulnerability when par... |
high | 7.8 | — | Adobe / substance 3d stager | 2026-10-13 | 2026-10-20 |
| CVE-2026-103841 Substance3D - Stager is affected by an out-of-bounds read vulnerability when par... |
high | 7.8 | — | Adobe / substance 3d stager | 2026-10-13 | 2026-10-20 |
| CVE-2026-103842 Substance3D - Stager is affected by an out-of-bounds read vulnerability when par... |
high | 7.8 | — | Adobe / substance 3d stager | 2026-10-13 | 2026-10-20 |
| CVE-2026-103843 Substance3D - Stager is affected by a Use After Free vulnerability that could re... |
high | 7.8 | — | Adobe / substance 3d stager | 2026-10-13 | 2026-10-20 |
| CVE-2026-103844 Dimension is affected by an out-of-bounds write vulnerability that could result... |
high | 7.8 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-103845 Dimension is affected by an Uncontrolled Search Path Element vulnerability that... |
high | 8.6 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-103830 Substance3D - Stager is affected by a Stack-based Buffer Overflow vulnerability... |
high | 7.8 | — | Adobe / substance 3d stager | 2026-10-13 | 2026-10-19 |
| CVE-2026-103832 Substance3D - Stager is affected by an out-of-bounds write vulnerability that co... |
high | 7.8 | — | Adobe / substance 3d stager | 2026-10-13 | 2026-10-19 |
| CVE-2026-103833 Substance3D - Stager is affected by an out-of-bounds write vulnerability that co... |
high | 7.8 | — | Adobe / substance 3d stager | 2026-10-13 | 2026-10-19 |
| CVE-2026-103834 Substance3D - Stager is affected by an out-of-bounds write vulnerability that co... |
high | 7.8 | — | Adobe / substance 3d stager | 2026-10-13 | 2026-10-19 |
| CVE-2026-103835 Substance3D - Stager is affected by an out-of-bounds write vulnerability that co... |
high | 7.8 | — | Adobe / substance 3d stager | 2026-10-13 | 2026-10-19 |
| CVE-2026-103836 Substance3D - Stager is affected by an out-of-bounds write vulnerability that co... |
high | 7.8 | — | Adobe / substance 3d stager | 2026-10-13 | 2026-10-19 |
| CVE-2026-102855 Heap-based buffer overflow in Microsoft Office Visio allows an unauthorized atta... |
high | 8.8 | — | Microsoft / 365 apps | 2026-10-13 | 2026-10-20 |
| CVE-2026-102234 Reliance on untrusted inputs in a security decision in Visual Studio Code allows... |
high | 7.4 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-102235 Improper encoding or escaping of output in Visual Studio Code allows an unauthor... |
high | 8.8 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-97830 Double free in Windows Internet Information Services allows an unauthorized atta... |
high | 7.5 | — | Microsoft / windows 11 23h2 | 2026-10-13 | 2026-10-14 |
| CVE-2026-97809 Use after free in Windows Broadcast DVR User Service allows an authorized attack... |
high | 7.8 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-16 |
| CVE-2026-97810 Heap-based buffer overflow in Windows Container Isolation FS Filter Driver (unio... |
high | 7.0 | — | Microsoft / windows 11 24h2 | 2026-10-13 | 2026-10-16 |
| CVE-2026-97811 Double free in OpenSSH for Windows allows an authorized attacker to elevate priv... |
high | 7.8 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-16 |
| CVE-2026-97812 Double free in Windows Update Orchestrator Service allows an authorized attacker... |
high | 7.0 | — | Microsoft / windows 10 21h2 | 2026-10-13 | 2026-10-16 |
| CVE-2026-97801 Improper validation of specified type of input in .NET Framework allows an unaut... |
high | 7.5 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-97803 Heap-based buffer overflow in Windows Kernel allows an authorized attacker to el... |
high | 7.8 | — | Microsoft / windows 11 26h1 | 2026-10-13 | 2026-10-16 |
| CVE-2026-97804 Heap-based buffer overflow in HID class driver allows an authorized attacker to... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-97806 Use after free in Windows Broadcast DVR User Service allows an authorized attack... |
high | 7.8 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-16 |
| CVE-2026-97807 Use after free in Windows Broadcast DVR User Service allows an authorized attack... |
high | 7.8 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-16 |
| CVE-2026-97808 Use after free in Windows Broadcast DVR User Service allows an authorized attack... |
high | 7.0 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-16 |
| CVE-2026-97792 Improper access control in Windows Container Isolation FS Filter Driver (unionfs... |
high | 7.8 | — | Microsoft / windows 11 23h2 | 2026-10-13 | 2026-10-16 |
| CVE-2026-97793 Missing authentication for critical function in Windows Setup and Deployment all... |
high | 7.0 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-16 |
| CVE-2026-97794 Heap-based buffer overflow in Windows Container Isolation FS Filter Driver (unio... |
high | 7.8 | — | Microsoft / windows 11 23h2 | 2026-10-13 | 2026-10-16 |
| CVE-2026-97798 Improper neutralization of argument delimiters in a command ('argument injection... |
high | 7.8 | — | Microsoft / windows 10 21h2 | 2026-10-13 | 2026-10-16 |
| CVE-2026-97799 Improper verification of cryptographic signature in Windows Audio Service allows... |
high | 7.8 | — | Microsoft / windows 11 24h2 | 2026-10-13 | 2026-10-16 |
| CVE-2026-97800 Incorrect permission assignment for critical resource in Windows Mobile Broadban... |
high | 7.8 | — | Microsoft / windows 11 24h2 | 2026-10-13 | 2026-10-16 |
| CVE-2026-97780 Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized atta... |
high | 8.8 | — | Microsoft / 365 apps | 2026-10-13 | 2026-10-15 |
| CVE-2026-97781 Improper neutralization of special elements used in a command ('command injectio... |
high | 8.8 | — | Microsoft / 365 apps | 2026-10-13 | 2026-10-16 |
| CVE-2026-97787 Concurrent execution using shared resource with improper synchronization ('race... |
high | 7.0 | — | Microsoft / windows 11 23h2 | 2026-10-13 | 2026-10-16 |
| CVE-2026-97788 Observable discrepancy in Active Directory Federation Services (AD FS) allows an... |
high | 7.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-97789 Use after free in Remote Desktop Client allows an unauthorized attacker to execu... |
high | 7.5 | — | Microsoft / windows server 2022 | 2026-10-13 | 2026-10-16 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.