October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,457
Critical
1,337
High
5,864
Medium
6,249
Low
648
Severity not reported
3,359
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1307), google (756), oracle (156), ibm (140), adobe (138), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-96847 Untrusted pointer dereference in WebDAV allows an authorized attacker to elevate... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-96323 Use after free in Windows Update allows an authorized attacker to elevate privil... |
high | 7.0 | — | Microsoft / windows 10 21h2 | 2026-10-13 | 2026-10-16 |
| CVE-2026-96324 Use after free in Microsoft Windows Search Component allows an authorized attack... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-96322 Use after free in Windows Remote Desktop Protocol allows an authorized attacker... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-96317 Use after free in Windows Kernel allows an authorized attacker to elevate privil... |
high | 7.8 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-16 |
| CVE-2026-96318 Heap-based buffer overflow in Windows Resume allows an authorized attacker to el... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-96319 Use after free in Windows USB Print Driver allows an authorized attacker to elev... |
high | 7.0 | — | Microsoft / windows 10 21h2 | 2026-10-13 | 2026-10-16 |
| CVE-2026-96308 Use after free in Windows Installer allows an authorized attacker to elevate pri... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-96309 Use after free in Windows Subsystem for Linux allows an authorized attacker to e... |
high | 7.8 | — | Microsoft / windows 10 21h2 | 2026-10-13 | 2026-10-16 |
| CVE-2026-96310 Use after free in Windows USB Print Driver allows an authorized attacker to elev... |
high | 7.0 | — | Microsoft / windows 10 21h2 | 2026-10-13 | 2026-10-16 |
| CVE-2026-96312 Heap-based buffer overflow in Windows Kernel allows an authorized attacker to el... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-96313 Missing authentication for critical function in Windows Push Notifications allow... |
high | 7.0 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-16 |
| CVE-2026-96302 Use after free in Windows Installer allows an authorized attacker to elevate pri... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-96304 Use after free in Windows USB Print Driver allows an authorized attacker to elev... |
high | 7.0 | — | Microsoft / windows 10 21h2 | 2026-10-13 | 2026-10-16 |
| CVE-2026-96305 Use after free in Windows Installer allows an authorized attacker to elevate pri... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-96306 Out-of-bounds read in Windows Sysmain Service allows an authorized attacker to e... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-96307 Use after free in Windows Installer allows an authorized attacker to elevate pri... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-96250 Use after free in Windows USB Print Driver allows an authorized attacker to elev... |
high | 7.0 | — | Microsoft / windows 10 21h2 | 2026-10-13 | 2026-10-16 |
| CVE-2026-96251 Reliance on untrusted inputs in a security decision in Microsoft PowerShell allo... |
high | 8.8 | — | Microsoft / powershell | 2026-10-13 | 2026-10-22 |
| CVE-2026-96253 Use after free in Windows USB Print Driver allows an authorized attacker to elev... |
high | 7.0 | — | Microsoft / windows 10 21h2 | 2026-10-13 | 2026-10-16 |
| CVE-2026-96254 Use after free in Windows USB Print Driver allows an authorized attacker to elev... |
high | 7.0 | — | Microsoft / windows 10 21h2 | 2026-10-13 | 2026-10-16 |
| CVE-2026-96301 Use after free in Windows USB Print Driver allows an authorized attacker to elev... |
high | 7.0 | — | Microsoft / windows 10 21h2 | 2026-10-13 | 2026-10-16 |
| CVE-2026-96245 Out-of-bounds read in Windows Routing and Remote Access Service (RRAS) allows an... |
high | 7.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-96246 Out-of-bounds read in Network Policy Server (NPS) allows an unauthorized attacke... |
high | 7.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-20 |
| CVE-2026-96248 Stack-based buffer overflow in Windows Host Guardian Service allows an unauthori... |
high | 7.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-96249 Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker t... |
high | 7.8 | — | Microsoft / windows 11 24h2 | 2026-10-13 | 2026-10-16 |
| CVE-2026-96233 Out-of-bounds write in ASP.NET Core allows an unauthorized attacker to deny serv... |
high | 7.5 | — | — | 2026-10-13 | 2026-10-22 |
| CVE-2026-96235 Out-of-bounds write in .NET allows an unauthorized attacker to execute code over... |
high | 8.8 | — | — | 2026-10-13 | 2026-10-22 |
| CVE-2026-96236 Allocation of resources without limits or throttling in ASP.NET Core allows an u... |
high | 7.5 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-96237 Inclusion of functionality from untrusted control sphere in .NET allows an unaut... |
high | 7.5 | — | — | 2026-10-13 | 2026-10-22 |
| CVE-2026-96243 Improper link resolution before file access ('link following') in Windows Wallet... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-96244 Use after free in Windows Internal System User Profile allows an authorized atta... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-96222 Improper certificate validation in Active Directory Federation Services (AD FS)... |
high | 7.4 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-22 |
| CVE-2026-96223 Use after free in Windows Hyper-V allows an authorized attacker to elevate privi... |
high | 7.8 | — | Microsoft / windows 11 24h2 | 2026-10-13 | 2026-10-16 |
| CVE-2026-96224 Out-of-bounds write in .NET allows an unauthorized attacker to execute code over... |
high | 8.8 | — | — | 2026-10-13 | 2026-10-22 |
| CVE-2026-96225 Improper link resolution before file access ('link following') in .NET allows an... |
high | 7.8 | — | — | 2026-10-13 | 2026-10-22 |
| CVE-2026-96230 Improper neutralization of input during web page generation ('cross-site scripti... |
high | 8.8 | — | — | 2026-10-13 | 2026-10-22 |
| CVE-2026-96231 Improper link resolution before file access ('link following') in .NET allows an... |
high | 7.8 | — | — | 2026-10-13 | 2026-10-22 |
| CVE-2026-96232 Out-of-bounds read in .NET allows an unauthorized attacker to disclose informati... |
high | 7.5 | — | — | 2026-10-13 | 2026-10-22 |
| CVE-2026-96215 Concurrent execution using shared resource with improper synchronization ('race... |
high | 7.0 | — | Microsoft / windows 11 24h2 | 2026-10-13 | 2026-10-16 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.