October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,462
Critical
1,337
High
5,864
Medium
6,249
Low
648
Severity not reported
3,364
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1307), google (756), oracle (156), ibm (140), adobe (138), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-85867 Heap-based buffer overflow in Windows Remote Access Connection Manager allows an... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-85868 Use after free in Windows Common Log File System Driver allows an authorized att... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-85856 Heap-based buffer overflow in Windows Internet Connection Sharing (ICS) allows a... |
high | 7.1 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-85858 Out-of-bounds read in Windows Win32 Kernel Subsystem allows an authorized attack... |
high | 7.8 | — | Microsoft / windows 11 23h2 | 2026-10-13 | 2026-10-29 |
| CVE-2026-85860 Use after free in Windows Message Queuing Queue Manager allows an authorized att... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-85861 Use after free in Windows Clipboard User Service allows an authorized attacker t... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-85849 Improper link resolution before file access ('link following') in Windows AppX D... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-85850 Release of invalid pointer or reference in Windows Kernel allows an authorized a... |
high | 7.8 | — | Microsoft / windows 11 26h1 | 2026-10-13 | 2026-10-29 |
| CVE-2026-85851 Use after free in Windows SmartScreen allows an authorized attacker to elevate p... |
high | 7.8 | — | Microsoft / windows 11 23h2 | 2026-10-13 | 2026-10-29 |
| CVE-2026-85853 Out-of-bounds read in Windows DWM Core Library allows an authorized attacker to... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-85854 Use after free in Windows DWM Core Library allows an authorized attacker to elev... |
high | 7.0 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-29 |
| CVE-2026-85855 Use after free in Windows DWM Core Library allows an authorized attacker to elev... |
high | 7.0 | — | Microsoft / windows 11 24h2 | 2026-10-13 | 2026-10-29 |
| CVE-2026-85842 Use of externally-controlled format string in Windows Image Acquisition allows a... |
high | 7.8 | — | Microsoft / windows 10 21h2 | 2026-10-13 | 2026-10-29 |
| CVE-2026-85843 Use of uninitialized resource in Windows Background Intelligent Transfer Service... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-85846 Use after free in Windows Web Account Manager allows an authorized attacker to e... |
high | 7.0 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-29 |
| CVE-2026-85848 Heap-based buffer overflow in Windows Background Intelligent Transfer Service (B... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-85833 Use after free in Windows Modern Device Management (MDM) allows an authorized at... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-85834 Heap-based buffer overflow in Windows TCP/IP allows an authorized attacker to el... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-85836 Use after free in Windows Kernel allows an authorized attacker to elevate privil... |
high | 7.8 | — | Microsoft / windows 11 24h2 | 2026-10-13 | 2026-10-16 |
| CVE-2026-85837 Out-of-bounds read in Windows Kernel allows an authorized attacker to elevate pr... |
high | 7.8 | — | Microsoft / windows 11 24h2 | 2026-10-13 | 2026-10-16 |
| CVE-2026-85828 Heap-based buffer overflow in WebDAV allows an authorized attacker to elevate pr... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-85829 Double free in Windows Wired AutoConfig Service allows an authorized attacker to... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-85832 Heap-based buffer overflow in Windows Background Intelligent Transfer Service (B... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-85822 Heap-based buffer overflow in Windows exFAT File System allows an authorized att... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-85823 Use after free in Windows Composite Image File System allows an authorized attac... |
high | 7.0 | — | Microsoft / windows 11 24h2 | 2026-10-13 | 2026-10-16 |
| CVE-2026-85824 Use after free in Windows Composite Image File System allows an authorized attac... |
high | 7.0 | — | Microsoft / windows 10 21h2 | 2026-10-13 | 2026-10-16 |
| CVE-2026-85825 Use after free in Windows Universal Disk Format File System Driver (UDFS) allows... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-85826 Out-of-bounds write in Windows Fast FAT Driver allows an authorized attacker to... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-85827 Heap-based buffer overflow in WebDAV allows an authorized attacker to elevate pr... |
high | 7.0 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-85817 Reliance on untrusted inputs in a security decision in Windows PowerShell allows... |
high | 8.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-85820 Use after free in Windows Universal Disk Format File System Driver (UDFS) allows... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-85808 Out-of-bounds read in Windows Routing and Remote Access Service (RRAS) allows an... |
high | 7.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-85810 Use after free in Windows Telephony Server allows an authorized attacker to elev... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-85811 Use after free in Network Policy Server (NPS) allows an unauthorized attacker to... |
high | 7.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-85802 Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker t... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-85803 Use after free in Windows Camera Frame Server Monitor allows an authorized attac... |
high | 7.0 | — | Microsoft / windows 11 23h2 | 2026-10-13 | 2026-10-16 |
| CVE-2026-85804 Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker t... |
high | 7.8 | — | Microsoft / windows 11 23h2 | 2026-10-13 | 2026-10-16 |
| CVE-2026-85807 Integer overflow or wraparound in Windows USB Video Driver allows an authorized... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-85795 Use after free in Windows Text Services Framework allows an authorized attacker... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-85796 Numeric truncation error in Windows Installer allows an authorized attacker to e... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.