October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,462
Critical
1,337
High
5,864
Medium
6,249
Low
648
Severity not reported
3,364
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1307), google (756), oracle (156), ibm (140), adobe (138), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-85797 Out-of-bounds read in Windows GDI allows an unauthorized attacker to disclose in... |
high | 7.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-85798 Heap-based buffer overflow in Windows Distributed File System (DFS) allows an au... |
high | 7.2 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-85799 Use after free in Network Policy Server (NPS) allows an unauthorized attacker to... |
high | 8.1 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-85800 Heap-based buffer overflow in Windows Error Reporting allows an authorized attac... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-85791 Heap-based buffer overflow in Windows Encrypting File System (EFS) allows an aut... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-85372 Use after free in Windows Kernel allows an authorized attacker to elevate privil... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-85373 Heap-based buffer overflow in Windows Universal Plug and Play (UPnP) Device Host... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-85375 Use after free in Windows Universal Plug and Play (UPnP) Device Host allows an a... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-85376 Weak authentication in Windows Print Spooler Components allows an authorized att... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-85377 Access of resource using incompatible type ('type confusion') in Windows CD-ROM... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-85367 Use after free in Windows Cash Drawer Protocol Provider allows an authorized att... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-85368 Heap-based buffer overflow in Windows TCP/IP allows an authorized attacker to el... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-85369 Out-of-bounds read in Windows Hyper-V allows an authorized attacker to elevate p... |
high | 8.8 | — | Microsoft / windows 10 21h2 | 2026-10-13 | 2026-10-28 |
| CVE-2026-85370 Use after free in WebDAV allows an authorized attacker to elevate privileges loc... |
high | 7.0 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-85371 Use after free in Network Policy Server (NPS) allows an unauthorized attacker to... |
high | 8.1 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-85361 Use after free in Windows Installer allows an authorized attacker to elevate pri... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-85362 Release of invalid pointer or reference in Windows Management Instrumentation al... |
high | 7.0 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-85363 Integer overflow or wraparound in .NET Framework allows an unauthorized attacker... |
high | 8.8 | — | — | 2026-10-13 | 2026-10-22 |
| CVE-2026-85364 Use after free in Windows Installer allows an authorized attacker to elevate pri... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-85365 Heap-based buffer overflow in Servicing Stack Updates allows an authorized attac... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-85366 Heap-based buffer overflow in Windows Installer allows an authorized attacker to... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-85355 Inclusion of functionality from untrusted control sphere in Windows Common Log F... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-85356 Out-of-bounds read in Windows Volume Manager Extension Driver allows an authoriz... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-85357 Concurrent execution using shared resource with improper synchronization ('race... |
high | 7.0 | — | Microsoft / windows 11 23h2 | 2026-10-13 | 2026-10-28 |
| CVE-2026-85358 Heap-based buffer overflow in Windows Installer allows an authorized attacker to... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-85359 Improper control of generation of code ('code injection') in Windows Performance... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-85341 Heap-based buffer overflow in Windows USB Video Driver allows an authorized atta... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-85342 Use after free in Windows Device Association Service allows an authorized attack... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-85343 Improper link resolution before file access ('link following') in Windows Hyper-... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-85352 Use after free in Windows Device Association Service allows an authorized attack... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-85353 Out-of-bounds read in Windows Print Spooler Components allows an unauthorized at... |
high | 7.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-85354 Use after free in Windows Error Reporting allows an authorized attacker to eleva... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-85334 Out-of-bounds read in Windows Message Queuing Queue Manager allows an unauthoriz... |
high | 7.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-85338 Out-of-bounds read in Microsoft Graphics Component allows an authorized attacker... |
high | 7.8 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-17 |
| CVE-2026-85339 Remote Code Execution in Windows Routing and Remote Access Service (RRAS) allows... |
high | 8.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-85340 Use after free in Microsoft Office Click-To-Run allows an authorized attacker to... |
high | 7.8 | — | Microsoft / 365 apps | 2026-10-13 | 2026-10-15 |
| CVE-2026-85329 Concurrent execution using shared resource with improper synchronization ('race... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-85332 Use after free in Windows Device Association Service allows an authorized attack... |
high | 7.8 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-16 |
| CVE-2026-85333 Concurrent execution using shared resource with improper synchronization ('race... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-85327 Heap-based buffer overflow in Windows Print Spooler Components allows an authori... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.