October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,463
Critical
1,337
High
5,864
Medium
6,249
Low
648
Severity not reported
3,365
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1307), google (756), oracle (156), ibm (140), adobe (138), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-85328 Weak authentication in Windows Projected File System allows an authorized attack... |
high | 7.0 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-16 |
| CVE-2026-85319 Allocation of resources without limits or throttling in Active Directory Federat... |
high | 7.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-85321 Allocation of resources without limits or throttling in Active Directory Federat... |
high | 7.5 | — | Microsoft / windows server 2012 | 2026-10-13 | 2026-10-29 |
| CVE-2026-85322 Use of uninitialized resource in Windows Routing and Remote Access Service (RRAS... |
high | 7.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-85324 Memory allocation with excessive size value in Active Directory Federation Servi... |
high | 7.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-84017 Null pointer dereference in Windows Routing and Remote Access Service (RRAS) all... |
high | 7.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-19 |
| CVE-2026-84018 Use after free in Windows Print Spooler Components allows an authorized attacker... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-19 |
| CVE-2026-84019 Use after free in Windows Advanced Rasterization Platform allows an authorized a... |
high | 7.0 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-19 |
| CVE-2026-84020 Use after free in Windows Routing and Remote Access Service (RRAS) allows an aut... |
high | 7.0 | — | Microsoft / windows 10 21h2 | 2026-10-13 | 2026-10-19 |
| CVE-2026-85318 Heap-based buffer overflow in Servicing Stack Updates allows an authorized attac... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-84012 Double free in Remote Desktop Gateway Service allows an unauthorized attacker to... |
high | 8.1 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-19 |
| CVE-2026-84013 Use after free in Windows Telephony Server allows an authorized attacker to elev... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-19 |
| CVE-2026-84014 Heap-based buffer overflow in Windows Device Association Service allows an autho... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-19 |
| CVE-2026-84016 Out-of-bounds write in Windows EAPHost Service allows an authorized attacker to... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-19 |
| CVE-2026-83934 Stack-based buffer overflow in Windows GDI+ allows an unauthorized attacker to e... |
high | 8.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-19 |
| CVE-2026-84008 Inefficient algorithmic complexity in .NET allows an unauthorized attacker to de... |
high | 7.5 | — | — | 2026-10-13 | 2026-10-22 |
| CVE-2026-83927 Improper link resolution before file access ('link following') in Windows Regist... |
high | 7.8 | — | Microsoft / windows 10 21h2 | 2026-10-13 | 2026-10-26 |
| CVE-2026-83928 Out-of-bounds write in Windows Local Security Authority Subsystem Service (LSASS... |
high | 8.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-26 |
| CVE-2026-83929 Out-of-bounds write in Windows GDI allows an unauthorized attacker to execute co... |
high | 8.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-26 |
| CVE-2026-83930 Use after free in Windows Update Orchestrator Service allows an authorized attac... |
high | 7.0 | — | Microsoft / windows 11 23h2 | 2026-10-13 | 2026-10-26 |
| CVE-2026-83931 Heap-based buffer overflow in Windows Hyper-V allows an authorized attacker to e... |
high | 7.8 | — | Microsoft / windows 11 23h2 | 2026-10-13 | 2026-10-26 |
| CVE-2026-83932 Heap-based buffer overflow in Windows Group Policy allows an authorized attacker... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-26 |
| CVE-2026-83922 Use after free in Windows Direct Composition allows an authorized attacker to el... |
high | 7.8 | — | Microsoft / windows 10 21h2 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83923 Relative path traversal in OpenSSH for Windows allows an unauthorized attacker t... |
high | 8.8 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83924 Use after free in Windows Kernel allows an authorized attacker to elevate privil... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-26 |
| CVE-2026-83916 Double free in Windows Error Reporting allows an authorized attacker to execute... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83917 Use after free in Windows ALPC allows an authorized attacker to elevate privileg... |
high | 7.0 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83918 Integer overflow or wraparound in Windows Kernel allows an authorized attacker t... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83919 Heap-based buffer overflow in Microsoft Internet Messaging API allows an authori... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83920 Heap-based buffer overflow in Microsoft Windows Search Component allows an autho... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83921 Heap-based buffer overflow in Microsoft Windows Search Component allows an autho... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83911 Heap-based buffer overflow in Windows Storage allows an authorized attacker to e... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83912 Use after free in Windows Direct Composition allows an authorized attacker to el... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83913 Use after free in Windows Kernel allows an authorized attacker to elevate privil... |
high | 7.8 | — | Microsoft / windows 10 21h2 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83914 Use after free in Microsoft XML allows an unauthorized attacker to execute code... |
high | 8.1 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83915 Use after free in Windows Diagnostic Policy Service allows an authorized attacke... |
high | 7.0 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83908 Release of invalid pointer or reference in RPC Runtime allows an authorized atta... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83900 Use after free in Windows Bind Filter Driver allows an authorized attacker to el... |
high | 7.0 | — | Microsoft / windows 11 23h2 | 2026-10-13 | 2026-10-21 |
| CVE-2026-83901 Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker t... |
high | 7.0 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83902 Heap-based buffer overflow in Windows Direct Composition allows an authorized at... |
high | 7.8 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-29 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.