October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,479
Critical
1,340
High
5,872
Medium
6,263
Low
649
Severity not reported
3,355
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1307), google (756), oracle (156), ibm (140), adobe (138), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-83587 Untrusted pointer dereference in Windows Core Messaging allows an authorized att... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83588 Heap-based buffer overflow in Windows USB Driver allows an authorized attacker t... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-83634 Double free in Windows BitLocker allows an authorized attacker to elevate privil... |
high | 7.8 | — | Microsoft / windows 11 23h2 | 2026-10-13 | 2026-10-28 |
| CVE-2026-83635 Out-of-bounds read in DNS Server allows an unauthorized attacker to deny service... |
high | 7.5 | — | Microsoft / windows server 2012 | 2026-10-13 | 2026-10-16 |
| CVE-2026-83637 Out-of-bounds read in Windows Kernel-Mode Drivers allows an authorized attacker... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-83583 Improper access control in Windows Geotag Broker allows an authorized attacker t... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83584 Use after free in Windows Smart Card allows an authorized attacker to elevate pr... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-83585 Use of externally-controlled format string in Windows NTFS allows an authorized... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-83586 Weak authentication in Windows Resilient File System (ReFS) Deduplication Servic... |
high | 7.8 | — | Microsoft / windows 11 23h2 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83574 Use after free in Microsoft Windows Search Component allows an authorized attack... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-83575 Use after free in Microsoft Windows Search Component allows an authorized attack... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-83579 Heap-based buffer overflow in Windows Smart Card allows an authorized attacker t... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-83580 Heap-based buffer overflow in Windows Client-Side Caching (CSC) Service allows a... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83567 Out-of-bounds read in Windows NTFS allows an authorized attacker to elevate priv... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-83568 Improper access control in Windows Kernel-Mode Drivers allows an authorized atta... |
high | 7.8 | — | Microsoft / windows 11 24h2 | 2026-10-13 | 2026-10-28 |
| CVE-2026-83569 Heap-based buffer overflow in HID Parser Library allows an authorized attacker t... |
high | 7.8 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83570 Use after free in Microsoft Windows Search Component allows an authorized attack... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-83522 Reliance on untrusted inputs in a security decision in Windows IKE Extension all... |
high | 8.1 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83564 Use after free in Microsoft Windows Search Component allows an authorized attack... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83566 Use after free in Windows Win32K - ICOMP allows an authorized attacker to elevat... |
high | 7.0 | — | Microsoft / windows 11 24h2 | 2026-10-13 | 2026-10-28 |
| CVE-2026-83515 Use of uninitialized resource in RPC Runtime allows an unauthorized attacker to... |
high | 7.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83516 Out-of-bounds read in Windows Local Security Authority Subsystem Service (LSASS)... |
high | 7.5 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83518 Heap-based buffer overflow in RPC Runtime allows an authorized attacker to eleva... |
high | 7.8 | — | Microsoft / windows 11 23h2 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83520 Deserialization of untrusted data in .NET allows an unauthorized attacker to exe... |
high | 8.8 | — | — | 2026-10-13 | 2026-10-22 |
| CVE-2026-83509 Untrusted search path in Windows Setup Files Cleanup allows an authorized attack... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-83510 Time-of-check time-of-use (toctou) race condition in Windows Setup Files Cleanup... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-83511 Weak authentication in Active Directory Federation Services (AD FS) allows an un... |
high | 7.4 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-83513 Use after free in Windows Universal Disk Format File System Driver (UDFS) allows... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83514 Heap-based buffer overflow in Windows Partition Management Driver allows an auth... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83499 Insufficient granularity of access control in Windows Server Update Service allo... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-83505 Time-of-check time-of-use (toctou) race condition in Windows Setup Files Cleanup... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-83506 Untrusted search path in Servicing Stack Updates allows an authorized attacker t... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-83508 Out-of-bounds read in Windows NTFS allows an authorized attacker to elevate priv... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-77910 Incorrect authorization in Microsoft Exchange Server allows an authorized attack... |
high | 8.8 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-78459 Heap-based buffer overflow in Windows Internet Information Services allows an au... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-81969 Insufficient granularity of access control in Windows Server Update Service allo... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-81971 Concurrent execution using shared resource with improper synchronization ('race... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-77496 Heap-based buffer overflow in Windows Imaging Component allows an unauthorized a... |
high | 8.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-77902 Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized atta... |
high | 8.8 | — | Microsoft / 365 apps | 2026-10-13 | 2026-10-15 |
| CVE-2026-72969 Use after free in Windows Program Compatibility Assistant Service allows an auth... |
high | 7.0 | — | Microsoft / windows 11 23h2 | 2026-10-13 | 2026-10-28 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.