October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,476
Critical
1,339
High
5,869
Medium
6,255
Low
648
Severity not reported
3,365
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1307), google (756), oracle (156), ibm (140), adobe (138), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-69850 Untrusted pointer dereference in Windows Certificates allows an authorized attac... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-26 |
| CVE-2026-69856 Use after free in Windows Storage allows an authorized attacker to elevate privi... |
high | 7.0 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-26 |
| CVE-2026-69867 Out-of-bounds read in SQLite allows an authorized attacker to elevate privileges... |
high | 7.8 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-69880 Access of resource using incompatible type ('type confusion') in Desktop Window... |
high | 7.8 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-19 |
| CVE-2026-69766 Use after free in Windows Storage allows an authorized attacker to elevate privi... |
high | 7.0 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-26 |
| CVE-2026-69783 External control of file name or path in Windows Update allows an authorized att... |
high | 7.8 | — | Microsoft / windows 11 23h2 | 2026-10-13 | 2026-10-26 |
| CVE-2026-69789 Heap-based buffer overflow in Reliable Multicast Transport Driver (RMCAST) allow... |
high | 7.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-27 |
| CVE-2026-69795 Null pointer dereference in Windows Clipboard Server allows an authorized attack... |
high | 7.0 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-26 |
| CVE-2026-69798 Use after free in Windows Wired AutoConfig Service allows an authorized attacker... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-26 |
| CVE-2026-69802 Weak authentication in Network Device Enrollment Service (NDES) allows an unauth... |
high | 8.1 | — | Microsoft / windows server 2012 | 2026-10-13 | 2026-10-27 |
| CVE-2026-69830 Concurrent execution using shared resource with improper synchronization ('race... |
high | 8.1 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-26 |
| CVE-2026-69733 Untrusted search path in Windows Update allows an authorized attacker to elevate... |
high | 7.8 | — | Microsoft / windows 11 23h2 | 2026-10-13 | 2026-10-23 |
| CVE-2026-69736 Concurrent execution using shared resource with improper synchronization ('race... |
high | 7.0 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-69743 Use after free in Windows Program Compatibility Assistant Service allows an auth... |
high | 7.0 | — | Microsoft / windows 11 23h2 | 2026-10-13 | 2026-10-28 |
| CVE-2026-69763 Use after free in Windows Storage allows an authorized attacker to elevate privi... |
high | 7.0 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-28 |
| CVE-2026-69765 Use after free in Windows Storport Miniport Driver allows an unauthorized attack... |
high | 8.8 | — | Microsoft / windows server 2025 | 2026-10-13 | 2026-10-26 |
| CVE-2026-69650 Improper verification of cryptographic signature in Windows Key Distribution Cen... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-69651 Inefficient algorithmic complexity in .NET allows an unauthorized attacker to de... |
high | 7.5 | — | — | 2026-10-13 | 2026-10-22 |
| CVE-2026-69673 Improper link resolution before file access ('link following') in Windows Update... |
high | 7.8 | — | Microsoft / windows 11 23h2 | 2026-10-13 | 2026-10-23 |
| CVE-2026-69718 Improper neutralization of special elements used in a command ('command injectio... |
high | 7.8 | — | Microsoft / windows 11 23h2 | 2026-10-13 | 2026-10-23 |
| CVE-2026-69596 Use after free in Windows Program Compatibility Assistant Service allows an auth... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-26 |
| CVE-2026-69633 Heap-based buffer overflow in Windows Update allows an authorized attacker to el... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-26 |
| CVE-2026-69452 Use after free in Windows Enterprise App Management allows an authorized attacke... |
high | 7.1 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-23 |
| CVE-2026-69454 Out-of-bounds read in Microsoft Azure Attestation service and Device Health Atte... |
high | 7.5 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-69471 Heap-based buffer overflow in Windows Installer allows an authorized attacker to... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-23 |
| CVE-2026-69521 Integer overflow or wraparound in Windows iSCSI allows an unauthorized attacker... |
high | 8.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-23 |
| CVE-2026-69577 Out-of-bounds read in Microsoft Azure Attestation service and Device Health Atte... |
high | 7.5 | — | Microsoft / windows server 2019 | 2026-10-13 | 2026-10-27 |
| CVE-2026-69326 Heap-based buffer overflow in Graphic Fonts allows an unauthorized attacker to e... |
high | 8.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-23 |
| CVE-2026-69354 Heap-based buffer overflow in Windows Error Reporting allows an authorized attac... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-23 |
| CVE-2026-69363 Heap-based buffer overflow in Windows Error Reporting allows an authorized attac... |
high | 8.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-23 |
| CVE-2026-69370 Improper neutralization of special elements used in a command ('command injectio... |
high | 8.8 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-69387 Use after free in Windows Error Reporting allows an authorized attacker to eleva... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-23 |
| CVE-2026-61931 Use after free in Windows Perception Simulation Service allows an authorized att... |
high | 7.8 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-26 |
| CVE-2026-68836 Heap-based buffer overflow in Windows kernel32.dll allows an authorized attacker... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-23 |
| CVE-2026-49785 Improper resource shutdown or release in Windows UEFI allows an authorized attac... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-26 |
| CVE-2026-58280 Uncontrolled recursion in .NET allows an unauthorized attacker to deny service o... |
high | 7.5 | — | — | 2026-10-13 | 2026-10-22 |
| CVE-2026-110238 Rapyd Admin from 9.0.0 before 9.20.0 contains an authorization bypass vulnerabil... |
high | 8.8 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-110247 Several buffer-growth sites in libmime performed size arithmetic in 32-bit types... |
high | 8.4 | — | — | 2026-10-13 | 2026-10-27 |
| CVE-2026-110249 A malicious, compromised, or MITM-controlled Exchange server can return a single... |
high | 8.6 | — | — | 2026-10-13 | 2026-10-20 |
| CVE-2026-110255 Finsys Dockhand before 1.0.43 contains a response-disclosing server-side request... |
high | 8.5 | — | — | 2026-10-13 | 2026-10-13 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.