October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 29, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
16,234
Critical
1,207
High
5,403
Medium
5,749
Low
602
Severity not reported
3,273
In CISA KEV
17
Most affected vendors (by CPE data where available): microsoft (1078), google (711), ibm (140), oracle (117), adobe (110), broadcom (61), apache (45), freerdp (42), linuxfoundation (41), dell (40)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-48383 Adobe Experience Manager is affected by an Incorrect Authorization vulnerability... |
critical | 10.0 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-48382 Adobe Experience Manager is affected by an Incorrect Authorization vulnerability... |
critical | 10.0 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-106626 Adobe Experience Manager is affected by an Improper Input Validation vulnerabili... |
critical | 9.1 | — | Adobe / experience manager | 2026-10-13 | 2026-10-26 |
| CVE-2026-106629 Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vuln... |
critical | 9.3 | — | Adobe / experience manager | 2026-10-13 | 2026-10-26 |
| CVE-2026-106630 Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vuln... |
critical | 9.3 | — | Adobe / experience manager | 2026-10-13 | 2026-10-26 |
| CVE-2026-105895 Adobe Experience Manager is affected by an Improper Input Validation vulnerabili... |
critical | 9.9 | — | Adobe / experience manager | 2026-10-13 | 2026-10-26 |
| CVE-2026-104252 Vitess is a database clustering system for horizontal scaling of MySQL. |
critical | 9.8 | — | Linuxfoundation / vitess | 2026-10-13 | 2026-10-23 |
| CVE-2026-104585 Mobile Security Framework (MobSF) v4.5.2 is vulnerable to Command Injection in /... |
critical | 9.8 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-103848 Adobe Experience Manager is affected by an Improper Neutralization of Special El... |
critical | 9.9 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-102238 Improper limitation of a pathname to a restricted directory ('path traversal') i... |
critical | 9.6 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-97816 Use after free in OpenSSH for Windows allows an unauthorized attacker to execute... |
critical | 9.8 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-16 |
| CVE-2026-97814 Heap-based buffer overflow in Windows Text Shaping allows an unauthorized attack... |
critical | 9.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-97815 Heap-based buffer overflow in Windows Error Reporting allows an unauthorized att... |
critical | 9.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-97805 Out-of-bounds read in Windows Partition Management Driver allows an unauthorized... |
critical | 9.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-97749 Double free in Microsoft Office Outlook allows an unauthorized attacker to execu... |
critical | 9.8 | — | Microsoft / 365 apps | 2026-10-13 | 2026-10-15 |
| CVE-2026-97016 Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized at... |
critical | 9.8 | — | Microsoft / 365 apps | 2026-10-13 | 2026-10-15 |
| CVE-2026-96934 Use after free in Windows DHCP Server allows an unauthorized attacker to execute... |
critical | 9.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-96924 Untrusted pointer dereference in Windows OLE allows an unauthorized attacker to... |
critical | 9.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-96909 Heap-based buffer overflow in Windows BitLocker allows an unauthorized attacker... |
critical | 9.8 | — | Microsoft / windows 11 23h2 | 2026-10-13 | 2026-10-16 |
| CVE-2026-96864 Double free in Microsoft Failover Cluster Virtual Driver allows an unauthorized... |
critical | 9.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-96320 Heap-based buffer overflow in Windows DHCP Server allows an unauthorized attacke... |
critical | 9.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-96252 Improper verification of cryptographic signature in Active Directory Federation... |
critical | 9.1 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-20 |
| CVE-2026-96219 Out-of-bounds write in Windows Local Security Authority Subsystem Service (LSASS... |
critical | 9.8 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-16 |
| CVE-2026-96096 Heap-based buffer overflow in Windows Media Player allows an unauthorized attack... |
critical | 9.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-96113 Heap-based buffer overflow in DNS Server allows an unauthorized attacker to exec... |
critical | 9.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-91013 Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability... |
critical | 9.3 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-92464 Adobe Commerce is affected by an Improper Input Validation vulnerability that co... |
critical | 9.1 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-92909 Adobe Commerce is affected by an Incorrect Authorization vulnerability that coul... |
critical | 9.8 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-88178 Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to... |
critical | 9.8 | — | Microsoft / 365 apps | 2026-10-13 | 2026-10-15 |
| CVE-2026-88156 Stack-based buffer overflow in Microsoft Office Outlook allows an unauthorized a... |
critical | 9.8 | — | Microsoft / 365 apps | 2026-10-13 | 2026-10-15 |
| CVE-2026-88102 Use after free in Windows Failover Cluster allows an unauthorized attacker to ex... |
critical | 9.8 | — | Microsoft / windows server 2019 | 2026-10-13 | 2026-10-16 |
| CVE-2026-88092 Inconsistent interpretation of http requests ('http request/response smuggling')... |
critical | 9.4 | — | Microsoft / asp.net core | 2026-10-13 | 2026-10-16 |
| CVE-2026-85928 Heap-based buffer overflow in Windows Volume Manager Extension Driver allows an... |
critical | 9.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-85818 Improper verification of cryptographic signature in Windows Schannel allows an u... |
critical | 9.0 | — | Microsoft / windows 11 23h2 | 2026-10-13 | 2026-10-16 |
| CVE-2026-85809 Remote Code Execution in Windows Routing and Remote Access Service (RRAS) allows... |
critical | 9.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-85814 Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unaut... |
critical | 9.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-85806 Integer underflow (wrap or wraparound) in Network Policy Server (NPS) allows an... |
critical | 9.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-85792 Remote Code Execution in Windows Routing and Remote Access Service (RRAS) allows... |
critical | 9.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-84015 Heap-based buffer overflow in Remote Access Point-to-Point Protocol (PPP) EAP-TL... |
critical | 9.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-19 |
| CVE-2026-83935 Heap-based buffer overflow in Microsoft XML allows an unauthorized attacker to e... |
critical | 9.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-19 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.