October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,479
Critical
1,340
High
5,869
Medium
6,256
Low
648
Severity not reported
3,366
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1307), google (756), oracle (156), ibm (140), adobe (138), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-97783 Improper neutralization of input during web page generation ('cross-site scripti... |
medium | 6.1 | — | Microsoft / sharepoint server | 2026-10-13 | 2026-10-21 |
| CVE-2026-97779 Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to... |
medium | 6.5 | — | Microsoft / 365 apps | 2026-10-13 | 2026-10-15 |
| CVE-2026-97760 Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to... |
medium | 6.5 | — | Microsoft / 365 apps | 2026-10-13 | 2026-10-15 |
| CVE-2026-97740 Exposure of sensitive system information to an unauthorized control sphere in Mi... |
medium | 6.5 | — | Microsoft / 365 apps | 2026-10-13 | 2026-10-15 |
| CVE-2026-97743 Use after free in Microsoft Office Excel allows an unauthorized attacker to disc... |
medium | 6.5 | — | Microsoft / 365 apps | 2026-10-13 | 2026-10-15 |
| CVE-2026-97744 Out-of-bounds read in Microsoft Office PowerPoint allows an unauthorized attacke... |
medium | 5.5 | — | Microsoft / 365 apps | 2026-10-13 | 2026-10-15 |
| CVE-2026-97014 Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to... |
medium | 5.5 | — | Microsoft / 365 apps | 2026-10-13 | 2026-10-14 |
| CVE-2026-97005 Out-of-bounds read in Microsoft Office PowerPoint allows an unauthorized attacke... |
medium | 5.5 | — | Microsoft / 365 apps | 2026-10-13 | 2026-10-15 |
| CVE-2026-96948 Exposure of sensitive information to an unauthorized actor in Windows Client Sid... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-96938 Heap-based buffer overflow in Windows Distributed File System (DFS) allows an au... |
medium | 6.7 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-96944 Insertion of sensitive information into externally-accessible file or directory... |
medium | 5.5 | — | Microsoft / windows 11 24h2 | 2026-10-13 | 2026-10-16 |
| CVE-2026-96935 Exposure of sensitive system information to an unauthorized control sphere in Wi... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-96925 Integer underflow (wrap or wraparound) in Windows NTFS allows an authorized atta... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-96926 Missing authorization in DNS Server allows an authorized attacker to perform tam... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-96927 Out-of-bounds read in Windows NTFS allows an authorized attacker to disclose inf... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-96930 Out-of-bounds read in Windows Universal Disk Format File System Driver (UDFS) al... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-96921 Access of resource using incompatible type ('type confusion') in Windows Message... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-96910 Untrusted pointer dereference in Microsoft Windows Search Component allows an au... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-26 |
| CVE-2026-96863 Heap-based buffer overflow in Windows Storage Port Driver allows an unauthorized... |
medium | 6.8 | — | Microsoft / windows 11 23h2 | 2026-10-13 | 2026-10-28 |
| CVE-2026-96865 Exposure of sensitive system information to an unauthorized control sphere in Wi... |
medium | 5.6 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-96854 Access of resource using incompatible type ('type confusion') in Windows Device... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-20 |
| CVE-2026-96855 Improper access control in Windows Modern Device Management (MDM) allows an auth... |
medium | 5.5 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-20 |
| CVE-2026-96857 Files or directories accessible to external parties in Windows Projected File Sy... |
medium | 5.5 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-20 |
| CVE-2026-96858 Missing authentication for critical function in Windows Security Account Manager... |
medium | 5.5 | — | Microsoft / windows 10 21h2 | 2026-10-13 | 2026-10-28 |
| CVE-2026-96859 Out-of-bounds read in Windows Imaging Component allows an authorized attacker to... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-96860 Out-of-bounds read in Windows USB Print Driver allows an authorized attacker to... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-96848 Buffer over-read in Windows Win32 Kernel Subsystem allows an authorized attacker... |
medium | 5.5 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-16 |
| CVE-2026-96849 Use of uninitialized resource in Windows Kernel-Mode Drivers allows an authorize... |
medium | 5.5 | — | Microsoft / windows 11 26h1 | 2026-10-13 | 2026-10-16 |
| CVE-2026-96850 Use of uninitialized resource in Windows Modern Device Management (MDM) allows a... |
medium | 5.5 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-16 |
| CVE-2026-96851 Buffer over-read in Windows Management Instrumentation allows an authorized atta... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-96853 Time-of-check time-of-use (toctou) race condition in Windows Win32 Kernel Subsys... |
medium | 4.7 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-20 |
| CVE-2026-96846 Out-of-bounds read in WebDAV allows an authorized attacker to disclose informati... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-96321 Out-of-bounds read in Remote Desktop Display Driver allows an authorized attacke... |
medium | 5.5 | — | Microsoft / windows 10 21h2 | 2026-10-13 | 2026-10-16 |
| CVE-2026-96314 Out-of-bounds read in Windows Audio Service allows an authorized attacker to dis... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-96315 Missing authorization in Windows Overlay Filter allows an authorized attacker to... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-96316 Improper access control in Windows Routing and Remote Access Service (RRAS) allo... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-96311 Improper authorization in Windows Network List Service allows an authorized atta... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-96303 Improperly implemented security check for standard in Microsoft PowerShell allow... |
medium | 6.5 | — | Microsoft / powershell | 2026-10-13 | 2026-10-22 |
| CVE-2026-96300 Uncontrolled resource consumption in RPC Endpoint Mapper Service allows an unaut... |
medium | 5.9 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-20 |
| CVE-2026-96247 Use of uninitialized resource in Windows Kernel-Mode Drivers allows an authorize... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.