October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,479
Critical
1,340
High
5,869
Medium
6,256
Low
648
Severity not reported
3,366
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1307), google (756), oracle (156), ibm (140), adobe (138), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-96234 Origin validation error in .NET allows an unauthorized attacker to disclose info... |
medium | 5.3 | — | — | 2026-10-13 | 2026-10-22 |
| CVE-2026-96238 Origin validation error in .NET allows an unauthorized attacker to bypass a secu... |
medium | 6.5 | — | — | 2026-10-13 | 2026-10-22 |
| CVE-2026-96229 Permissive list of allowed inputs in .NET allows an unauthorized attacker to dis... |
medium | 6.5 | — | — | 2026-10-13 | 2026-10-22 |
| CVE-2026-96218 Improper access control in Windows Update Stack allows an authorized attacker to... |
medium | 5.5 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-16 |
| CVE-2026-96183 Missing authentication for critical function in Windows Health and Optimized Exp... |
medium | 5.5 | — | Microsoft / windows 11 24h2 | 2026-10-13 | 2026-10-16 |
| CVE-2026-96204 Server-side request forgery (ssrf) in Azure Arc allows an authorized attacker to... |
medium | 6.5 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-96206 Use of uninitialized resource in Windows Subsystem for Linux allows an authorize... |
medium | 5.5 | — | Microsoft / windows subsystem for linux | 2026-10-13 | 2026-10-29 |
| CVE-2026-94506 Out-of-bounds read in Microsoft Office Access allows an unauthorized attacker to... |
medium | 6.5 | — | Microsoft / 365 apps | 2026-10-13 | 2026-10-15 |
| CVE-2026-95630 Adobe Commerce is affected by an Improper Input Validation vulnerability that co... |
medium | 4.3 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-95904 Buffer over-read in Windows Event Logging Service allows an authorized attacker... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-88208 Improper neutralization of input during web page generation ('cross-site scripti... |
medium | 4.6 | — | Microsoft / sharepoint server | 2026-10-13 | 2026-10-14 |
| CVE-2026-88209 Improper neutralization of input during web page generation ('cross-site scripti... |
medium | 4.6 | — | Microsoft / sharepoint server | 2026-10-13 | 2026-10-14 |
| CVE-2026-88226 Out-of-bounds read in Windows Storage Port Driver allows an unauthorized attacke... |
medium | 4.6 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-88195 Buffer over-read in Microsoft Office Excel allows an unauthorized attacker to di... |
medium | 6.5 | — | Microsoft / 365 apps | 2026-10-13 | 2026-10-14 |
| CVE-2026-88201 Buffer over-read in Microsoft Office Excel allows an unauthorized attacker to di... |
medium | 6.5 | — | Microsoft / 365 apps | 2026-10-13 | 2026-10-14 |
| CVE-2026-88203 Untrusted pointer dereference in Microsoft Office PowerPoint allows an unauthori... |
medium | 6.5 | — | Microsoft / 365 apps | 2026-10-13 | 2026-10-15 |
| CVE-2026-88190 Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to... |
medium | 6.5 | — | Microsoft / 365 apps | 2026-10-13 | 2026-10-14 |
| CVE-2026-88192 Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to... |
medium | 6.5 | — | Microsoft / 365 apps | 2026-10-13 | 2026-10-15 |
| CVE-2026-88183 Out-of-bounds read in Microsoft Office PowerPoint allows an unauthorized attacke... |
medium | 6.5 | — | Microsoft / 365 apps | 2026-10-13 | 2026-10-15 |
| CVE-2026-88184 Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to... |
medium | 6.5 | — | Microsoft / 365 apps | 2026-10-13 | 2026-10-15 |
| CVE-2026-88175 Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to... |
medium | 6.5 | — | Microsoft / 365 apps | 2026-10-13 | 2026-10-15 |
| CVE-2026-88167 Buffer over-read in Microsoft Office Word allows an unauthorized attacker to dis... |
medium | 6.5 | — | Microsoft / 365 apps | 2026-10-13 | 2026-10-15 |
| CVE-2026-88169 Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to d... |
medium | 6.5 | — | Microsoft / 365 apps | 2026-10-13 | 2026-10-15 |
| CVE-2026-88172 Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to... |
medium | 6.5 | — | Microsoft / 365 apps | 2026-10-13 | 2026-10-14 |
| CVE-2026-88158 Out-of-bounds read in Microsoft Digest Authentication allows an authorized attac... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-31 |
| CVE-2026-88162 Improper authorization in Windows Encrypting File System (EFS) allows an authori... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-20 |
| CVE-2026-88151 Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to... |
medium | 6.5 | — | Microsoft / 365 apps | 2026-10-13 | 2026-10-14 |
| CVE-2026-88153 Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to... |
medium | 6.5 | — | Microsoft / 365 apps | 2026-10-13 | 2026-10-14 |
| CVE-2026-88154 Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to... |
medium | 6.5 | — | Microsoft / 365 apps | 2026-10-13 | 2026-10-15 |
| CVE-2026-88137 Files or directories accessible to external parties in WebDAV allows an authoriz... |
medium | 6.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-31 |
| CVE-2026-88140 Out-of-bounds read in Windows Key Storage Provider allows an authorized attacker... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-88129 Out-of-bounds read in DNS Server allows an authorized attacker to deny service o... |
medium | 6.5 | — | Microsoft / windows server 2012 | 2026-10-13 | 2026-10-16 |
| CVE-2026-88130 Out-of-bounds read in DNS Server allows an authorized attacker to deny service o... |
medium | 6.5 | — | Microsoft / windows server 2012 | 2026-10-13 | 2026-10-16 |
| CVE-2026-88132 Origin validation error in Azure Key Vault allows an unauthorized attacker to di... |
medium | 5.9 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-88123 Out-of-bounds read in DNS Server allows an authorized attacker to deny service o... |
medium | 6.5 | — | Microsoft / windows server 2012 | 2026-10-13 | 2026-10-16 |
| CVE-2026-88125 Out-of-bounds read in DNS Server allows an authorized attacker to deny service o... |
medium | 6.5 | — | Microsoft / windows server 2012 | 2026-10-13 | 2026-10-16 |
| CVE-2026-88122 Out-of-bounds read in DNS Server allows an authorized attacker to deny service o... |
medium | 6.5 | — | Microsoft / windows server 2012 | 2026-10-13 | 2026-10-16 |
| CVE-2026-88099 Uncaught exception in Windows Failover Cluster allows an unauthorized attacker t... |
medium | 5.9 | — | Microsoft / windows server 2019 | 2026-10-13 | 2026-10-16 |
| CVE-2026-87714 Missing authorization in WebDAV allows an authorized attacker to bypass a securi... |
medium | 6.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-87709 Improper access control in Windows Host Guardian Service allows an authorized at... |
medium | 5.5 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-28 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.