October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,479
Critical
1,340
High
5,869
Medium
6,256
Low
648
Severity not reported
3,366
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1307), google (756), oracle (156), ibm (140), adobe (138), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-87698 Out-of-bounds read in Windows Remote Access Service Infrastructure allows an aut... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-27 |
| CVE-2026-85935 Buffer over-read in Windows USB Driver allows an authorized attacker to disclose... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-85938 Improper access control in Windows Broadcast DVR User Service allows an authoriz... |
medium | 5.5 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-28 |
| CVE-2026-85939 Weak authentication in Windows Kernel allows an authorized attacker to bypass a... |
medium | 5.3 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-85932 Improper limitation of a pathname to a restricted directory ('path traversal') i... |
medium | 6.5 | — | Microsoft / sharepoint server | 2026-10-13 | 2026-10-14 |
| CVE-2026-85910 Buffer over-read in Windows StateRepository API allows an authorized attacker to... |
medium | 5.5 | — | Microsoft / windows 11 24h2 | 2026-10-13 | 2026-10-26 |
| CVE-2026-85916 Exposure of private personal information to an unauthorized actor in Azure Activ... |
medium | 5.5 | — | Microsoft / windows 11 23h2 | 2026-10-13 | 2026-10-16 |
| CVE-2026-85909 Out-of-bounds read in Windows Universal Disk Format File System Driver (UDFS) al... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-26 |
| CVE-2026-85873 Improper authorization in Skype for Business and Microsoft Lync allows an author... |
medium | 6.5 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-85865 Improper authentication in Windows DHCP Server allows an authorized attacker to... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-85866 Exposure of sensitive system information to an unauthorized control sphere in Wi... |
medium | 4.7 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-29 |
| CVE-2026-85857 Insertion of sensitive information into log file in Windows Kernel-Mode Drivers... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-85859 Null pointer dereference in Windows Message Queuing Queue Manager allows an auth... |
medium | 6.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-85852 Out-of-bounds read in Windows Management Instrumentation allows an authorized at... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-85841 Use after free in Windows DHCP Server allows an authorized attacker to execute c... |
medium | 6.6 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-85847 Out-of-bounds read in Windows Print Spooler Components allows an unauthorized at... |
medium | 6.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-85835 Buffer over-read in Servicing Stack Updates allows an authorized attacker to dis... |
medium | 5.5 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-85840 Files or directories accessible to external parties in Windows Event Viewer allo... |
medium | 6.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-85830 Out-of-bounds read in Windows Installer allows an authorized attacker to disclos... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-85831 Heap-based buffer overflow in Windows Biometric Service allows an authorized att... |
medium | 5.5 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-29 |
| CVE-2026-85815 Out-of-bounds read in Windows Device Association Service allows an authorized at... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-85816 Out-of-bounds read in Windows Wi-Fi Driver allows an authorized attacker to disc... |
medium | 5.7 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-85821 Out-of-bounds read in Windows Universal Disk Format File System Driver (UDFS) al... |
medium | 6.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-85812 Files or directories accessible to external parties in Windows Bind Filter Drive... |
medium | 5.5 | — | Microsoft / windows 10 21h2 | 2026-10-13 | 2026-10-16 |
| CVE-2026-85805 Improperly implemented security check for standard in Windows PowerShell allows... |
medium | 6.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-85747 Distribution is a toolkit to pack, ship, store, and deliver container content. |
medium | 6.8 | — | — | 2026-10-13 | 2026-10-18 |
| CVE-2026-85790 Use after free in Microsoft QUIC allows an unauthorized attacker to disclose inf... |
medium | 5.9 | — | Microsoft / windows 11 23h2 | 2026-10-13 | 2026-10-22 |
| CVE-2026-85793 Exposure of sensitive system information to an unauthorized control sphere in Wi... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-85794 Out-of-bounds read in Windows Routing and Remote Access Service (RRAS) allows an... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-85374 Out-of-bounds read in Windows Installer allows an authorized attacker to disclos... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-85336 Out-of-bounds read in Windows Device Association Service allows an authorized at... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-85337 Out-of-bounds read in Remote Desktop Client allows an unauthorized attacker to d... |
medium | 6.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-85331 Out-of-bounds read in Windows Device Association Service allows an authorized at... |
medium | 6.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-85320 Use of uninitialized resource in Windows Print Spooler Components allows an auth... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-85323 Weak authentication in Network Device Enrollment Service (NDES) allows an author... |
medium | 6.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-84011 Incorrect authorization in Windows SMB Client allows an authorized attacker to b... |
medium | 5.5 | — | Microsoft / windows 11 23h2 | 2026-10-13 | 2026-10-19 |
| CVE-2026-83933 Improper link resolution before file access ('link following') in Windows Update... |
medium | 5.5 | — | Microsoft / windows 10 21h2 | 2026-10-13 | 2026-10-29 |
| CVE-2026-84007 Out-of-bounds read in Remote Desktop Gateway Service allows an authorized attack... |
medium | 6.5 | — | Microsoft / windows server 2012 | 2026-10-13 | 2026-10-19 |
| CVE-2026-84009 Time-of-check time-of-use (toctou) race condition in Windows Projected File Syst... |
medium | 4.7 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-19 |
| CVE-2026-83925 Use of uninitialized resource in Windows Kernel allows an authorized attacker to... |
medium | 4.7 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-26 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.