October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,479
Critical
1,340
High
5,869
Medium
6,256
Low
648
Severity not reported
3,366
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1307), google (756), oracle (156), ibm (140), adobe (138), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-83713 Out-of-bounds read in Windows Universal Disk Format File System Driver (UDFS) al... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83714 Use of uninitialized resource in Windows HTTP.sys allows an authorized attacker... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83703 Out-of-bounds read in Windows Wi-Fi Driver allows an unauthorized attacker to de... |
medium | 6.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83705 Exposure of sensitive system information to an unauthorized control sphere in Wi... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83706 Use after free in Windows NTFS allows an authorized attacker to elevate privileg... |
medium | 6.7 | — | Microsoft / windows 11 24h2 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83697 Time-of-check time-of-use (toctou) race condition in Windows Modern Device Manag... |
medium | 4.7 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-30 |
| CVE-2026-83695 Use of uninitialized resource in Windows Event Logging Service allows an authori... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-30 |
| CVE-2026-83686 Out-of-bounds read in Microsoft Windows Search Component allows an authorized at... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83681 Weak authentication in Microsoft PowerToys allows an authorized attacker to perf... |
medium | 5.5 | — | — | 2026-10-13 | 2026-10-22 |
| CVE-2026-83683 Absolute path traversal in Windows Encrypting File System (EFS) allows an author... |
medium | 6.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83685 Buffer over-read in Windows IKE Extension allows an authorized attacker to deny... |
medium | 6.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83671 Out-of-bounds read in Windows Hyper-V allows an authorized attacker to disclose... |
medium | 6.5 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83672 Exposure of sensitive system information to an unauthorized control sphere in Wi... |
medium | 4.7 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83667 Out-of-bounds read in Active Directory Domain Services allows an authorized atta... |
medium | 6.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83668 Out-of-bounds read in Windows WLAN Service allows an authorized attacker to disc... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83656 Missing authentication for critical function in Windows Modern Device Management... |
medium | 4.7 | — | Microsoft / windows 10 21h2 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83657 Weak authentication in Windows Modern Device Management (MDM) allows an authoriz... |
medium | 5.5 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83658 Improper access control in Windows Error Reporting allows an authorized attacker... |
medium | 5.5 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83664 Access of resource using incompatible type ('type confusion') in Windows Portabl... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83649 Out-of-bounds read in Windows Local Security Authority Subsystem Service (LSASS)... |
medium | 6.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83646 Url redirection to untrusted site ('open redirect') in Active Directory Federati... |
medium | 5.4 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83648 Null pointer dereference in Active Directory Domain Services allows an authorize... |
medium | 6.5 | — | Microsoft / windows 10 21h2 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83636 Null pointer dereference in Windows Hyper-V allows an authorized attacker to den... |
medium | 6.5 | — | Microsoft / windows 10 21h2 | 2026-10-13 | 2026-10-28 |
| CVE-2026-83582 Use after free in Windows Graphics Kernel allows an authorized attacker to discl... |
medium | 4.7 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-83571 Null pointer dereference in Windows Audio Service allows an authorized attacker... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83573 Integer overflow or wraparound in Windows Kernel Mode Driver allows an unauthori... |
medium | 6.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-83521 Out-of-bounds read in Windows IKE Extension allows an authorized attacker to dis... |
medium | 6.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83565 Buffer over-read in Windows Encrypting File System (EFS) allows an authorized at... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-83500 Url redirection to untrusted site ('open redirect') in Windows BitLocker allows... |
medium | 6.1 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-83504 Time-of-check time-of-use (toctou) race condition in Windows SmartScreen allows... |
medium | 4.7 | — | Microsoft / windows 11 23h2 | 2026-10-13 | 2026-10-28 |
| CVE-2026-83507 Improper link resolution before file access ('link following') in Windows Update... |
medium | 5.5 | — | Microsoft / windows 10 21h2 | 2026-10-13 | 2026-10-28 |
| CVE-2026-81964 Use of hard-coded credentials in Windows Update Orchestrator Service allows an a... |
medium | 5.5 | — | Microsoft / windows 10 21h2 | 2026-10-13 | 2026-10-28 |
| CVE-2026-70293 Use of uninitialized resource in Windows Win32 Kernel Subsystem allows an author... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-21 |
| CVE-2026-70294 Out-of-bounds read in Windows Win32 Kernel Subsystem allows an authorized attack... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-21 |
| CVE-2026-70295 Out-of-bounds read in Windows Win32 Kernel Subsystem allows an authorized attack... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-21 |
| CVE-2026-70298 Improper limitation of a pathname to a restricted directory ('path traversal') i... |
medium | 6.5 | — | Microsoft / sharepoint server | 2026-10-13 | 2026-10-14 |
| CVE-2026-70288 Time-of-check time-of-use (toctou) race condition in Windows Win32 Kernel Subsys... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-21 |
| CVE-2026-70292 Out-of-bounds read in Windows Win32 Kernel Subsystem allows an authorized attack... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-21 |
| CVE-2026-70277 Out-of-bounds read in Windows Fast FAT Driver allows an unauthorized attacker to... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-70280 Incorrect authorization in Windows Hello allows an authorized attacker to bypass... |
medium | 5.5 | — | Microsoft / windows 10 21h2 | 2026-10-13 | 2026-10-28 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.