October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,181
Critical
1,306
High
5,739
Medium
6,115
Low
636
Severity not reported
3,385
In CISA KEV
19
Most affected vendors (by CPE data where available): microsoft (1303), google (745), oracle (156), ibm (140), adobe (129), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-86972 A buffer overflow was addressed with improved size validation. |
not reported | — | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-86973 An out-of-bounds read was addressed with improved bounds checking. |
not reported | — | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-86974 A type confusion issue was addressed with improved checks. |
not reported | — | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-86964 A null pointer dereference was addressed with improved input validation. |
not reported | — | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-86966 This issue was addressed with improved handling of symlinks. |
not reported | — | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-86968 An access issue was addressed with improved access control. |
not reported | — | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-86969 An out-of-bounds write was addressed with improved input validation. |
not reported | — | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-86954 An out-of-bounds read was addressed with improved bounds checking. |
not reported | — | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-86958 The issue was addressed with improved memory handling. |
not reported | — | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-86943 The issue was addressed with improved memory handling. |
not reported | — | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-86945 This issue was addressed with improved checks. |
not reported | — | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-86946 A use-after-free issue was addressed with improved memory management. |
not reported | — | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-86936 A logic issue was addressed with improved checks. |
not reported | — | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-86937 A logic issue was addressed with improved state management. |
not reported | — | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-86939 A permissions issue was addressed with additional restrictions. |
not reported | — | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-86941 A file quarantine bypass was addressed with additional checks. |
not reported | — | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-86942 An out-of-bounds read was addressed with improved bounds checking. |
not reported | — | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-86931 A privacy issue was addressed with improved memory management. |
not reported | — | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-86923 An information disclosure issue was addressed with improved privacy controls. |
not reported | — | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-86896 A permissions issue was addressed with additional restrictions. |
not reported | — | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-86877 A path traversal issue was addressed with improved path validation. |
not reported | — | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-86880 This issue was addressed with additional entitlement checks. |
not reported | — | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-84633 A path traversal issue was addressed with improved path validation. |
not reported | — | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-84634 A race condition was addressed with additional validation. |
not reported | — | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-84627 A buffer overflow was addressed with improved bounds checking. |
not reported | — | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-84614 A logic issue was addressed with improved checks. |
not reported | — | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-84610 A file quarantine bypass was addressed with additional checks. |
not reported | — | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-84604 A stack buffer overflow was addressed through improved input validation. |
not reported | — | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-84605 An authorization issue was addressed with improved state management. |
not reported | — | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-84594 A logic issue was addressed with improved state management. |
not reported | — | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-84595 An out-of-bounds write issue was addressed with improved bounds checking. |
not reported | — | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-84599 The issue was addressed with improved memory handling. |
not reported | — | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-84590 An out-of-bounds write issue was addressed with improved bounds checking. |
not reported | — | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-84542 An access issue was addressed with improved access restrictions. |
not reported | — | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-84545 A use after free issue was addressed with improved memory management. |
not reported | — | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-84539 An out-of-bounds write issue was addressed with improved bounds checking. |
not reported | — | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-84528 A logging issue was addressed with improved data redaction. |
not reported | — | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-84494 An out-of-bounds write issue was addressed with improved bounds checking. |
not reported | — | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-84495 A use-after-free issue was addressed with improved memory management. |
not reported | — | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-84498 The issue was addressed with improved memory handling. |
not reported | — | — | — | 2026-10-26 | 2026-10-27 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.