cve.bz

Microsoft Patch Tuesday, October 2026: the CVEs

Filter

Microsoft Patch Tuesday October 2026: the CVEs Microsoft published on 13 October 2026, the second Tuesday of the month, with CVSS, EPSS, CISA KEV and public exploits to show what to patch first. Narrow it: in CISA KEV · critical. The same day: Adobe, SAP. Earlier: Sep 2026, Aug 2026, Jul 2026, Jun 2026, May 2026, Apr 2026, Mar 2026, Feb 2026, Jan 2026, Dec 2025, Nov 2025, Oct 2025. Other lists: CISA KEV list, CVE exploit search, Latest critical CVEs, Ransomware CVEs, New CVEs today, This week, Patch Tuesday

  1. 9.6CVE-2026-102238EPSS 0.8%

    Improper limitation of a pathname to a restricted directory ('path traversal') in Visual Studio Code allows an unauthorized attacker to execute code over a network.

  2. 9.8CVE-2026-97816EPSS 1.0%

    Use after free in OpenSSH for Windows allows an unauthorized attacker to execute code over a network.

  3. 9.8CVE-2026-97815EPSS 0.9%

    Heap-based buffer overflow in Windows Error Reporting allows an unauthorized attacker to execute code over a network.

  4. 9.8CVE-2026-97814EPSS 1.1%

    Heap-based buffer overflow in Windows Text Shaping allows an unauthorized attacker to execute code over a network.

  5. 9.8CVE-2026-97805EPSS 1.1%

    Out-of-bounds read in Windows Partition Management Driver allows an unauthorized attacker to execute code over a network.

  6. 9.8CVE-2026-97749EPSS 1.2%

    Double free in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.

  7. 9.8CVE-2026-97016EPSS 1.2%

    Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.

  8. 9.8CVE-2026-96934EPSS 0.9%

    Use after free in Windows DHCP Server allows an unauthorized attacker to execute code over a network.

  9. 9.8CVE-2026-96924EPSS 1.0%

    Untrusted pointer dereference in Windows OLE allows an unauthorized attacker to execute code over a network.

  10. 9.8CVE-2026-96909EPSS 1.0%

    Heap-based buffer overflow in Windows BitLocker allows an unauthorized attacker to execute code over a network.

  11. 9.8CVE-2026-96864EPSS 0.6%

    Double free in Microsoft Failover Cluster Virtual Driver allows an unauthorized attacker to execute code over a network.

  12. 9.8CVE-2026-96320EPSS 1.1%

    Heap-based buffer overflow in Windows DHCP Server allows an unauthorized attacker to execute code over a network.

  13. 9.1CVE-2026-96252EPSS 0.6%

    Improper verification of cryptographic signature in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network.

  14. 9.8CVE-2026-96219EPSS 0.9%

    Out-of-bounds write in Windows Local Security Authority Subsystem Service (LSASS) allows an unauthorized attacker to execute code over a network.

  15. 9.8CVE-2026-96113EPSS 0.9%

    Heap-based buffer overflow in DNS Server allows an unauthorized attacker to execute code over a network.

  16. 9.8CVE-2026-96096EPSS 0.7%

    Heap-based buffer overflow in Windows Media Player allows an unauthorized attacker to execute code over a network.

  17. 9.8CVE-2026-88178EPSS 1.0%

    Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to execute code over a network.

  18. 9.8CVE-2026-88156EPSS 1.2%

    Stack-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.

  19. 9.8CVE-2026-88102EPSS 0.6%

    Use after free in Windows Failover Cluster allows an unauthorized attacker to execute code over a network.

  20. 9.4CVE-2026-88092EPSS 0.9%

    Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an unauthorized attacker to perform tampering over a network.

  21. 9.8CVE-2026-85928EPSS 0.6%

    Heap-based buffer overflow in Windows Volume Manager Extension Driver allows an unauthorized attacker to execute code over a network.

  22. 9.0CVE-2026-85818EPSS 0.4%

    Improper verification of cryptographic signature in Windows Schannel allows an unauthorized attacker to perform spoofing over a network.

  23. 9.8CVE-2026-85814EPSS 0.9%

    Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unauthorized attacker to execute code over a network.

  24. 9.8CVE-2026-85809EPSS 0.9%

    Remote Code Execution in Windows Routing and Remote Access Service (RRAS) allows attacker to gain an unauthorized access to victim's machine

  25. 9.8CVE-2026-85806EPSS 0.9%

    Integer underflow (wrap or wraparound) in Network Policy Server (NPS) allows an unauthorized attacker to execute code over a network.

  26. 9.8CVE-2026-85792EPSS 0.9%

    Remote Code Execution in Windows Routing and Remote Access Service (RRAS) allows attacker to gain an unauthorized access to victim's machine

  27. 9.8CVE-2026-84015EPSS 0.9%

    Heap-based buffer overflow in Remote Access Point-to-Point Protocol (PPP) EAP-TLS allows an unauthorized attacker to execute code over a network.

  28. 9.8CVE-2026-83935EPSS 0.9%

    Heap-based buffer overflow in Microsoft XML allows an unauthorized attacker to execute code over a network.

  29. 9.8CVE-2026-83910EPSS 1.1%

    Out-of-bounds write in RPC Runtime allows an unauthorized attacker to execute code over a network.

  30. 9.8CVE-2026-83888EPSS 1.0%

    Buffer over-read in Windows CD-ROM Driver allows an unauthorized attacker to elevate privileges over a network.

  31. 9.8CVE-2026-83869EPSS 0.8%

    Integer underflow (wrap or wraparound) in DNS Server allows an unauthorized attacker to execute code over a network.

  32. 9.8CVE-2026-83789EPSS 0.9%

    Heap-based buffer overflow in Windows SMB Client allows an unauthorized attacker to elevate privileges over a network.

  33. 9.8CVE-2026-83782EPSS 1.0%

    Heap-based buffer overflow in Windows Shell allows an unauthorized attacker to execute code over a network.

  34. 9.8CVE-2026-83780EPSS 1.1%

    Use after free in Windows CCFFilter Driver allows an unauthorized attacker to execute code over a network.

  35. 9.8CVE-2026-83770EPSS 1.1%

    Heap-based buffer overflow in Windows Text Shaping allows an unauthorized attacker to execute code over a network.

  36. 9.8CVE-2026-83748EPSS 0.9%

    Heap-based buffer overflow in Windows Error Reporting allows an unauthorized attacker to execute code over a network.

  37. 9.8CVE-2026-83693EPSS 1.1%

    Heap-based buffer overflow in Windows Error Reporting allows an unauthorized attacker to execute code over a network.

  38. 9.8CVE-2026-83578EPSS 1.1%

    Integer underflow (wrap or wraparound) in Windows PowerShell allows an unauthorized attacker to execute code over a network.

  39. 9.8CVE-2026-83523EPSS 0.9%

    Heap-based buffer overflow in Windows Image Acquisition allows an unauthorized attacker to execute code over a network.

  40. 9.8CVE-2026-83519EPSS 1.1%

    Heap-based buffer overflow in Windows Error Reporting allows an unauthorized attacker to execute code over a network.

  41. 9.8CVE-2026-83517EPSS 1.1%

    Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unauthorized attacker to execute code over a network.

  42. 9.8CVE-2026-70300EPSS 1.1%

    Untrusted pointer dereference in Microsoft Office Word allows an unauthorized attacker to execute code over a network.

  43. 9.8CVE-2026-70291EPSS 1.3%

    Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.

  44. 9.3CVE-2026-70279EPSS 1.3%

    Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.

  45. 9.8CVE-2026-70275EPSS 0.9%

    Untrusted pointer dereference in Windows CD-ROM Driver allows an unauthorized attacker to execute code over a network.

  46. 9.8CVE-2026-70262EPSS 0.9%

    Heap-based buffer overflow in WebDAV allows an unauthorized attacker to elevate privileges over a network.

  47. 9.8CVE-2026-70242EPSS 1.6%

    Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.

  48. 9.1CVE-2026-70188EPSS 0.9%

    Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an unauthorized attacker to bypass a security feature over a network.

  49. 9.8CVE-2026-70157EPSS 1.1%

    Heap-based buffer overflow in Windows System Information Console allows an unauthorized attacker to execute code over a network.

  50. 9.8CVE-2026-70153EPSS 1.1%

    Heap-based buffer overflow in Microsoft PostScript Printer Driver allows an unauthorized attacker to execute code over a network.

  51. 9.8CVE-2026-70147EPSS 1.1%

    Heap-based buffer overflow in Microsoft PostScript Printer Driver allows an unauthorized attacker to execute code over a network.

  52. 9.8CVE-2026-70096EPSS 1.1%

    Heap-based buffer overflow in Windows Rich Text Edit Control allows an unauthorized attacker to execute code over a network.

  53. 9.8CVE-2026-70024EPSS 1.0%

    Stack-based buffer overflow in Windows Internet Information Services allows an unauthorized attacker to execute code over a network.

  54. 9.8CVE-2026-69886EPSS 0.9%

    Heap-based buffer overflow in Windows Imaging Component allows an unauthorized attacker to execute code over a network.

  55. 9.8CVE-2026-69883EPSS 0.9%

    Use after free in Windows iSCSI allows an unauthorized attacker to execute code over a network.

  56. 9.8CVE-2026-69705EPSS 0.9%

    Out-of-bounds write in Windows iSCSI allows an unauthorized attacker to execute code over a network.

  57. 9.8CVE-2026-69639EPSS 0.9%

    Heap-based buffer overflow in Windows Libarchive allows an unauthorized attacker to execute code over a network.

  58. 9.8CVE-2026-69634EPSS 0.9%

    Heap-based buffer overflow in Windows iSCSI allows an unauthorized attacker to execute code over a network.

  59. 9.8CVE-2026-105723EPSS 1.3%

    Untrusted pointer dereference in Windows Distributed File System (DFS) allows an unauthorized attacker to elevate privileges over a network.

  60. 9.8CVE-2026-105016EPSS 1.7%

    Heap-based buffer overflow in Microsoft QUIC allows an unauthorized attacker to execute code over a network.

  61. 9.8CVE-2026-105010EPSS 1.0%

    Use after free in Microsoft Windows Search Component allows an unauthorized attacker to elevate privileges over a network.

  62. 9.0CVE-2026-105008EPSS 0.7%

    No cwe for this issue in Windows Schannel allows an unauthorized attacker to perform spoofing over a network.

  63. 9.8CVE-2026-102210EPSS 1.0%

    Heap-based buffer overflow in Windows Text Shaping allows an unauthorized attacker to execute code over a network.

  64. 9.8CVE-2026-100222EPSS 1.1%

    Heap-based buffer overflow in Network Policy Server (NPS) allows an unauthorized attacker to execute code over a network.

  65. 9.8CVE-2026-100219EPSS 1.1%

    Use after free in Microsoft QUIC allows an unauthorized attacker to execute code over a network.

  66. 9.8CVE-2026-100202EPSS 1.1%

    Use after free in Windows Message Queuing Queue Manager allows an unauthorized attacker to execute code over a network.