September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,833
Low
527
Severity not reported
2,537
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), linux (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-77891 Out-of-bounds read in Windows DHCP Server allows an authorized attacker to execu... |
medium | 6.4 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-77492 Out-of-bounds read in Storage Port Driver allows an authorized attacker to discl... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-28 |
| CVE-2026-77488 Integer underflow (wrap or wraparound) in SQL Server allows an authorized attack... |
medium | 5.5 | — | Microsoft / sql server 2017 | 2026-09-08 | 2026-09-15 |
| CVE-2026-77491 Out-of-bounds read in Windows GDI allows an unauthorized attacker to disclose in... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-10-30 |
| CVE-2026-73029 Buffer over-read in SQL Server allows an authorized attacker to disclose informa... |
medium | 6.5 | — | Microsoft / sql server 2019 | 2026-09-08 | 2026-09-15 |
| CVE-2026-73019 Improper resolution of path equivalence in Windows URL Moniker allows an unautho... |
medium | 4.3 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-73004 Missing authentication for critical function in Windows Autopilot allows an auth... |
medium | 5.5 | — | Microsoft / windows 10 21h2 | 2026-09-08 | 2026-09-17 |
| CVE-2026-73008 Exposure of private personal information to an unauthorized actor in Windows Bio... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-10 |
| CVE-2026-72999 Out-of-bounds read in Windows USB Hub Driver allows an unauthorized attacker to... |
medium | 6.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-17 |
| CVE-2026-72985 Heap-based buffer overflow in Windows Volume Shadow Copy allows an unauthorized... |
medium | 6.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-72977 Out-of-bounds read in Microsoft Office PowerPoint allows an unauthorized attacke... |
medium | 6.5 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-17 |
| CVE-2026-72980 Uncontrolled search path element in Windows Hello allows an authorized attacker... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-17 |
| CVE-2026-72974 Buffer over-read in Microsoft Office Excel allows an unauthorized attacker to di... |
medium | 6.5 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-17 |
| CVE-2026-72975 Out-of-bounds read in Microsoft Office PowerPoint allows an unauthorized attacke... |
medium | 6.5 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-17 |
| CVE-2026-72976 Out-of-bounds read in Microsoft Office Word allows an authorized attacker to dis... |
medium | 5.0 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-17 |
| CVE-2026-72964 Missing authentication for critical function in Windows Internet Connection Shar... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-21 |
| CVE-2026-72966 Missing authorization in Windows Remote Access Connection Manager allows an auth... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-72956 Untrusted pointer dereference in Microsoft Office PowerPoint allows an unauthori... |
medium | 6.5 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-10 |
| CVE-2026-72942 Out-of-bounds read in Windows Spaceport.sys allows an unauthorized attacker to d... |
medium | 6.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-72945 Use of uninitialized resource in Windows Task Scheduler allows an authorized att... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-21 |
| CVE-2026-72935 Out-of-bounds read in Windows NTFS allows an authorized attacker to elevate priv... |
medium | 6.7 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-72937 Out-of-bounds read in Storage Port Driver allows an authorized attacker to discl... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-72938 Access of resource using incompatible type ('type confusion') in Microsoft Offic... |
medium | 6.5 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-17 |
| CVE-2026-72939 Null pointer dereference in Windows Routing and Remote Access Service (RRAS) all... |
medium | 6.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-72931 Missing release of resource after effective lifetime in Windows Secure Socket Tu... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-71350 Heap-based buffer overflow in Windows Spaceport.sys allows an unauthorized attac... |
medium | 6.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-71341 Out-of-bounds read in Windows Partition Management Driver allows an authorized a... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-71348 Heap-based buffer overflow in Windows Spaceport.sys allows an unauthorized attac... |
medium | 6.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-71349 Heap-based buffer overflow in Windows Spaceport.sys allows an unauthorized attac... |
medium | 6.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-71338 Double free in Windows Failover Cluster allows an authorized attacker to elevate... |
medium | 6.4 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-71339 Heap-based buffer overflow in Windows Installer allows an authorized attacker to... |
medium | 6.7 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-71329 Heap-based buffer overflow in Windows NTFS allows an unauthorized attacker to ex... |
medium | 6.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-70582 Concurrent execution using shared resource with improper synchronization ('race... |
medium | 6.4 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-28 |
| CVE-2026-70575 Null pointer dereference in Windows Schannel allows an authorized attacker to de... |
medium | 6.5 | — | Microsoft / windows 11 23h2 | 2026-09-08 | 2026-09-24 |
| CVE-2026-70290 Use of uninitialized resource in Windows Win32 Kernel Subsystem allows an author... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-70019 Windows hard link in Windows Compressed Folder allows an unauthorized attacker t... |
medium | 6.5 | — | Microsoft / windows 11 23h2 | 2026-09-08 | 2026-09-16 |
| CVE-2026-70091 Concurrent execution using shared resource with improper synchronization ('race... |
medium | 5.9 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-70145 Out-of-bounds read in Microsoft Windows Search Component allows an authorized at... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69895 Out-of-bounds read in Windows Spaceport.sys allows an authorized attacker to dis... |
medium | 4.7 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69878 Heap-based buffer overflow in Windows DHCP Server allows an authorized attacker... |
medium | 6.4 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.