September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,833
Low
527
Severity not reported
2,537
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), linux (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-69874 Untrusted pointer dereference in Windows ALPC allows an authorized attacker to e... |
medium | 6.4 | — | Microsoft / windows 10 1809 | 2026-09-08 | 2026-09-16 |
| CVE-2026-69862 Out-of-bounds read in Windows Wireless Wide Area Network Service allows an autho... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-16 |
| CVE-2026-69853 Use of uninitialized resource in Windows Win32K allows an authorized attacker to... |
medium | 4.7 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69839 Uncaught exception in Windows iSCSI Target Service allows an authorized attacker... |
medium | 6.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69832 Exposure of sensitive system information to an unauthorized control sphere in Wi... |
medium | 4.7 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69820 Heap-based buffer overflow in Windows Hello allows an authorized attacker to ele... |
medium | 6.7 | — | Microsoft / windows 10 21h2 | 2026-09-08 | 2026-09-16 |
| CVE-2026-69808 Out-of-bounds read in Windows Win32K allows an authorized attacker to disclose i... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69794 Buffer over-read in Windows Encrypting File System (EFS) allows an authorized at... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-22 |
| CVE-2026-69792 Concurrent execution using shared resource with improper synchronization ('race... |
medium | 4.7 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-22 |
| CVE-2026-69781 Missing release of memory after effective lifetime in Windows DHCP Client allows... |
medium | 6.5 | — | Microsoft / windows 11 24h2 | 2026-09-08 | 2026-09-10 |
| CVE-2026-69770 Use of uninitialized resource in Windows Spaceport.sys allows an authorized atta... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69771 Improper link resolution before file access ('link following') in Windows Contai... |
medium | 4.7 | — | Microsoft / windows 11 23h2 | 2026-09-08 | 2026-09-22 |
| CVE-2026-69741 Out-of-bounds read in Windows Spaceport.sys allows an authorized attacker to dis... |
medium | 5.5 | — | Microsoft / windows 10 21h2 | 2026-09-08 | 2026-09-22 |
| CVE-2026-69734 Integer overflow or wraparound in Microsoft Office Word allows an unauthorized a... |
medium | 6.5 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-17 |
| CVE-2026-69719 Buffer over-read in Microsoft Office Word allows an unauthorized attacker to dis... |
medium | 6.5 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-17 |
| CVE-2026-69723 Exposure of sensitive system information to an unauthorized control sphere in Wi... |
medium | 5.7 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69713 Dependency on vulnerable third-party component in Windows Secure Boot allows an... |
medium | 4.4 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69690 Improper neutralization of input during web page generation ('cross-site scripti... |
medium | 5.4 | — | Microsoft / sharepoint server | 2026-09-08 | 2026-09-09 |
| CVE-2026-69684 Generation of error message containing sensitive information in Windows Error Re... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69679 Out-of-bounds read in Windows DHCP Server allows an authorized attacker to deny... |
medium | 5.7 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69672 Use of uninitialized resource in Windows DNS allows an authorized attacker to di... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69674 Missing authentication for critical function in Windows Modern Device Management... |
medium | 5.5 | — | Microsoft / windows 10 1809 | 2026-09-08 | 2026-09-22 |
| CVE-2026-69636 Improper neutralization of special elements used in an sql command ('sql injecti... |
medium | 6.5 | — | Microsoft / sharepoint server | 2026-09-08 | 2026-09-09 |
| CVE-2026-69637 Out-of-bounds read in Windows DHCP Server allows an authorized attacker to deny... |
medium | 5.7 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69624 Incomplete list of disallowed inputs in Active Directory Certificate Services (A... |
medium | 6.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69626 Buffer over-read in Microsoft Office allows an unauthorized attacker to disclose... |
medium | 6.5 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-17 |
| CVE-2026-69627 Out-of-bounds read in Windows Remote Desktop Licensing Service allows an authori... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69615 Improper neutralization of input during web page generation ('cross-site scripti... |
medium | 4.8 | — | Microsoft / sharepoint server | 2026-09-08 | 2026-09-10 |
| CVE-2026-69616 Out-of-bounds read in Windows Remote Desktop Services allows an authorized attac... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69618 Out-of-bounds read in Windows SMB Client allows an authorized attacker to disclo... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69609 Out-of-bounds read in Windows Win32K allows an authorized attacker to disclose i... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-10-30 |
| CVE-2026-69591 Out-of-bounds read in Windows NTFS allows an authorized attacker to disclose inf... |
medium | 5.7 | — | Microsoft / windows 10 1809 | 2026-09-08 | 2026-09-14 |
| CVE-2026-69569 Untrusted pointer dereference in Windows Print Spooler Components allows an auth... |
medium | 5.7 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69572 Out-of-bounds read in Windows SMB Client allows an authorized attacker to disclo... |
medium | 5.7 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69562 Out-of-bounds read in SQL Server allows an unauthorized attacker to disclose inf... |
medium | 6.5 | — | Microsoft / sql server 2017 | 2026-09-08 | 2026-10-02 |
| CVE-2026-69566 Heap-based buffer overflow in Windows NTFS allows an unauthorized attacker to ex... |
medium | 6.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69568 Out-of-bounds read in Windows Storage Spaces Controller allows an authorized att... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69554 Missing authentication for critical function in Microsoft Windows Search Compone... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69559 Origin validation error in Microsoft Teams for Android allows an authorized atta... |
medium | 6.3 | — | Microsoft / teams | 2026-09-08 | 2026-09-29 |
| CVE-2026-69548 Heap-based buffer overflow in Windows RNDIS allows an unauthorized attacker to d... |
medium | 4.6 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.