September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,364
Critical
1,230
High
4,374
Medium
4,126
Low
462
Severity not reported
1,172
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (964), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-69553 Missing authorization in Windows Hyper-V allows an authorized attacker to elevat... |
high | 7.5 | — | Microsoft / windows 10 1809 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69544 Heap-based buffer overflow in Windows SMB Client allows an authorized attacker t... |
high | 7.8 | — | Microsoft / windows 11 26h1 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69542 Heap-based buffer overflow in Windows Camera Frame Server Monitor allows an auth... |
high | 7.8 | — | Microsoft / windows 11 24h2 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69540 Use after free in Windows Audio Service allows an authorized attacker to elevate... |
high | 7.0 | — | Microsoft / windows 10 1809 | 2026-09-08 | 2026-09-24 |
| CVE-2026-68844 Heap-based buffer overflow in Windows Storage Spaces Controller allows an author... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-68877 Heap-based buffer overflow in Windows Storage Spaces Controller allows an author... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-68896 Absolute path traversal in Microsoft Windows Search Component allows an authoriz... |
high | 7.8 | — | Microsoft / windows 11 23h2 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69280 Use after free in Windows Push Notifications allows an authorized attacker to el... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-78512 Numeric truncation error in Microsoft Office Word allows an unauthorized attacke... |
high | 8.8 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-24 |
| CVE-2026-69732 Heap-based buffer overflow in Windows Link Layer Topology Discovery Protocol all... |
high | 8.1 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69535 Numeric truncation error in Windows Spaceport.sys allows an authorized attacker... |
high | 7.8 | — | Microsoft / windows 10 21h2 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69534 Improper neutralization of special elements used in a command ('command injectio... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69300 Use after free in Windows Push Notifications allows an authorized attacker to el... |
high | 7.0 | — | Microsoft / windows 11 23h2 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69383 External control of file name or path in Windows Shell allows an authorized atta... |
high | 7.0 | — | Microsoft / windows 11 23h2 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69386 Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unaut... |
high | 8.8 | — | Microsoft / windows 10 1809 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69388 Use after free in Windows Bluetooth Service allows an authorized attacker to ele... |
high | 7.0 | — | Microsoft / windows 10 1809 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69322 Double free in Microsoft Windows Search Component allows an authorized attacker... |
high | 8.0 | — | Microsoft / windows 11 23h2 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69328 Untrusted search path in Windows Storage allows an authorized attacker to elevat... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69377 Missing authorization in Windows Modern Device Management (MDM) allows an author... |
high | 7.8 | — | Microsoft / windows 10 1809 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69279 Use after free in Windows Cloud Files Mini Filter Driver allows an authorized at... |
high | 7.0 | — | Microsoft / windows 10 1809 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69281 Use after free in Windows License Manager allows an authorized attacker to eleva... |
high | 7.0 | — | Microsoft / windows 10 1809 | 2026-09-08 | 2026-09-24 |
| CVE-2026-80097 Improper authentication in Microsoft Authenticator allows an unauthorized attack... |
high | 8.6 | — | Microsoft / authenticator | 2026-09-08 | 2026-09-24 |
| CVE-2026-69299 Use after free in Microsoft COM for Windows allows an authorized attacker to ele... |
high | 7.0 | — | Microsoft / windows 10 21h2 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69528 Missing authentication for critical function in Windows Shell allows an authoriz... |
high | 7.8 | — | Microsoft / windows 11 23h2 | 2026-09-08 | 2026-09-23 |
| CVE-2026-69517 Use after free in Windows Wireless Networking allows an authorized attacker to e... |
high | 7.0 | — | Microsoft / windows 10 1809 | 2026-09-08 | 2026-09-23 |
| CVE-2026-69512 Heap-based buffer overflow in Windows Spaceport.sys allows an authorized attacke... |
high | 8.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-23 |
| CVE-2026-69508 Stack-based buffer overflow in Windows MIDI Service Module allows an authorized... |
high | 7.8 | — | Microsoft / windows 11 24h2 | 2026-09-08 | 2026-09-23 |
| CVE-2026-81349 Improper neutralization of special elements used in an os command ('os command i... |
high | 7.2 | — | Microsoft / azure hdinsight | 2026-09-08 | 2026-09-23 |
| CVE-2026-83998 Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attac... |
high | 8.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-23 |
| CVE-2026-69443 Out-of-bounds read in Microsoft Azure Attestation service and Device Health Atte... |
high | 7.5 | — | Microsoft / windows 10 1809 | 2026-09-08 | 2026-09-23 |
| CVE-2026-78442 Heap-based buffer overflow in Windows OLE DB allows an unauthorized attacker to... |
high | 8.8 | — | Microsoft / sql server 2017 | 2026-09-08 | 2026-09-23 |
| CVE-2026-70584 Access of resource using incompatible type ('type confusion') in Windows Core Me... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-23 |
| CVE-2026-73014 Missing authorization in Data Sharing Service Client allows an authorized attack... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-23 |
| CVE-2026-69725 Double free in Windows Hello allows an authorized attacker to elevate privileges... |
high | 7.8 | — | Microsoft / windows 10 21h2 | 2026-09-08 | 2026-09-22 |
| CVE-2026-69729 Heap-based buffer overflow in Windows Credential Providers allows an authorized... |
high | 8.8 | — | Microsoft / windows 11 24h2 | 2026-09-08 | 2026-09-22 |
| CVE-2026-69735 Use after free in Windows Broadcast DVR User Service allows an authorized attack... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-22 |
| CVE-2026-69740 Use after free in Windows Hello allows an authorized attacker to elevate privile... |
high | 8.8 | — | Microsoft / windows 11 23h2 | 2026-09-08 | 2026-09-22 |
| CVE-2026-69757 Use after free in Windows TCP/IP allows an authorized attacker to elevate privil... |
high | 7.5 | — | Microsoft / windows 10 1809 | 2026-09-08 | 2026-09-22 |
| CVE-2026-69762 Stack-based buffer overflow in Windows Win32K allows an authorized attacker to e... |
high | 8.8 | — | Microsoft / windows 10 1809 | 2026-09-08 | 2026-09-22 |
| CVE-2026-69775 Use after free in Windows DWM Core Library allows an authorized attacker to elev... |
high | 7.5 | — | Microsoft / windows 11 23h2 | 2026-09-08 | 2026-09-22 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.