September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,290
Critical
1,223
High
4,344
Medium
4,103
Low
460
Severity not reported
1,160
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-85983 The Auth0 AD/LDAP Connector improperly processes a configuration value during se... |
high | 7.8 | — | — | 2026-09-08 | 2026-09-10 |
| CVE-2026-85545 There is an Vulnerability in some HikCentral Access Control versions. |
high | 7.1 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-83974 Heap-based buffer overflow in Windows Biometric Service allows an authorized att... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-10 |
| CVE-2026-83979 Use after free in Windows Biometric Service allows an authorized attacker to ele... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-10 |
| CVE-2026-83952 Heap-based buffer overflow in Windows Resilient File System (ReFS) allows an aut... |
high | 7.8 | — | Microsoft / windows 11 24h2 | 2026-09-08 | 2026-09-10 |
| CVE-2026-83969 Heap-based buffer overflow in Windows Biometric Service allows an authorized att... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-10 |
| CVE-2026-6485 UEFI BIOS embedded Shell could be used to bypass Secure Boot via shell commands... |
high | 8.2 | — | — | 2026-09-09 | 2026-09-10 |
| CVE-2026-81973 Acrobat Reader is affected by a Use After Free vulnerability that could result i... |
high | 7.8 | — | Adobe / acrobat | 2026-09-08 | 2026-09-10 |
| CVE-2026-26212 Rara One Click Demo Import plugin for WordPress before 1.3.5 contains an arbitra... |
high | 7.2 | — | — | 2026-09-09 | 2026-09-10 |
| CVE-2026-80083 Untrusted pointer dereference in Windows Hyper-V allows an authorized attacker t... |
high | 8.8 | — | Microsoft / windows 11 23h2 | 2026-09-08 | 2026-09-10 |
| CVE-2026-80093 Use after free in Windows Cloud Files Mini Filter Driver allows an authorized at... |
high | 7.0 | — | Microsoft / windows 10 1809 | 2026-09-08 | 2026-09-10 |
| CVE-2026-61686 SolidInvoice is an open-source invoicing platform. |
high | 7.5 | — | — | 2026-09-04 | 2026-09-10 |
| CVE-2026-19436 The Ultimate Gift Cards for WooCommerce WordPress plugin before 3.2.10 does not... |
high | 7.5 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-19439 The Ultimate Gift Cards for WooCommerce WordPress plugin before 3.2.10 does not... |
high | 7.5 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-77771 The miniOrange 2FA WordPress plugin before 6.3.1, miniOrange 2FA WordPress plugi... |
high | 7.5 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-81431 The Registration Form for WooCommerce WordPress plugin before 1.1.3 does not val... |
high | 7.2 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-82925 The Site Reviews WordPress plugin before 8.3.0 does not prevent request data fro... |
high | 8.1 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-9166 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') v... |
high | 7.5 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-81975 Acrobat Reader is affected by a Use After Free vulnerability that could result i... |
high | 7.8 | — | Adobe / acrobat | 2026-09-08 | 2026-09-10 |
| CVE-2026-81976 Acrobat Reader is affected by a Use After Free vulnerability that could result i... |
high | 7.8 | — | Adobe / acrobat | 2026-09-08 | 2026-09-10 |
| CVE-2026-81979 Acrobat Reader is affected by an out-of-bounds write vulnerability that could re... |
high | 7.8 | — | Adobe / acrobat | 2026-09-08 | 2026-09-10 |
| CVE-2026-81980 Acrobat Reader is affected by an out-of-bounds write vulnerability that could re... |
high | 7.8 | — | Adobe / acrobat | 2026-09-08 | 2026-09-10 |
| CVE-2026-81354 Heap-based buffer overflow in Windows Hello allows an authorized attacker to ele... |
high | 8.2 | — | Microsoft / windows 10 1809 | 2026-09-08 | 2026-09-10 |
| CVE-2026-83498 Untrusted pointer dereference in Windows Virtualization-Based Security (VBS) Enc... |
high | 7.8 | — | Microsoft / windows 11 23h2 | 2026-09-08 | 2026-09-10 |
| CVE-2026-83939 Untrusted pointer dereference in Windows Secure Kernel Mode allows an authorized... |
high | 8.2 | — | Microsoft / windows 11 26h1 | 2026-09-08 | 2026-09-10 |
| CVE-2026-81981 Acrobat Reader is affected by an out-of-bounds write vulnerability that could re... |
high | 7.8 | — | Adobe / acrobat | 2026-09-08 | 2026-09-10 |
| CVE-2026-81983 Acrobat Reader is affected by an out-of-bounds write vulnerability that could re... |
high | 7.8 | — | Adobe / acrobat | 2026-09-08 | 2026-09-10 |
| CVE-2026-81985 Acrobat Reader is affected by a Use After Free vulnerability that could result i... |
high | 7.8 | — | Adobe / acrobat | 2026-09-08 | 2026-09-10 |
| CVE-2026-83942 Missing authorization in Windows Kernel allows an authorized attacker to elevate... |
high | 7.8 | — | Microsoft / windows 10 1809 | 2026-09-08 | 2026-09-10 |
| CVE-2026-83968 Use after free in Windows Biometric Service allows an authorized attacker to ele... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-10 |
| CVE-2026-83940 Use after free in Windows Device Association Service allows an authorized attack... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-10 |
| CVE-2026-81383 Use of incorrectly-resolved name or reference in Visual Studio Code allows an un... |
high | 7.4 | — | Microsoft / visual studio code | 2026-09-08 | 2026-09-10 |
| CVE-2026-15019 The Direct Download for WooCommerce plugin for WordPress is vulnerable to Direct... |
high | 7.5 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-81986 Acrobat Reader is affected by a Use After Free vulnerability that could result i... |
high | 7.8 | — | Adobe / acrobat | 2026-09-08 | 2026-09-10 |
| CVE-2026-69778 Heap-based buffer overflow in Microsoft Office Access allows an unauthorized att... |
high | 8.8 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-10 |
| CVE-2026-77907 Heap-based buffer overflow in Visual Studio allows an unauthorized attacker to e... |
high | 8.8 | — | Microsoft / visual studio 2026 | 2026-09-08 | 2026-09-10 |
| CVE-2026-69614 Stack-based buffer overflow in Microsoft Office Access allows an unauthorized at... |
high | 8.8 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-10 |
| CVE-2026-69529 Heap-based buffer overflow in Microsoft Office Access allows an unauthorized att... |
high | 8.8 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-10 |
| CVE-2026-69477 Heap-based buffer overflow in Microsoft Office Access allows an authorized attac... |
high | 7.3 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-10 |
| CVE-2026-86666 A security flaw has been discovered in aircheng-org iWebShop-5 up to 5.15. |
high | 7.3 | — | — | 2026-09-08 | 2026-09-10 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.