September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,364
Critical
1,230
High
4,374
Medium
4,126
Low
462
Severity not reported
1,172
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (964), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-69323 Heap-based buffer overflow in Windows Biometric Service allows an authorized att... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-10 |
| CVE-2026-69467 Stack-based buffer overflow in Microsoft Graphics Component allows an authorized... |
high | 7.8 | — | Microsoft / windows 10 21h2 | 2026-09-08 | 2026-09-10 |
| CVE-2026-69580 Heap-based buffer overflow in Windows Biometric Service allows an authorized att... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-10 |
| CVE-2026-72990 Heap-based buffer overflow in Windows Biometric Service allows an authorized att... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-10 |
| CVE-2026-72995 Heap-based buffer overflow in Windows Biometric Service allows an authorized att... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-10 |
| CVE-2026-73001 Heap-based buffer overflow in Windows Biometric Service allows an authorized att... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-10 |
| CVE-2026-73006 Stack-based buffer overflow in Microsoft Graphics Component allows an unauthoriz... |
high | 8.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-10 |
| CVE-2026-73011 Heap-based buffer overflow in Windows Biometric Service allows an authorized att... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-10 |
| CVE-2026-73021 Heap-based buffer overflow in Windows Biometric Service allows an authorized att... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-10 |
| CVE-2026-73026 Heap-based buffer overflow in Windows Biometric Service allows an authorized att... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-10 |
| CVE-2026-78464 Time-of-check time-of-use (toctou) race condition in Windows MIDI Service Module... |
high | 7.0 | — | Microsoft / windows 11 24h2 | 2026-09-08 | 2026-09-10 |
| CVE-2026-83974 Heap-based buffer overflow in Windows Biometric Service allows an authorized att... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-10 |
| CVE-2026-83979 Use after free in Windows Biometric Service allows an authorized attacker to ele... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-10 |
| CVE-2026-83952 Heap-based buffer overflow in Windows Resilient File System (ReFS) allows an aut... |
high | 7.8 | — | Microsoft / windows 11 24h2 | 2026-09-08 | 2026-09-10 |
| CVE-2026-83969 Heap-based buffer overflow in Windows Biometric Service allows an authorized att... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-10 |
| CVE-2026-80083 Untrusted pointer dereference in Windows Hyper-V allows an authorized attacker t... |
high | 8.8 | — | Microsoft / windows 11 23h2 | 2026-09-08 | 2026-09-10 |
| CVE-2026-80093 Use after free in Windows Cloud Files Mini Filter Driver allows an authorized at... |
high | 7.0 | — | Microsoft / windows 10 1809 | 2026-09-08 | 2026-09-10 |
| CVE-2026-81354 Heap-based buffer overflow in Windows Hello allows an authorized attacker to ele... |
high | 8.2 | — | Microsoft / windows 10 1809 | 2026-09-08 | 2026-09-10 |
| CVE-2026-83498 Untrusted pointer dereference in Windows Virtualization-Based Security (VBS) Enc... |
high | 7.8 | — | Microsoft / windows 11 23h2 | 2026-09-08 | 2026-09-10 |
| CVE-2026-83939 Untrusted pointer dereference in Windows Secure Kernel Mode allows an authorized... |
high | 8.2 | — | Microsoft / windows 11 26h1 | 2026-09-08 | 2026-09-10 |
| CVE-2026-83942 Missing authorization in Windows Kernel allows an authorized attacker to elevate... |
high | 7.8 | — | Microsoft / windows 10 1809 | 2026-09-08 | 2026-09-10 |
| CVE-2026-83968 Use after free in Windows Biometric Service allows an authorized attacker to ele... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-10 |
| CVE-2026-83940 Use after free in Windows Device Association Service allows an authorized attack... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-10 |
| CVE-2026-81383 Use of incorrectly-resolved name or reference in Visual Studio Code allows an un... |
high | 7.4 | — | Microsoft / visual studio code | 2026-09-08 | 2026-09-10 |
| CVE-2026-69778 Heap-based buffer overflow in Microsoft Office Access allows an unauthorized att... |
high | 8.8 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-10 |
| CVE-2026-77907 Heap-based buffer overflow in Visual Studio allows an unauthorized attacker to e... |
high | 8.8 | — | Microsoft / visual studio 2026 | 2026-09-08 | 2026-09-10 |
| CVE-2026-69614 Stack-based buffer overflow in Microsoft Office Access allows an unauthorized at... |
high | 8.8 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-10 |
| CVE-2026-69529 Heap-based buffer overflow in Microsoft Office Access allows an unauthorized att... |
high | 8.8 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-10 |
| CVE-2026-69477 Heap-based buffer overflow in Microsoft Office Access allows an authorized attac... |
high | 7.3 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-10 |
| CVE-2026-85877 Heap-based buffer overflow in Windows Print Spooler Components allows an unautho... |
high | 8.8 | — | Microsoft / windows 11 24h2 | 2026-09-08 | 2026-09-09 |
| CVE-2026-81385 Deserialization of untrusted data in Microsoft Office Publisher allows an unauth... |
high | 8.8 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-09 |
| CVE-2026-69742 Integer overflow or wraparound in Microsoft Office Publisher allows an unauthori... |
high | 8.8 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-09 |
| CVE-2026-69285 Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker t... |
high | 8.8 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-09 |
| CVE-2026-69442 Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker t... |
high | 8.8 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-09 |
| CVE-2026-69629 Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized at... |
high | 8.8 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-09 |
| CVE-2026-83975 Heap-based buffer overflow in Windows Biometric Service allows an authorized att... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-09 |
| CVE-2026-83986 Heap-based buffer overflow in Windows Biometric Service allows an authorized att... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-09 |
| CVE-2026-80081 Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to... |
high | 8.8 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-09 |
| CVE-2026-78519 Use of uninitialized resource in Microsoft Office Outlook allows an unauthorized... |
high | 8.8 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-09 |
| CVE-2026-69857 Authorization bypass through user-controlled key in Azure Cosmos DB allows an au... |
high | 8.8 | — | Microsoft / azure cosmos db | 2026-09-03 | 2026-09-09 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.