September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,364
Critical
1,230
High
4,374
Medium
4,126
Low
462
Severity not reported
1,172
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (964), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-69453 Missing authorization in Microsoft Windows Search Component allows an authorized... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-25 |
| CVE-2026-78508 Out-of-bounds read in Windows CD-ROM Driver allows an unauthorized attacker to d... |
medium | 4.6 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-78453 Integer underflow (wrap or wraparound) in Microsoft Windows SCSI Class System Fi... |
medium | 6.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-77892 No cwe for this issue in Windows Boot Manager allows an unauthorized attacker to... |
medium | 6.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-77887 Out-of-bounds read in Windows DHCP Server allows an authorized attacker to execu... |
medium | 6.4 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-77891 Out-of-bounds read in Windows DHCP Server allows an authorized attacker to execu... |
medium | 6.4 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-77491 Out-of-bounds read in Windows GDI allows an unauthorized attacker to disclose in... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-73019 Improper resolution of path equivalence in Windows URL Moniker allows an unautho... |
medium | 4.3 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-72985 Heap-based buffer overflow in Windows Volume Shadow Copy allows an unauthorized... |
medium | 6.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-72966 Missing authorization in Windows Remote Access Connection Manager allows an auth... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-72939 Null pointer dereference in Windows Routing and Remote Access Service (RRAS) all... |
medium | 6.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-72942 Out-of-bounds read in Windows Spaceport.sys allows an unauthorized attacker to d... |
medium | 6.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-72935 Out-of-bounds read in Windows NTFS allows an authorized attacker to elevate priv... |
medium | 6.7 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-72937 Out-of-bounds read in Storage Port Driver allows an authorized attacker to discl... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-72931 Missing release of resource after effective lifetime in Windows Secure Socket Tu... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-71348 Heap-based buffer overflow in Windows Spaceport.sys allows an unauthorized attac... |
medium | 6.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-71349 Heap-based buffer overflow in Windows Spaceport.sys allows an unauthorized attac... |
medium | 6.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-71350 Heap-based buffer overflow in Windows Spaceport.sys allows an unauthorized attac... |
medium | 6.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-71339 Heap-based buffer overflow in Windows Installer allows an authorized attacker to... |
medium | 6.7 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-71341 Out-of-bounds read in Windows Partition Management Driver allows an authorized a... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-71338 Double free in Windows Failover Cluster allows an authorized attacker to elevate... |
medium | 6.4 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-71329 Heap-based buffer overflow in Windows NTFS allows an unauthorized attacker to ex... |
medium | 6.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-70145 Out-of-bounds read in Microsoft Windows Search Component allows an authorized at... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-70290 Use of uninitialized resource in Windows Win32 Kernel Subsystem allows an author... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-70091 Concurrent execution using shared resource with improper synchronization ('race... |
medium | 5.9 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69878 Heap-based buffer overflow in Windows DHCP Server allows an authorized attacker... |
medium | 6.4 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69895 Out-of-bounds read in Windows Spaceport.sys allows an authorized attacker to dis... |
medium | 4.7 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69853 Use of uninitialized resource in Windows Win32K allows an authorized attacker to... |
medium | 4.7 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69839 Uncaught exception in Windows iSCSI Target Service allows an authorized attacker... |
medium | 6.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69832 Exposure of sensitive system information to an unauthorized control sphere in Wi... |
medium | 4.7 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69808 Out-of-bounds read in Windows Win32K allows an authorized attacker to disclose i... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69770 Use of uninitialized resource in Windows Spaceport.sys allows an authorized atta... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69723 Exposure of sensitive system information to an unauthorized control sphere in Wi... |
medium | 5.7 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69713 Dependency on vulnerable third-party component in Windows Secure Boot allows an... |
medium | 4.4 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69684 Generation of error message containing sensitive information in Windows Error Re... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69679 Out-of-bounds read in Windows DHCP Server allows an authorized attacker to deny... |
medium | 5.7 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69672 Use of uninitialized resource in Windows DNS allows an authorized attacker to di... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69637 Out-of-bounds read in Windows DHCP Server allows an authorized attacker to deny... |
medium | 5.7 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69624 Incomplete list of disallowed inputs in Active Directory Certificate Services (A... |
medium | 6.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69627 Out-of-bounds read in Windows Remote Desktop Licensing Service allows an authori... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.