September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,364
Critical
1,230
High
4,374
Medium
4,126
Low
462
Severity not reported
1,172
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (964), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-78502 Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to d... |
medium | 6.5 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-17 |
| CVE-2026-78503 Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to d... |
medium | 6.5 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-17 |
| CVE-2026-72975 Out-of-bounds read in Microsoft Office PowerPoint allows an unauthorized attacke... |
medium | 6.5 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-17 |
| CVE-2026-72976 Out-of-bounds read in Microsoft Office Word allows an authorized attacker to dis... |
medium | 5.0 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-17 |
| CVE-2026-72977 Out-of-bounds read in Microsoft Office PowerPoint allows an unauthorized attacke... |
medium | 6.5 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-17 |
| CVE-2026-72974 Buffer over-read in Microsoft Office Excel allows an unauthorized attacker to di... |
medium | 6.5 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-17 |
| CVE-2026-72938 Access of resource using incompatible type ('type confusion') in Microsoft Offic... |
medium | 6.5 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-17 |
| CVE-2026-69734 Integer overflow or wraparound in Microsoft Office Word allows an unauthorized a... |
medium | 6.5 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-17 |
| CVE-2026-69719 Buffer over-read in Microsoft Office Word allows an unauthorized attacker to dis... |
medium | 6.5 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-17 |
| CVE-2026-69626 Buffer over-read in Microsoft Office allows an unauthorized attacker to disclose... |
medium | 6.5 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-17 |
| CVE-2026-72980 Uncontrolled search path element in Windows Hello allows an authorized attacker... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-17 |
| CVE-2026-72999 Out-of-bounds read in Windows USB Hub Driver allows an unauthorized attacker to... |
medium | 6.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-17 |
| CVE-2026-73004 Missing authentication for critical function in Windows Autopilot allows an auth... |
medium | 5.5 | — | Microsoft / windows 10 21h2 | 2026-09-08 | 2026-09-17 |
| CVE-2026-69316 Buffer over-read in Windows Overlay Filter allows an authorized attacker to disc... |
medium | 4.7 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-17 |
| CVE-2026-69344 Out-of-bounds read in Windows Print Spooler Components allows an authorized atta... |
medium | 5.5 | — | Microsoft / windows 10 21h2 | 2026-09-08 | 2026-09-17 |
| CVE-2026-69294 Generation of error message containing sensitive information in Microsoft COM fo... |
medium | 5.5 | — | Microsoft / windows 10 1809 | 2026-09-08 | 2026-09-17 |
| CVE-2026-69315 Exposure of sensitive system information to an unauthorized control sphere in Wi... |
medium | 5.5 | — | Microsoft / windows 10 1809 | 2026-09-08 | 2026-09-17 |
| CVE-2026-69339 Exposure of sensitive system information to an unauthorized control sphere in Wi... |
medium | 5.5 | — | Microsoft / windows 11 24h2 | 2026-09-08 | 2026-09-17 |
| CVE-2026-69374 Allocation of resources without limits or throttling in Windows SMB Server allow... |
medium | 6.5 | — | Microsoft / windows 10 21h2 | 2026-09-08 | 2026-09-17 |
| CVE-2026-69390 Out-of-bounds read in Windows Spaceport.sys allows an authorized attacker to dis... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-17 |
| CVE-2026-69507 Insertion of sensitive information into externally-accessible file or directory... |
medium | 5.7 | — | Microsoft / windows 11 23h2 | 2026-09-08 | 2026-09-17 |
| CVE-2026-69267 Insufficient granularity of access control in Windows Connected User Experiences... |
medium | 6.5 | — | Microsoft / windows 10 1809 | 2026-09-08 | 2026-09-17 |
| CVE-2026-68886 Use after free in Windows Network Connection Broker allows an authorized attacke... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-17 |
| CVE-2026-68873 Insertion of sensitive information into log file in Windows Program Compatibilit... |
medium | 5.5 | — | Microsoft / windows 11 23h2 | 2026-09-08 | 2026-09-17 |
| CVE-2026-69820 Heap-based buffer overflow in Windows Hello allows an authorized attacker to ele... |
medium | 6.7 | — | Microsoft / windows 10 21h2 | 2026-09-08 | 2026-09-16 |
| CVE-2026-68849 Out-of-bounds read in Windows Bluetooth Port Driver allows an authorized attacke... |
medium | 4.7 | — | Microsoft / windows 10 21h2 | 2026-09-08 | 2026-09-16 |
| CVE-2026-69642 Improper neutralization of input during web page generation ('cross-site scripti... |
medium | 6.1 | — | Microsoft / skype for business server | 2026-09-08 | 2026-09-16 |
| CVE-2026-66308 Out-of-bounds read in Skype for Business allows an authorized attacker to deny s... |
medium | 6.5 | — | Microsoft / skype for business server | 2026-09-08 | 2026-09-16 |
| CVE-2026-66306 Generation of error message containing sensitive information in Skype for Busine... |
medium | 6.5 | — | Microsoft / skype for business server | 2026-09-08 | 2026-09-16 |
| CVE-2026-66303 Null pointer dereference in Skype for Business allows an authorized attacker to... |
medium | 6.5 | — | Microsoft / skype for business server | 2026-09-08 | 2026-09-16 |
| CVE-2026-63523 Improper neutralization of input during web page generation ('cross-site scripti... |
medium | 6.1 | — | Microsoft / skype for business server | 2026-09-08 | 2026-09-16 |
| CVE-2026-70019 Windows hard link in Windows Compressed Folder allows an unauthorized attacker t... |
medium | 6.5 | — | Microsoft / windows 11 23h2 | 2026-09-08 | 2026-09-16 |
| CVE-2026-69874 Untrusted pointer dereference in Windows ALPC allows an authorized attacker to e... |
medium | 6.4 | — | Microsoft / windows 10 1809 | 2026-09-08 | 2026-09-16 |
| CVE-2026-69862 Out-of-bounds read in Windows Wireless Wide Area Network Service allows an autho... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-16 |
| CVE-2026-69469 Integer overflow or wraparound in Windows USB Audio Class driver (usbaudio.sys)... |
medium | 6.6 | — | Microsoft / windows 10 1809 | 2026-09-08 | 2026-09-16 |
| CVE-2026-68842 Exposure of sensitive system information to an unauthorized control sphere in Wi... |
medium | 5.5 | — | Microsoft / windows 11 24h2 | 2026-09-08 | 2026-09-16 |
| CVE-2026-67633 Out-of-bounds read in SQL Server allows an authorized attacker to deny service o... |
medium | 6.5 | — | Microsoft / sql server 2017 | 2026-09-08 | 2026-09-16 |
| CVE-2026-67386 Use of uninitialized resource in SQL Server allows an authorized attacker to dis... |
medium | 6.5 | — | Microsoft / sql server 2017 | 2026-09-08 | 2026-09-16 |
| CVE-2026-67383 Generation of error message containing sensitive information in SQL Server allow... |
medium | 6.5 | — | Microsoft / sql server 2025 | 2026-09-08 | 2026-09-16 |
| CVE-2026-67369 Out-of-bounds read in SQL Server allows an authorized attacker to disclose infor... |
medium | 6.5 | — | Microsoft / sql server 2025 | 2026-09-08 | 2026-09-16 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.