September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,364
Critical
1,230
High
4,374
Medium
4,126
Low
462
Severity not reported
1,172
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (964), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-66816 Insufficient logging in SQL Server allows an authorized attacker to bypass a sec... |
medium | 6.5 | — | Microsoft / sql server 2022 | 2026-09-08 | 2026-09-16 |
| CVE-2026-68785 Heap-based buffer overflow in SQL Server allows an authorized attacker to execut... |
medium | 4.9 | — | Microsoft / sql server 2017 | 2026-09-08 | 2026-09-15 |
| CVE-2026-68784 Out-of-bounds read in SQL Server allows an authorized attacker to disclose infor... |
medium | 6.5 | — | Microsoft / sql server 2017 | 2026-09-08 | 2026-09-15 |
| CVE-2026-68781 Out-of-bounds read in SQL Server allows an authorized attacker to disclose infor... |
medium | 6.5 | — | Microsoft / sql server 2017 | 2026-09-08 | 2026-09-15 |
| CVE-2026-68780 Out-of-bounds read in SQL Server allows an authorized attacker to disclose infor... |
medium | 6.5 | — | Microsoft / sql server 2017 | 2026-09-08 | 2026-09-15 |
| CVE-2026-68779 Out-of-bounds read in SQL Server allows an authorized attacker to disclose infor... |
medium | 6.5 | — | Microsoft / sql server 2017 | 2026-09-08 | 2026-09-15 |
| CVE-2026-68778 Out-of-bounds read in SQL Server allows an authorized attacker to disclose infor... |
medium | 6.5 | — | Microsoft / sql server 2017 | 2026-09-08 | 2026-09-15 |
| CVE-2026-68777 Out-of-bounds read in SQL Server allows an authorized attacker to disclose infor... |
medium | 6.5 | — | Microsoft / sql server 2017 | 2026-09-08 | 2026-09-15 |
| CVE-2026-68776 Use of uninitialized resource in SQL Server allows an authorized attacker to dis... |
medium | 6.5 | — | Microsoft / sql server 2017 | 2026-09-08 | 2026-09-15 |
| CVE-2026-67648 Use of uninitialized resource in SQL Server allows an authorized attacker to dis... |
medium | 6.5 | — | Microsoft / sql server 2017 | 2026-09-08 | 2026-09-15 |
| CVE-2026-67645 Out-of-bounds read in SQL Server allows an authorized attacker to disclose infor... |
medium | 6.5 | — | Microsoft / sql server 2017 | 2026-09-08 | 2026-09-15 |
| CVE-2026-67641 Integer overflow or wraparound in SQL Server allows an authorized attacker to de... |
medium | 6.5 | — | Microsoft / sql server 2022 | 2026-09-08 | 2026-09-15 |
| CVE-2026-67393 Buffer over-read in SQL Server allows an authorized attacker to disclose informa... |
medium | 6.5 | — | Microsoft / sql server 2017 | 2026-09-08 | 2026-09-15 |
| CVE-2026-67390 Buffer over-read in SQL Server allows an authorized attacker to disclose informa... |
medium | 6.5 | — | Microsoft / sql server 2017 | 2026-09-08 | 2026-09-15 |
| CVE-2026-67389 Out-of-bounds read in SQL Server allows an authorized attacker to disclose infor... |
medium | 6.5 | — | Microsoft / sql server 2022 | 2026-09-08 | 2026-09-15 |
| CVE-2026-73029 Buffer over-read in SQL Server allows an authorized attacker to disclose informa... |
medium | 6.5 | — | Microsoft / sql server 2019 | 2026-09-08 | 2026-09-15 |
| CVE-2026-77488 Integer underflow (wrap or wraparound) in SQL Server allows an authorized attack... |
medium | 5.5 | — | Microsoft / sql server 2017 | 2026-09-08 | 2026-09-15 |
| CVE-2026-69425 Improper link resolution before file access ('link following') in Windows NTFS a... |
medium | 4.7 | — | Microsoft / windows 11 23h2 | 2026-09-08 | 2026-09-14 |
| CVE-2026-69591 Out-of-bounds read in Windows NTFS allows an authorized attacker to disclose inf... |
medium | 5.7 | — | Microsoft / windows 10 1809 | 2026-09-08 | 2026-09-14 |
| CVE-2026-81377 Improper limitation of a pathname to a restricted directory ('path traversal') i... |
medium | 6.5 | — | Microsoft / visual studio code | 2026-09-08 | 2026-09-11 |
| CVE-2026-78455 Out-of-bounds read in Xbox allows an unauthorized attacker to disclose informati... |
medium | 4.3 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-11 |
| CVE-2026-78451 Untrusted pointer dereference in Microsoft Windows SCSI Class System File allows... |
medium | 6.8 | — | Microsoft / windows 10 1809 | 2026-09-08 | 2026-09-11 |
| CVE-2026-78452 Out-of-bounds read in Microsoft Windows SCSI Class System File allows an unautho... |
medium | 4.6 | — | Microsoft / windows 10 1809 | 2026-09-08 | 2026-09-11 |
| CVE-2026-78454 Out-of-bounds read in Windows CD-ROM Driver allows an authorized attacker to dis... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-11 |
| CVE-2026-69615 Improper neutralization of input during web page generation ('cross-site scripti... |
medium | 4.8 | — | Microsoft / sharepoint server | 2026-09-08 | 2026-09-10 |
| CVE-2026-69402 Improper neutralization of input during web page generation ('cross-site scripti... |
medium | 5.4 | — | Microsoft / sharepoint server | 2026-09-08 | 2026-09-10 |
| CVE-2026-73008 Exposure of private personal information to an unauthorized actor in Windows Bio... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-10 |
| CVE-2026-69781 Missing release of memory after effective lifetime in Windows DHCP Client allows... |
medium | 6.5 | — | Microsoft / windows 11 24h2 | 2026-09-08 | 2026-09-10 |
| CVE-2026-72956 Untrusted pointer dereference in Microsoft Office PowerPoint allows an unauthori... |
medium | 6.5 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-10 |
| CVE-2026-83501 Out-of-bounds read in Windows Virtualization-Based Security (VBS) Enclave allows... |
medium | 5.5 | — | Microsoft / windows 11 23h2 | 2026-09-08 | 2026-09-10 |
| CVE-2026-80084 Out-of-bounds read in Microsoft Office Outlook allows an unauthorized attacker t... |
medium | 6.5 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-10 |
| CVE-2026-83991 Missing authentication for critical function in Windows Cloud Files Mini Filter... |
medium | 5.5 | — | Microsoft / windows 10 1809 | 2026-09-08 | 2026-09-09 |
| CVE-2026-69690 Improper neutralization of input during web page generation ('cross-site scripti... |
medium | 5.4 | — | Microsoft / sharepoint server | 2026-09-08 | 2026-09-09 |
| CVE-2026-80073 Out-of-bounds read in Microsoft Office Outlook allows an unauthorized attacker t... |
medium | 6.5 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-09 |
| CVE-2026-64918 Insufficiently protected credentials in Microsoft Office allows an unauthorized... |
medium | 6.5 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-09 |
| CVE-2026-69409 Execution with unnecessary privileges in Microsoft Office SharePoint allows an a... |
medium | 6.5 | — | Microsoft / sharepoint server | 2026-09-08 | 2026-09-09 |
| CVE-2026-69417 Improper neutralization of input during web page generation ('cross-site scripti... |
medium | 5.4 | — | Microsoft / sharepoint server | 2026-09-08 | 2026-09-09 |
| CVE-2026-69636 Improper neutralization of special elements used in an sql command ('sql injecti... |
medium | 6.5 | — | Microsoft / sharepoint server | 2026-09-08 | 2026-09-09 |
| CVE-2026-78522 Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to d... |
medium | 6.5 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-08 |
| CVE-2026-80079 Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to d... |
medium | 6.5 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-08 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.