September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,293
Critical
1,225
High
4,345
Medium
4,103
Low
460
Severity not reported
1,160
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-93563 A flaw was found in Netty's `SmtpResponseDecoder` component. |
high | 7.5 | — | — | 2026-09-18 | 2026-09-25 |
| CVE-2026-93572 A flaw was found in Netty's `RedisArrayAggregator` component. |
high | 7.5 | — | — | 2026-09-18 | 2026-09-25 |
| CVE-2026-93575 A flaw was found in Netty's MqttDecoder. |
high | 7.5 | — | — | 2026-09-18 | 2026-09-25 |
| CVE-2026-93576 A flaw was found in Netty netty-codec-smtp. |
high | 7.5 | — | — | 2026-09-18 | 2026-09-25 |
| CVE-2026-96750 MongoDB Compass can interpolate a database name without escaping into the initia... |
high | 7.1 | — | — | 2026-09-24 | 2026-09-25 |
| CVE-2026-82157 Dell ThinOS 10, versions prior to SecurityAddon_2605.10.2766_T10, contains an Im... |
high | 8.3 | — | — | 2026-09-24 | 2026-09-25 |
| CVE-2026-94495 jshERP through 3.6 fails to properly validate user privileges in SystemConfigSer... |
high | 7.1 | — | — | 2026-09-21 | 2026-09-24 |
| CVE-2026-94540 DesktopSMS 1.11.0 by MrPear contains an unauthorized access vulnerability that a... |
high | 7.7 | — | — | 2026-09-21 | 2026-09-24 |
| CVE-2026-94411 jshERP 3.6 contains a privilege escalation vulnerability in the updateOneValueBy... |
high | 8.8 | — | — | 2026-09-21 | 2026-09-24 |
| CVE-2026-85880 Microsoft Windows Heap-Based Buffer Overflow Vulnerability |
high | 7.8 | Listed | Microsoft / Windows | 2026-09-08 | 2026-09-24 |
| CVE-2026-84001 Out-of-bounds read in Windows Key Distribution Center allows an unauthorized att... |
high | 7.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-85360 Use after free in Windows Kernel allows an authorized attacker to elevate privil... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-83995 Heap-based buffer overflow in Windows NTFS allows an authorized attacker to elev... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-83996 Heap-based buffer overflow in Windows Error Reporting allows an authorized attac... |
high | 8.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-84000 Heap-based buffer overflow in Microsoft Graphics Component allows an authorized... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-83989 Out-of-bounds read in Windows Services for NFS ONCRPC XDR Driver allows an unaut... |
high | 7.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-83992 Heap-based buffer overflow in Windows Imaging Component allows an unauthorized a... |
high | 8.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-81955 Heap-based buffer overflow in Microsoft Graphics Component allows an unauthorize... |
high | 8.8 | — | — | 2026-09-08 | 2026-09-24 |
| CVE-2026-81469 Dell Inventory Collector Client, versions prior to 15.0.0, contain an Unquoted S... |
high | 7.8 | — | — | 2026-09-21 | 2026-09-24 |
| CVE-2026-80096 Out-of-bounds read in Windows Remote Desktop Services allows an authorized attac... |
high | 8.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-81355 Heap-based buffer overflow in Virtual Hard Disk (VHD) Miniport Driver allows an... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-78523 Use after free in Windows DNS allows an unauthorized attacker to deny service ov... |
high | 7.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-80075 Heap-based buffer overflow in Windows Work Folders allows an authorized attacker... |
high | 7.8 | — | Microsoft / windows 10 21h2 | 2026-09-08 | 2026-09-24 |
| CVE-2026-78449 Use after free in Reliable Multicast Transport Driver (RMCAST) allows an unautho... |
high | 8.1 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-77904 Heap-based buffer overflow in Windows Volume Manager Extension Driver allows an... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-77905 Use after free in Windows Management Instrumentation allows an authorized attack... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-77893 Out-of-bounds read in Windows DHCP Server allows an unauthorized attacker to den... |
high | 7.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-77894 Concurrent execution using shared resource with improper synchronization ('race... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-77895 Out-of-bounds read in Windows DHCP Server allows an unauthorized attacker to den... |
high | 7.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-77886 Out-of-bounds read in Windows DHCP Server allows an unauthorized attacker to den... |
high | 7.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-77888 Access of resource using incompatible type ('type confusion') in Windows DHCP Se... |
high | 7.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-77889 Access of resource using incompatible type ('type confusion') in Windows DHCP Se... |
high | 7.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-77890 Access of resource using incompatible type ('type confusion') in Windows DHCP Se... |
high | 7.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-77503 Out-of-bounds read in Windows NTFS allows an unauthorized attacker to elevate pr... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-77494 Access of resource using incompatible type ('type confusion') in Windows DHCP Se... |
high | 7.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-77495 Heap-based buffer overflow in Windows Imaging Component allows an unauthorized a... |
high | 8.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-77498 Out-of-bounds read in Windows DHCP Server allows an unauthorized attacker to den... |
high | 7.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-77499 Access of resource using incompatible type ('type confusion') in Windows DHCP Se... |
high | 7.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-77501 Out-of-bounds read in Windows DHCP Server allows an unauthorized attacker to den... |
high | 7.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-77502 Out-of-bounds read in Windows DHCP Server allows an unauthorized attacker to den... |
high | 7.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.