September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,291
Critical
1,223
High
4,345
Medium
4,103
Low
460
Severity not reported
1,160
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-73016 Heap-based buffer overflow in Microsoft Graphics Component allows an unauthorize... |
high | 8.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-73018 Heap-based buffer overflow in Graphic Fonts allows an unauthorized attacker to e... |
high | 8.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-73012 Heap-based buffer overflow in Windows Management Services allows an authorized a... |
high | 8.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-72986 Heap-based buffer overflow in Graphic Fonts allows an unauthorized attacker to e... |
high | 8.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-72987 Use after free in Windows DNS allows an unauthorized attacker to execute code ov... |
high | 8.1 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-72981 Use after free in IP Helper allows an unauthorized attacker to execute code over... |
high | 8.1 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-72967 Heap-based buffer overflow in Windows Network Connection Broker allows an author... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-72978 Allocation of resources without limits or throttling in Active Directory Federat... |
high | 7.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-72957 Heap-based buffer overflow in Windows Deployment Services allows an authorized a... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-72959 Remote Code Execution in Windows Routing and Remote Access Service (RRAS) allows... |
high | 8.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-72965 Use after free in Windows WebClient Service allows an authorized attacker to ele... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-72948 Relative path traversal in Windows DNS allows an authorized attacker to elevate... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-72954 Use after free in Windows Deployment Services allows an authorized attacker to e... |
high | 7.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-72943 Use after free in Windows Deployment Services allows an authorized attacker to e... |
high | 7.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-72944 Heap-based buffer overflow in Windows Fax Service allows an authorized attacker... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-72932 Buffer over-read in Windows Message Queuing Queue Manager allows an unauthorized... |
high | 7.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-72933 Heap-based buffer overflow in Microsoft WDAC OLE DB provider for SQL allows an u... |
high | 8.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-71353 Double free in Windows Routing and Remote Access Service (RRAS) allows an author... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-72927 Heap-based buffer overflow in Winsock allows an authorized attacker to elevate p... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-72930 Use after free in Windows Secure Socket Tunneling Protocol (SSTP) allows an auth... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-71351 Double free in Windows Routing and Remote Access Service (RRAS) allows an author... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-71352 Integer underflow (wrap or wraparound) in Windows Remote Access Connection Manag... |
high | 8.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-71342 Use after free in Windows Remote Access Connection Manager allows an authorized... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-71343 Heap-based buffer overflow in Windows Remote Access Connection Manager allows an... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-71345 Out-of-bounds write in Windows Spaceport.sys allows an authorized attacker to ex... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-71333 Use after free in Windows Remote Access Connection Manager allows an authorized... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-71334 Heap-based buffer overflow in Windows NFS Portmapper allows an authorized attack... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-71336 Integer overflow or wraparound in Windows Work Folder Service allows an authoriz... |
high | 8.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-70585 Use after free in Windows Services for NFS ONCRPC XDR Driver allows an authorize... |
high | 7.0 | — | Microsoft / windows server 2012 | 2026-09-08 | 2026-09-24 |
| CVE-2026-70586 Heap-based buffer overflow in Windows Paint allows an unauthorized attacker to e... |
high | 8.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-70587 Improper null termination in Windows Remote Desktop Protocol allows an unauthori... |
high | 7.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-71330 Exposure of sensitive system information to an unauthorized control sphere in Wi... |
high | 7.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-70574 Out-of-bounds read in Virtual Hard Disk (VHD) Miniport Driver allows an authoriz... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-70564 Heap-based buffer overflow in Windows Print Spooler Components allows an authori... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-70565 Use after free in Windows AF_UNIX Socket Provider allows an authorized attacker... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-70568 Heap-based buffer overflow in Windows Defender Firewall Service allows an author... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-70570 Remote Code Execution in Windows Routing and Remote Access Service (RRAS) allows... |
high | 8.1 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-70342 Use after free in Windows Ancillary Function Driver for WinSock allows an unauth... |
high | 8.1 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-70562 Double free in Windows Audio Service allows an authorized attacker to elevate pr... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-70563 Improper link resolution before file access ('link following') in Windows Shell... |
high | 8.1 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.