September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,290
Critical
1,223
High
4,344
Medium
4,103
Low
460
Severity not reported
1,160
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-78505 Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker t... |
high | 8.8 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-17 |
| CVE-2026-77901 Null pointer dereference in Microsoft Office Word allows an unauthorized attacke... |
high | 8.8 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-17 |
| CVE-2026-78439 Stack-based buffer overflow in Microsoft Graphics Component allows an unauthoriz... |
high | 8.8 | — | — | 2026-09-08 | 2026-09-17 |
| CVE-2026-77898 Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker t... |
high | 7.5 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-17 |
| CVE-2026-76869 Netcore NR255-V version 1.5.130703 contains a stack-based buffer overflow in reb... |
high | 7.2 | — | — | 2026-09-15 | 2026-09-17 |
| CVE-2026-76646 A remote attacker could cause excessive resource consumption by supplying specia... |
high | 7.5 | — | — | 2026-09-16 | 2026-09-17 |
| CVE-2026-72972 Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attac... |
high | 8.8 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-17 |
| CVE-2026-72973 Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attac... |
high | 8.8 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-17 |
| CVE-2026-69797 Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to... |
high | 8.8 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-17 |
| CVE-2026-69759 Stack-based buffer overflow in Microsoft Office Word allows an unauthorized atta... |
high | 8.8 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-17 |
| CVE-2026-69739 Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclo... |
high | 7.5 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-17 |
| CVE-2026-69722 Stack-based buffer overflow in Microsoft Office Word allows an unauthorized atta... |
high | 8.8 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-17 |
| CVE-2026-69686 Stack-based buffer overflow in Microsoft Office Word allows an unauthorized atta... |
high | 8.8 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-17 |
| CVE-2026-69671 Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attac... |
high | 8.8 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-17 |
| CVE-2026-69678 Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to... |
high | 8.8 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-17 |
| CVE-2026-69632 Use after free in Microsoft Office allows an unauthorized attacker to execute co... |
high | 8.8 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-17 |
| CVE-2026-73003 Use after free in Windows Modern Device Management (MDM) allows an authorized at... |
high | 7.0 | — | Microsoft / windows 10 1809 | 2026-09-08 | 2026-09-17 |
| CVE-2026-73005 Use after free in Windows Authentication Methods allows an authorized attacker t... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-17 |
| CVE-2026-79419 A reflected cross-site scripting (XSS) vulnerability exists in EMX Tecnologia Ge... |
high | 8.7 | — | Emxtecnologia / gestao x business suite | 2026-09-04 | 2026-09-17 |
| CVE-2026-79418 EMX Tecnologia Gestao X version <= 8.4 contains a Stored Cross-Site Scripting (X... |
high | 8.7 | — | Emxtecnologia / gestao x business suite | 2026-09-04 | 2026-09-17 |
| CVE-2026-82964 Improper preservation of permissions in the Avast sandbox minifilter driver (asw... |
high | 8.8 | — | — | 2026-09-16 | 2026-09-17 |
| CVE-2026-72963 Use after free in Windows Modern Execution Server allows an authorized attacker... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-17 |
| CVE-2026-81353 Heap-based buffer overflow in Microsoft Windows Codecs Library allows an unautho... |
high | 7.8 | — | Microsoft / heif image extension | 2026-09-08 | 2026-09-17 |
| CVE-2026-91741 Type confusion in CacheStorage in Google Chrome prior to 153.0.8010.47 allowed a... |
high | 8.8 | — | Google / chrome | 2026-09-15 | 2026-09-17 |
| CVE-2026-91743 Race condition in Core in Google Chrome prior to 153.0.8010.47 allowed a remote... |
high | 8.3 | — | Google / chrome | 2026-09-15 | 2026-09-17 |
| CVE-2026-91745 Use after free in V8 in Google Chrome prior to 153.0.8010.47 allowed a remote at... |
high | 8.8 | — | Google / chrome | 2026-09-15 | 2026-09-17 |
| CVE-2026-91748 Race condition in Extensions in Google Chrome on on Mac prior to 153.0.8010.47 a... |
high | 8.3 | — | Google / chrome | 2026-09-15 | 2026-09-17 |
| CVE-2026-65344 An out-of-bounds write issue was addressed with improved bounds checking. |
high | 7.8 | — | Apple / ipados | 2026-09-14 | 2026-09-17 |
| CVE-2026-43702 The issue was addressed with improved memory handling. |
high | 7.8 | — | Apple / ipados | 2026-09-14 | 2026-09-17 |
| CVE-2026-43688 A memory corruption issue was addressed with improved input validation. |
high | 7.8 | — | Apple / ipados | 2026-09-14 | 2026-09-17 |
| CVE-2026-28938 A privacy issue was addressed by moving sensitive data. |
high | 7.5 | — | Apple / ipados | 2026-09-14 | 2026-09-17 |
| CVE-2026-28935 The issue was addressed with improved memory handling. |
high | 7.5 | — | Apple / ipados | 2026-09-14 | 2026-09-17 |
| CVE-2026-56172 Use after free in Windows VHD miniport driver allows an authorized attacker to e... |
high | 7.8 | — | Microsoft / windows 10 1809 | 2026-09-08 | 2026-09-17 |
| CVE-2026-56177 Use after free in Windows Server allows an authorized attacker to elevate privil... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-17 |
| CVE-2026-62697 Use after free in Windows Push Notifications allows an authorized attacker to el... |
high | 7.8 | — | Microsoft / windows 10 21h2 | 2026-09-08 | 2026-09-17 |
| CVE-2026-68824 Concurrent execution using shared resource with improper synchronization ('race... |
high | 7.0 | — | Microsoft / windows 10 21h2 | 2026-09-08 | 2026-09-17 |
| CVE-2026-68825 Use after free in Windows Bind Filter Driver allows an authorized attacker to el... |
high | 7.0 | — | Microsoft / windows 11 23h2 | 2026-09-08 | 2026-09-17 |
| CVE-2026-68837 Use after free in Windows File History Service allows an authorized attacker to... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-17 |
| CVE-2026-68847 Use after free in Windows Connected User Experiences and Telemetry allows an aut... |
high | 7.0 | — | Microsoft / windows 10 21h2 | 2026-09-08 | 2026-09-17 |
| CVE-2026-89063 The Online Scheduling and Appointment Booking System – Bookly plugin for WordPre... |
high | 7.5 | — | — | 2026-09-16 | 2026-09-17 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.