September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,826
Low
527
Severity not reported
2,544
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), apache (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-69827 Concurrent execution using shared resource with improper synchronization ('race... |
high | 8.1 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69816 Use after free in Windows Accounts Control allows an authorized attacker to elev... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-16 |
| CVE-2026-69817 Use after free in Windows Bluetooth Port Driver allows an authorized attacker to... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69818 Use after free in Windows Win32K allows an authorized attacker to elevate privil... |
high | 7.0 | — | Microsoft / windows 11 24h2 | 2026-09-08 | 2026-09-16 |
| CVE-2026-69821 Improper encoding or escaping of output in Active Directory Certificate Services... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69805 External control of file name or path in .NET allows an unauthorized attacker to... |
high | 8.1 | — | Microsoft / microsoft.diagnostics.runtime | 2026-09-08 | 2026-09-29 |
| CVE-2026-69806 Exposure of sensitive information to an unauthorized actor in .NET allows an aut... |
high | 7.0 | — | Microsoft / .net | 2026-09-08 | 2026-09-29 |
| CVE-2026-69807 Improper limitation of a pathname to a restricted directory ('path traversal') i... |
high | 8.0 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69809 Missing release of memory after effective lifetime in Active Directory Domain Se... |
high | 7.5 | — | Microsoft / windows 11 23h2 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69813 Use after free in Windows DNS allows an unauthorized attacker to execute code ov... |
high | 8.1 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69814 Use after free in Windows Credential Providers allows an authorized attacker to... |
high | 7.0 | — | Microsoft / windows 11 23h2 | 2026-09-08 | 2026-09-16 |
| CVE-2026-69797 Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to... |
high | 8.8 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-17 |
| CVE-2026-69799 Concurrent execution using shared resource with improper synchronization ('race... |
high | 7.8 | — | Microsoft / windows 10 21h2 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69801 Heap-based buffer overflow in Windows Audio Service allows an authorized attacke... |
high | 7.8 | — | Microsoft / windows 10 1809 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69803 Out-of-bounds read in Windows DHCP Server allows an unauthorized attacker to dis... |
high | 7.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69804 Time-of-check time-of-use (toctou) race condition in Microsoft Office SharePoint... |
high | 7.5 | — | Microsoft / sharepoint server | 2026-09-08 | 2026-09-09 |
| CVE-2026-69786 Heap-based buffer overflow in Windows Text Shaping allows an unauthorized attack... |
high | 8.1 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69787 Heap-based buffer overflow in Windows Biometric Service allows an authorized att... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-11 |
| CVE-2026-69790 Heap-based buffer overflow in Windows Credential Providers allows an authorized... |
high | 7.8 | — | Microsoft / windows 10 1809 | 2026-09-08 | 2026-09-22 |
| CVE-2026-69791 Use after free in Windows Device Association Service allows an authorized attack... |
high | 7.0 | — | Microsoft / windows 10 1809 | 2026-09-08 | 2026-09-22 |
| CVE-2026-69793 Improper validation of consistency within input in Windows TCP/IP allows an unau... |
high | 7.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69777 Heap-based buffer overflow in Windows DHCP Client allows an authorized attacker... |
high | 8.0 | — | Microsoft / windows 11 24h2 | 2026-09-08 | 2026-09-11 |
| CVE-2026-69778 Heap-based buffer overflow in Microsoft Office Access allows an unauthorized att... |
high | 8.8 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-10 |
| CVE-2026-69779 Time-of-check time-of-use (toctou) race condition in Windows Win32K allows an au... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69782 Concurrent execution using shared resource with improper synchronization ('race... |
high | 8.1 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69784 Use after free in Windows Hello allows an authorized attacker to elevate privile... |
high | 8.8 | — | Microsoft / windows 10 21h2 | 2026-09-08 | 2026-09-22 |
| CVE-2026-69785 Untrusted search path in Windows Smart Card allows an authorized attacker to ele... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69772 Heap-based buffer overflow in Windows Network File System allows an unauthorized... |
high | 8.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69773 Heap-based buffer overflow in Windows Biometric Service allows an authorized att... |
high | 8.0 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-11 |
| CVE-2026-69775 Use after free in Windows DWM Core Library allows an authorized attacker to elev... |
high | 7.5 | — | Microsoft / windows 11 23h2 | 2026-09-08 | 2026-09-22 |
| CVE-2026-69759 Stack-based buffer overflow in Microsoft Office Word allows an unauthorized atta... |
high | 8.8 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-17 |
| CVE-2026-69760 Out-of-bounds read in Windows Kerberos allows an unauthorized attacker to deny s... |
high | 7.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-22 |
| CVE-2026-69761 Use after free in Windows TCP/IP allows an authorized attacker to elevate privil... |
high | 7.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69762 Stack-based buffer overflow in Windows Win32K allows an authorized attacker to e... |
high | 8.8 | — | Microsoft / windows 10 1809 | 2026-09-08 | 2026-09-22 |
| CVE-2026-69764 Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attac... |
high | 8.8 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-09 |
| CVE-2026-69767 Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to... |
high | 8.8 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-17 |
| CVE-2026-69739 Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclo... |
high | 7.5 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-17 |
| CVE-2026-69740 Use after free in Windows Hello allows an authorized attacker to elevate privile... |
high | 8.8 | — | Microsoft / windows 11 23h2 | 2026-09-08 | 2026-09-22 |
| CVE-2026-69742 Integer overflow or wraparound in Microsoft Office Publisher allows an unauthori... |
high | 8.8 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-09 |
| CVE-2026-69744 Null pointer dereference in Windows Kerberos allows an unauthorized attacker to... |
high | 7.5 | — | Microsoft / windows 11 24h2 | 2026-09-08 | 2026-09-22 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.