September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,826
Low
527
Severity not reported
2,544
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), apache (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-69757 Use after free in Windows TCP/IP allows an authorized attacker to elevate privil... |
high | 7.5 | — | Microsoft / windows 10 1809 | 2026-09-08 | 2026-09-22 |
| CVE-2026-69758 Heap-based buffer overflow in Windows Universal Disk Format File System Driver (... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69729 Heap-based buffer overflow in Windows Credential Providers allows an authorized... |
high | 8.8 | — | Microsoft / windows 11 24h2 | 2026-09-08 | 2026-09-22 |
| CVE-2026-69731 Heap-based buffer overflow in HID class driver allows an authorized attacker to... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69732 Heap-based buffer overflow in Windows Link Layer Topology Discovery Protocol all... |
high | 8.1 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69735 Use after free in Windows Broadcast DVR User Service allows an authorized attack... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-22 |
| CVE-2026-69738 Integer overflow or wraparound in Windows Biometric Service allows an authorized... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-14 |
| CVE-2026-69720 Heap-based buffer overflow in Windows MIDI Service Module allows an authorized a... |
high | 7.8 | — | Microsoft / windows 11 24h2 | 2026-09-08 | 2026-09-22 |
| CVE-2026-69722 Stack-based buffer overflow in Microsoft Office Word allows an unauthorized atta... |
high | 8.8 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-17 |
| CVE-2026-69724 Missing authorization in Microsoft Office SharePoint allows an authorized attack... |
high | 8.8 | — | Microsoft / sharepoint server | 2026-09-08 | 2026-09-09 |
| CVE-2026-69725 Double free in Windows Hello allows an authorized attacker to elevate privileges... |
high | 7.8 | — | Microsoft / windows 10 21h2 | 2026-09-08 | 2026-09-22 |
| CVE-2026-69727 Heap-based buffer overflow in Windows Biometric Service allows an authorized att... |
high | 8.0 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-11 |
| CVE-2026-69712 Use after free in Windows Key Distribution Center allows an authorized attacker... |
high | 8.8 | — | Microsoft / windows server 2012 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69714 Stack-based buffer overflow in Windows Device Association Service allows an auth... |
high | 8.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69716 Improper neutralization of special elements used in an sql command ('sql injecti... |
high | 8.8 | — | Microsoft / sharepoint server | 2026-09-08 | 2026-09-09 |
| CVE-2026-69717 Untrusted pointer dereference in Windows Group Policy allows an authorized attac... |
high | 8.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69706 Use after free in Windows Win32K allows an authorized attacker to elevate privil... |
high | 7.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69707 Integer overflow or wraparound in Windows USB Audio Class driver (usbaudio.sys)... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69708 Use after free in Windows Web Platform Storage allows an authorized attacker to... |
high | 7.0 | — | Microsoft / windows 10 1809 | 2026-09-08 | 2026-09-22 |
| CVE-2026-69709 Heap-based buffer overflow in Windows NTFS allows an authorized attacker to exec... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69710 Concurrent execution using shared resource with improper synchronization ('race... |
high | 7.5 | — | Microsoft / windows 10 21h2 | 2026-09-08 | 2026-09-22 |
| CVE-2026-69711 Use after free in Windows Device Association Service allows an authorized attack... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-22 |
| CVE-2026-69689 Out-of-bounds read in Windows Win32K allows an authorized attacker to elevate pr... |
high | 8.8 | — | Microsoft / windows 10 1809 | 2026-09-08 | 2026-09-22 |
| CVE-2026-69691 Heap-based buffer overflow in Windows Spaceport.sys allows an authorized attacke... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69692 Use after free in Windows Audio Service allows an authorized attacker to elevate... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69693 Use after free in Windows Device Association Broker service allows an authorized... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-22 |
| CVE-2026-69694 Deserialization of untrusted data in Windows IP Address Management (IPAM) Servic... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-22 |
| CVE-2026-69683 Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an auth... |
high | 7.7 | — | Microsoft / sharepoint server | 2026-09-08 | 2026-09-09 |
| CVE-2026-69685 Heap-based buffer overflow in Windows Kerberos allows an authorized attacker to... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69686 Stack-based buffer overflow in Microsoft Office Word allows an unauthorized atta... |
high | 8.8 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-17 |
| CVE-2026-69687 Integer underflow (wrap or wraparound) in Windows USB Audio Class driver (usbaud... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69688 Heap-based buffer overflow in Windows Encrypting File System (EFS) allows an aut... |
high | 7.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69676 Authentication bypass by capture-replay in Windows Kerberos allows an authorized... |
high | 8.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69678 Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to... |
high | 8.8 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-17 |
| CVE-2026-69680 Origin validation error in Windows DNS allows an unauthorized attacker to perfor... |
high | 8.1 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69681 Heap-based buffer overflow in Virtual Hard Disk (VHD) Miniport Driver allows an... |
high | 8.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69682 Use after free in Windows Host Guardian Service allows an authorized attacker to... |
high | 7.0 | — | Microsoft / windows 10 1809 | 2026-09-08 | 2026-09-22 |
| CVE-2026-69649 Heap-based buffer overflow in Windows Raw Image Extension allows an unauthorized... |
high | 8.8 | — | Microsoft / raw image extension | 2026-09-08 | 2026-09-22 |
| CVE-2026-69652 Use after free in Windows Win32K allows an authorized attacker to elevate privil... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-22 |
| CVE-2026-69654 Use after free in Windows Accounts Control allows an authorized attacker to elev... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-22 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.