September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,826
Low
527
Severity not reported
2,544
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), apache (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-69669 Heap-based buffer overflow in Windows Kernel allows an unauthorized attacker to... |
high | 8.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69671 Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attac... |
high | 8.8 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-17 |
| CVE-2026-69648 Use after free in Windows Notification allows an authorized attacker to elevate... |
high | 7.0 | — | Microsoft / windows 10 21h2 | 2026-09-08 | 2026-09-21 |
| CVE-2026-69638 Heap-based buffer overflow in Windows NTFS allows an unauthorized attacker to ex... |
high | 8.4 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69643 Heap-based buffer overflow in Windows Spaceport.sys allows an authorized attacke... |
high | 8.0 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69645 Use after free in Windows Message Queuing allows an authorized attacker to eleva... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69628 Heap-based buffer overflow in Windows iSCSI allows an authorized attacker to exe... |
high | 8.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69629 Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized at... |
high | 8.8 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-09 |
| CVE-2026-69630 Out-of-bounds read in Windows Win32K allows an authorized attacker to elevate pr... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69631 Integer overflow or wraparound in Windows DNS allows an unauthorized attacker to... |
high | 7.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69632 Use after free in Microsoft Office allows an unauthorized attacker to execute co... |
high | 8.8 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-17 |
| CVE-2026-69621 Heap-based buffer overflow in Windows Fax Service allows an authorized attacker... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69623 Heap-based buffer overflow in Windows HTTP Print Provider allows an authorized a... |
high | 8.0 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69625 Heap-based buffer overflow in Windows Connected User Experiences and Telemetry a... |
high | 8.8 | — | Microsoft / windows 10 1809 | 2026-09-08 | 2026-09-21 |
| CVE-2026-69614 Stack-based buffer overflow in Microsoft Office Access allows an unauthorized at... |
high | 8.8 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-10 |
| CVE-2026-69617 Out-of-bounds read in Windows Resilient File System (ReFS) allows an authorized... |
high | 7.0 | — | Microsoft / windows 11 26h1 | 2026-09-08 | 2026-09-21 |
| CVE-2026-69619 Out-of-bounds read in Windows exFAT File System allows an authorized attacker to... |
high | 8.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69620 Stack-based buffer overflow in Windows DHCP Server allows an unauthorized attack... |
high | 8.1 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69610 Buffer over-read in Windows Win32K allows an authorized attacker to elevate priv... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69611 Use after free in Virtual Hard Disk (VHD) Miniport Driver allows an authorized a... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-29 |
| CVE-2026-69612 Absolute path traversal in Windows Error Reporting allows an authorized attacker... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69613 Use after free in Windows Image Acquisition allows an authorized attacker to ele... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69602 Use after free in Windows PrintWorkflowUserSvc allows an authorized attacker to... |
high | 7.5 | — | Microsoft / windows 10 1809 | 2026-09-08 | 2026-09-21 |
| CVE-2026-69603 Heap-based buffer overflow in Windows Hyper-V allows an authorized attacker to e... |
high | 8.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69604 Heap-based buffer overflow in Windows Audio Service allows an authorized attacke... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69605 Use after free in Microsoft Install Service allows an authorized attacker to ele... |
high | 7.0 | — | Microsoft / windows 10 21h2 | 2026-09-08 | 2026-09-29 |
| CVE-2026-69606 Use after free in Windows Shell allows an authorized attacker to elevate privile... |
high | 7.0 | — | Microsoft / windows 11 23h2 | 2026-09-08 | 2026-09-21 |
| CVE-2026-69607 Use after free in Windows Deployment Services allows an unauthorized attacker to... |
high | 7.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69608 Integer overflow or wraparound in Microsoft Windows Search Component allows an a... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69597 Use after free in Windows HTTP.sys allows an authorized attacker to elevate priv... |
high | 7.5 | — | Microsoft / windows 11 23h2 | 2026-09-08 | 2026-09-21 |
| CVE-2026-69598 Incorrect calculation of buffer size in Windows iSCSI allows an unauthorized att... |
high | 8.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69599 Use after free in Windows Remote Desktop Services allows an authorized attacker... |
high | 7.5 | — | Microsoft / windows 11 23h2 | 2026-09-08 | 2026-09-14 |
| CVE-2026-69600 Use after free in Microsoft Windows Search Component allows an authorized attack... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69601 Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unaut... |
high | 8.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69588 Missing release of memory after effective lifetime in Windows TCP/IP allows an u... |
high | 7.5 | — | Microsoft / windows 11 23h2 | 2026-09-08 | 2026-09-18 |
| CVE-2026-69589 Heap-based buffer overflow in Windows Biometric Service allows an authorized att... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-11 |
| CVE-2026-69592 Heap-based buffer overflow in Windows Universal Disk Format File System Driver (... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69593 Heap-based buffer overflow in Windows Biometric Service allows an authorized att... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-11 |
| CVE-2026-69594 Heap-based buffer overflow in Microsoft Local Security Authority Server (lsasrv)... |
high | 7.8 | — | Microsoft / windows 11 24h2 | 2026-09-08 | 2026-10-01 |
| CVE-2026-69583 Heap-based buffer overflow in Windows Biometric Service allows an authorized att... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-11 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.