September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,826
Low
527
Severity not reported
2,544
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), apache (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-69459 Heap-based buffer overflow in Windows Power Dependency Coordinator allows an aut... |
high | 7.8 | — | Microsoft / windows 10 1809 | 2026-09-08 | 2026-09-28 |
| CVE-2026-69460 Use after free in Windows Modern Device Management (MDM) allows an authorized at... |
high | 7.1 | — | Microsoft / windows 10 1809 | 2026-09-08 | 2026-09-28 |
| CVE-2026-69447 Heap-based buffer overflow in Windows Audio Service allows an authorized attacke... |
high | 7.8 | — | Microsoft / windows 11 23h2 | 2026-09-08 | 2026-09-25 |
| CVE-2026-69448 Concurrent execution using shared resource with improper synchronization ('race... |
high | 7.0 | — | Microsoft / windows 10 21h2 | 2026-09-08 | 2026-09-25 |
| CVE-2026-69450 Out-of-bounds read in Windows Error Reporting allows an authorized attacker to e... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69451 Use after free in Windows Management Instrumentation allows an authorized attack... |
high | 7.1 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-25 |
| CVE-2026-69440 Time-of-check time-of-use (toctou) race condition in Windows MIDI Service Module... |
high | 7.0 | — | Microsoft / windows 11 24h2 | 2026-09-08 | 2026-09-25 |
| CVE-2026-69441 Concurrent execution using shared resource with improper synchronization ('race... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-25 |
| CVE-2026-69442 Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker t... |
high | 8.8 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-09 |
| CVE-2026-69443 Out-of-bounds read in Microsoft Azure Attestation service and Device Health Atte... |
high | 7.5 | — | Microsoft / windows 10 1809 | 2026-09-08 | 2026-09-23 |
| CVE-2026-69444 Heap-based buffer overflow in Microsoft Windows Speech allows an authorized atta... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-25 |
| CVE-2026-69445 Improper limitation of a pathname to a restricted directory ('path traversal') i... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-25 |
| CVE-2026-69432 Heap-based buffer overflow in Volume Manager Driver allows an authorized attacke... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-29 |
| CVE-2026-69433 Heap-based buffer overflow in Windows Error Reporting allows an authorized attac... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-25 |
| CVE-2026-69434 Heap-based buffer overflow in Windows URL Moniker allows an unauthorized attacke... |
high | 8.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-25 |
| CVE-2026-69436 Heap-based buffer overflow in Windows State Repository Service allows an authori... |
high | 7.8 | — | Microsoft / windows 10 1809 | 2026-09-08 | 2026-10-07 |
| CVE-2026-69438 Incorrect conversion between numeric types in Microsoft JScript allows an unauth... |
high | 8.1 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-29 |
| CVE-2026-69439 Heap-based buffer overflow in .NET and Visual Studio allows an unauthorized atta... |
high | 8.8 | — | Microsoft / .net | 2026-09-08 | 2026-09-29 |
| CVE-2026-69426 Heap-based buffer overflow in Windows VOLSNAP.SYS allows an authorized attacker... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69427 Out-of-bounds read in Windows VOLSNAP.SYS allows an authorized attacker to eleva... |
high | 8.0 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69428 Out-of-bounds read in Windows LDAP - Lightweight Directory Access Protocol allow... |
high | 7.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69429 Heap-based buffer overflow in Windows IKE Extension allows an authorized attacke... |
high | 7.5 | — | Microsoft / windows 10 1809 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69430 Use after free in Windows Embedded Mode Service allows an authorized attacker to... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69420 Heap-based buffer overflow in Windows VOLSNAP.SYS allows an authorized attacker... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69421 Integer underflow (wrap or wraparound) in Windows Kernel Mode Driver allows an a... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69422 Use after free in Windows USB Video Driver allows an authorized attacker to elev... |
high | 7.0 | — | Microsoft / windows 11 24h2 | 2026-09-08 | 2026-09-16 |
| CVE-2026-69423 Heap-based buffer overflow in Windows USB Video Driver allows an authorized atta... |
high | 8.0 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69424 Heap-based buffer overflow in Windows Distributed File System (DFS) allows an au... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69413 Use after free in Windows USB Audio Class driver (usbaudio.sys) allows an author... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69418 Heap-based buffer overflow in Volume Manager Driver allows an authorized attacke... |
high | 8.0 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-29 |
| CVE-2026-69407 Integer overflow or wraparound in Volume Manager Driver allows an authorized att... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-29 |
| CVE-2026-69410 Use after free in Windows Win32K allows an authorized attacker to elevate privil... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69412 Stack-based buffer overflow in Windows DHCP Server allows an authorized attacker... |
high | 8.0 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69397 Use after free in OpenSSH for Windows allows an unauthorized attacker to execute... |
high | 7.5 | — | Microsoft / windows 10 1809 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69398 Concurrent execution using shared resource with improper synchronization ('race... |
high | 7.0 | — | Microsoft / windows 10 1809 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69401 Use after free in Audio Video Control Transport Protocol allows an authorized at... |
high | 7.0 | — | Microsoft / windows 11 24h2 | 2026-09-08 | 2026-09-29 |
| CVE-2026-69404 Concurrent execution using shared resource with improper synchronization ('race... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69391 Stack-based buffer overflow in Windows Broker Infrastructure Service allows an a... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-25 |
| CVE-2026-69392 Use after free in Windows Shell allows an authorized attacker to elevate privile... |
high | 7.8 | — | Microsoft / windows 11 23h2 | 2026-09-08 | 2026-09-25 |
| CVE-2026-69394 Heap-based buffer overflow in Windows Audio Service allows an authorized attacke... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-25 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.