September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,826
Low
527
Severity not reported
2,544
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), apache (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-69332 Out-of-bounds read in Windows NTFS allows an authorized attacker to elevate priv... |
high | 8.0 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69319 Concurrent execution using shared resource with improper synchronization ('race... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69322 Double free in Microsoft Windows Search Component allows an authorized attacker... |
high | 8.0 | — | Microsoft / windows 11 23h2 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69323 Heap-based buffer overflow in Windows Biometric Service allows an authorized att... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-10 |
| CVE-2026-69313 Heap-based buffer overflow in Microsoft Standard XPS allows an authorized attack... |
high | 7.1 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-30 |
| CVE-2026-69314 Use after free in Windows Device Association Broker service allows an authorized... |
high | 7.1 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-17 |
| CVE-2026-69309 Double free in Windows Print Spooler Components allows an authorized attacker to... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69310 Use after free in Windows DNS allows an authorized attacker to elevate privilege... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69311 Use after free in Windows Audio Service allows an authorized attacker to elevate... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69312 Out-of-bounds read in Windows NTFS allows an authorized attacker to elevate priv... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69305 Use after free in Microsoft Windows Search Component allows an authorized attack... |
high | 7.1 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69307 Heap-based buffer overflow in Windows USB Audio Class driver (usbaudio.sys) allo... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69296 Use after free in Windows Device Association Service allows an authorized attack... |
high | 7.1 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69298 Integer overflow or wraparound in Windows Biometric Service allows an authorized... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-10 |
| CVE-2026-69299 Use after free in Microsoft COM for Windows allows an authorized attacker to ele... |
high | 7.0 | — | Microsoft / windows 10 21h2 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69300 Use after free in Windows Push Notifications allows an authorized attacker to el... |
high | 7.0 | — | Microsoft / windows 11 23h2 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69301 Stack-based buffer overflow in Windows Win32K allows an authorized attacker to e... |
high | 8.0 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69290 Stack-based buffer overflow in Windows Storage Spaces Controller allows an autho... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69291 Heap-based buffer overflow in Windows Volume Manager Extension Driver allows an... |
high | 8.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69292 Double free in Remote Desktop Gateway Service allows an authorized attacker to e... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-30 |
| CVE-2026-69293 Heap-based buffer overflow in Windows Biometric Service allows an authorized att... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-14 |
| CVE-2026-69295 Out-of-bounds read in Windows USB Driver allows an authorized attacker to elevat... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69284 Heap-based buffer overflow in Windows DCOM Server allows an authorized attacker... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69285 Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker t... |
high | 8.8 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-09 |
| CVE-2026-69287 Use after free in Windows Remote Desktop Services allows an authorized attacker... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69289 Improper link resolution before file access ('link following') in Windows Setup... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69279 Use after free in Windows Cloud Files Mini Filter Driver allows an authorized at... |
high | 7.0 | — | Microsoft / windows 10 1809 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69280 Use after free in Windows Push Notifications allows an authorized attacker to el... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69281 Use after free in Windows License Manager allows an authorized attacker to eleva... |
high | 7.0 | — | Microsoft / windows 10 1809 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69282 Improper access control in Microsoft Office SharePoint allows an authorized atta... |
high | 8.8 | — | Microsoft / sharepoint server | 2026-09-08 | 2026-09-09 |
| CVE-2026-69283 Heap-based buffer overflow in Windows CD-ROM Driver allows an authorized attacke... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69277 Stack-based buffer overflow in Microsoft Local Security Authority Server (lsasrv... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-30 |
| CVE-2026-69273 Improper access control in Microsoft Office SharePoint allows an authorized atta... |
high | 8.8 | — | Microsoft / sharepoint server | 2026-09-08 | 2026-09-09 |
| CVE-2026-69274 Use after free in Windows Win32K allows an authorized attacker to elevate privil... |
high | 7.1 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69275 Use after free in Kernel Streaming WOW Thunk Service Driver allows an authorized... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-30 |
| CVE-2026-69268 Improper access control in Microsoft Office SharePoint allows an authorized atta... |
high | 8.8 | — | Microsoft / sharepoint server | 2026-09-08 | 2026-09-09 |
| CVE-2026-69269 Integer underflow (wrap or wraparound) in Microsoft Standard XPS allows an autho... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-30 |
| CVE-2026-69270 Heap-based buffer overflow in Windows USB Audio Class driver (usbaudio.sys) allo... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69271 Heap-based buffer overflow in Microsoft Standard XPS allows an authorized attack... |
high | 8.0 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-30 |
| CVE-2026-69272 Heap-based buffer overflow in Microsoft Standard XPS allows an authorized attack... |
high | 7.1 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-30 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.