September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,826
Low
527
Severity not reported
2,544
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), apache (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-55946 Ai command injection in Microsoft Copilot allows an unauthorized attacker to dis... |
medium | 5.9 | — | Microsoft / copilot | 2026-09-17 | 2026-10-14 |
| CVE-2026-77490 Improper neutralization of input during web page generation ('cross-site scripti... |
medium | 6.1 | — | Microsoft / edge chromium | 2026-09-11 | 2026-09-25 |
| CVE-2026-69642 Improper neutralization of input during web page generation ('cross-site scripti... |
medium | 6.1 | — | Microsoft / skype for business server | 2026-09-08 | 2026-09-16 |
| CVE-2026-66306 Generation of error message containing sensitive information in Skype for Busine... |
medium | 6.5 | — | Microsoft / skype for business server | 2026-09-08 | 2026-09-16 |
| CVE-2026-66308 Out-of-bounds read in Skype for Business allows an authorized attacker to deny s... |
medium | 6.5 | — | Microsoft / skype for business server | 2026-09-08 | 2026-09-16 |
| CVE-2026-63523 Improper neutralization of input during web page generation ('cross-site scripti... |
medium | 6.1 | — | Microsoft / skype for business server | 2026-09-08 | 2026-09-16 |
| CVE-2026-66303 Null pointer dereference in Skype for Business allows an authorized attacker to... |
medium | 6.5 | — | Microsoft / skype for business server | 2026-09-08 | 2026-09-16 |
| CVE-2026-85875 Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to... |
medium | 5.5 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-17 |
| CVE-2026-83991 Missing authentication for critical function in Windows Cloud Files Mini Filter... |
medium | 5.5 | — | Microsoft / windows 10 1809 | 2026-09-08 | 2026-09-09 |
| CVE-2026-83949 Buffer over-read in Microsoft Office Word allows an unauthorized attacker to dis... |
medium | 5.5 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-08 |
| CVE-2026-83951 Buffer over-read in Microsoft Office Word allows an unauthorized attacker to dis... |
medium | 5.5 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-08 |
| CVE-2026-83501 Out-of-bounds read in Windows Virtualization-Based Security (VBS) Enclave allows... |
medium | 5.5 | — | Microsoft / windows 11 23h2 | 2026-09-08 | 2026-09-10 |
| CVE-2026-81958 Use of uninitialized resource in Microsoft Office Excel allows an unauthorized a... |
medium | 5.5 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-17 |
| CVE-2026-81395 Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to... |
medium | 5.5 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-17 |
| CVE-2026-81399 Buffer over-read in Microsoft Office Excel allows an unauthorized attacker to di... |
medium | 5.5 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-17 |
| CVE-2026-81400 Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to... |
medium | 5.5 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-17 |
| CVE-2026-81401 Access of resource using incompatible type ('type confusion') in Microsoft Offic... |
medium | 5.5 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-17 |
| CVE-2026-81390 Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to... |
medium | 5.5 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-17 |
| CVE-2026-81391 Use of uninitialized resource in Microsoft Office Excel allows an unauthorized a... |
medium | 5.5 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-17 |
| CVE-2026-81392 Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to... |
medium | 5.5 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-17 |
| CVE-2026-81393 Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to... |
medium | 5.5 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-17 |
| CVE-2026-81394 Exposure of sensitive system information to an unauthorized control sphere in Mi... |
medium | 5.5 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-17 |
| CVE-2026-81380 Improper neutralization of special elements used in a command ('command injectio... |
medium | 5.9 | — | Microsoft / visual studio code | 2026-09-08 | 2026-09-23 |
| CVE-2026-81387 Exposure of sensitive system information to an unauthorized control sphere in Mi... |
medium | 5.5 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-17 |
| CVE-2026-81377 Improper limitation of a pathname to a restricted directory ('path traversal') i... |
medium | 6.5 | — | Microsoft / visual studio code | 2026-09-08 | 2026-09-11 |
| CVE-2026-80086 Out-of-bounds read in Microsoft Office PowerPoint allows an unauthorized attacke... |
medium | 6.5 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-17 |
| CVE-2026-80087 Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker t... |
medium | 6.5 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-17 |
| CVE-2026-80088 Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to d... |
medium | 6.5 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-17 |
| CVE-2026-80089 Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclo... |
medium | 6.5 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-17 |
| CVE-2026-80090 Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to d... |
medium | 6.5 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-17 |
| CVE-2026-80091 Use of uninitialized resource in Microsoft Office allows an unauthorized attacke... |
medium | 6.5 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-17 |
| CVE-2026-80079 Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to d... |
medium | 6.5 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-08 |
| CVE-2026-80082 Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclo... |
medium | 6.5 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-17 |
| CVE-2026-80084 Out-of-bounds read in Microsoft Office Outlook allows an unauthorized attacker t... |
medium | 6.5 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-10 |
| CVE-2026-80073 Out-of-bounds read in Microsoft Office Outlook allows an unauthorized attacker t... |
medium | 6.5 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-09 |
| CVE-2026-80076 Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclo... |
medium | 6.5 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-17 |
| CVE-2026-80078 Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclo... |
medium | 6.5 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-17 |
| CVE-2026-78520 Out-of-bounds read in Microsoft Office Outlook allows an unauthorized attacker t... |
medium | 6.5 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-17 |
| CVE-2026-78522 Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to d... |
medium | 6.5 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-08 |
| CVE-2026-78513 Out-of-bounds read in Microsoft Office PowerPoint allows an unauthorized attacke... |
medium | 5.5 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-17 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.