September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,826
Low
527
Severity not reported
2,544
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), apache (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-78515 Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to... |
medium | 6.5 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-17 |
| CVE-2026-78516 Insertion of sensitive information into externally-accessible file or directory... |
medium | 4.3 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-25 |
| CVE-2026-78502 Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to d... |
medium | 6.5 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-17 |
| CVE-2026-78503 Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to d... |
medium | 6.5 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-17 |
| CVE-2026-78506 Improper null termination in Microsoft Office Word allows an unauthorized attack... |
medium | 5.5 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-17 |
| CVE-2026-78508 Out-of-bounds read in Windows CD-ROM Driver allows an unauthorized attacker to d... |
medium | 4.6 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-78455 Out-of-bounds read in Xbox allows an unauthorized attacker to disclose informati... |
medium | 4.3 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-11 |
| CVE-2026-78451 Untrusted pointer dereference in Microsoft Windows SCSI Class System File allows... |
medium | 6.8 | — | Microsoft / windows 10 1809 | 2026-09-08 | 2026-09-11 |
| CVE-2026-78452 Out-of-bounds read in Microsoft Windows SCSI Class System File allows an unautho... |
medium | 4.6 | — | Microsoft / windows 10 1809 | 2026-09-08 | 2026-09-11 |
| CVE-2026-78453 Integer underflow (wrap or wraparound) in Microsoft Windows SCSI Class System Fi... |
medium | 6.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-78454 Out-of-bounds read in Windows CD-ROM Driver allows an authorized attacker to dis... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-11 |
| CVE-2026-77909 Insufficiently protected credentials in Azure CycleCloud allows an authorized at... |
medium | 6.5 | — | Microsoft / azure cyclecloud | 2026-09-08 | 2026-09-29 |
| CVE-2026-77911 Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to d... |
medium | 6.5 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-08 |
| CVE-2026-78441 Out-of-bounds read in Windows OLE DB allows an unauthorized attacker to disclose... |
medium | 6.5 | — | Microsoft / sql server 2017 | 2026-09-08 | 2026-09-23 |
| CVE-2026-77892 No cwe for this issue in Windows Boot Manager allows an unauthorized attacker to... |
medium | 6.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-77887 Out-of-bounds read in Windows DHCP Server allows an authorized attacker to execu... |
medium | 6.4 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-77891 Out-of-bounds read in Windows DHCP Server allows an authorized attacker to execu... |
medium | 6.4 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-77492 Out-of-bounds read in Storage Port Driver allows an authorized attacker to discl... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-28 |
| CVE-2026-77488 Integer underflow (wrap or wraparound) in SQL Server allows an authorized attack... |
medium | 5.5 | — | Microsoft / sql server 2017 | 2026-09-08 | 2026-09-15 |
| CVE-2026-77491 Out-of-bounds read in Windows GDI allows an unauthorized attacker to disclose in... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-73029 Buffer over-read in SQL Server allows an authorized attacker to disclose informa... |
medium | 6.5 | — | Microsoft / sql server 2019 | 2026-09-08 | 2026-09-15 |
| CVE-2026-73019 Improper resolution of path equivalence in Windows URL Moniker allows an unautho... |
medium | 4.3 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-73004 Missing authentication for critical function in Windows Autopilot allows an auth... |
medium | 5.5 | — | Microsoft / windows 10 21h2 | 2026-09-08 | 2026-09-17 |
| CVE-2026-73008 Exposure of private personal information to an unauthorized actor in Windows Bio... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-10 |
| CVE-2026-72999 Out-of-bounds read in Windows USB Hub Driver allows an unauthorized attacker to... |
medium | 6.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-17 |
| CVE-2026-72985 Heap-based buffer overflow in Windows Volume Shadow Copy allows an unauthorized... |
medium | 6.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-72977 Out-of-bounds read in Microsoft Office PowerPoint allows an unauthorized attacke... |
medium | 6.5 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-17 |
| CVE-2026-72980 Uncontrolled search path element in Windows Hello allows an authorized attacker... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-17 |
| CVE-2026-72974 Buffer over-read in Microsoft Office Excel allows an unauthorized attacker to di... |
medium | 6.5 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-17 |
| CVE-2026-72975 Out-of-bounds read in Microsoft Office PowerPoint allows an unauthorized attacke... |
medium | 6.5 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-17 |
| CVE-2026-72976 Out-of-bounds read in Microsoft Office Word allows an authorized attacker to dis... |
medium | 5.0 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-17 |
| CVE-2026-72964 Missing authentication for critical function in Windows Internet Connection Shar... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-21 |
| CVE-2026-72966 Missing authorization in Windows Remote Access Connection Manager allows an auth... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-72956 Untrusted pointer dereference in Microsoft Office PowerPoint allows an unauthori... |
medium | 6.5 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-10 |
| CVE-2026-72942 Out-of-bounds read in Windows Spaceport.sys allows an unauthorized attacker to d... |
medium | 6.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-72945 Use of uninitialized resource in Windows Task Scheduler allows an authorized att... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-21 |
| CVE-2026-72935 Out-of-bounds read in Windows NTFS allows an authorized attacker to elevate priv... |
medium | 6.7 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-72937 Out-of-bounds read in Storage Port Driver allows an authorized attacker to discl... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-72938 Access of resource using incompatible type ('type confusion') in Microsoft Offic... |
medium | 6.5 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-17 |
| CVE-2026-72939 Null pointer dereference in Windows Routing and Remote Access Service (RRAS) all... |
medium | 6.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.