September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,826
Low
527
Severity not reported
2,544
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), apache (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-81959 Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized atta... |
high | 7.8 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-17 |
| CVE-2026-81960 Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized atta... |
high | 7.8 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-17 |
| CVE-2026-81947 Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized atta... |
high | 7.8 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-17 |
| CVE-2026-81948 Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized atta... |
high | 7.8 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-17 |
| CVE-2026-81949 Integer overflow or wraparound in Microsoft Office Excel allows an unauthorized... |
high | 7.8 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-17 |
| CVE-2026-81950 Double free in Microsoft Office Excel allows an unauthorized attacker to execute... |
high | 7.8 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-17 |
| CVE-2026-81951 Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized atta... |
high | 7.8 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-17 |
| CVE-2026-81952 Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attac... |
high | 8.8 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-17 |
| CVE-2026-81953 Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized att... |
high | 7.8 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-17 |
| CVE-2026-81954 Use after free in Microsoft Office Excel allows an unauthorized attacker to exec... |
high | 7.8 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-17 |
| CVE-2026-81396 Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized att... |
high | 7.8 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-17 |
| CVE-2026-81397 Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized atta... |
high | 7.8 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-17 |
| CVE-2026-81398 Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized atta... |
high | 7.8 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-17 |
| CVE-2026-81388 Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized att... |
high | 7.8 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-17 |
| CVE-2026-81389 Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized atta... |
high | 7.0 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-17 |
| CVE-2026-81378 Interpretation conflict in Visual Studio Code allows an unauthorized attacker to... |
high | 8.2 | — | Microsoft / visual studio code | 2026-09-08 | 2026-09-11 |
| CVE-2026-81379 Not failing securely ('failing open') in Visual Studio Code allows an unauthoriz... |
high | 8.2 | — | Microsoft / visual studio code | 2026-09-08 | 2026-09-11 |
| CVE-2026-81381 Insufficiently protected credentials in GitHub Copilot and Visual Studio Code al... |
high | 7.5 | — | Microsoft / visual studio code | 2026-09-08 | 2026-09-15 |
| CVE-2026-81383 Use of incorrectly-resolved name or reference in Visual Studio Code allows an un... |
high | 7.4 | — | Microsoft / visual studio code | 2026-09-08 | 2026-09-10 |
| CVE-2026-81385 Deserialization of untrusted data in Microsoft Office Publisher allows an unauth... |
high | 8.8 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-09 |
| CVE-2026-81386 Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized atta... |
high | 7.8 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-17 |
| CVE-2026-81353 Heap-based buffer overflow in Microsoft Windows Codecs Library allows an unautho... |
high | 7.8 | — | Microsoft / heif image extension | 2026-09-08 | 2026-09-17 |
| CVE-2026-81354 Heap-based buffer overflow in Windows Hello allows an authorized attacker to ele... |
high | 8.2 | — | Microsoft / windows 10 1809 | 2026-09-08 | 2026-09-10 |
| CVE-2026-81355 Heap-based buffer overflow in Virtual Hard Disk (VHD) Miniport Driver allows an... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-81356 Inconsistent interpretation of http requests ('http request/response smuggling')... |
high | 8.2 | — | Microsoft / visual studio code | 2026-09-08 | 2026-09-11 |
| CVE-2026-81357 Server-side request forgery (ssrf) in Visual Studio Code allows an unauthorized... |
high | 8.2 | — | Microsoft / visual studio code | 2026-09-08 | 2026-09-11 |
| CVE-2026-80097 Improper authentication in Microsoft Authenticator allows an unauthorized attack... |
high | 8.6 | — | Microsoft / authenticator | 2026-09-08 | 2026-09-24 |
| CVE-2026-81349 Improper neutralization of special elements used in an os command ('os command i... |
high | 7.2 | — | Microsoft / azure hdinsight | 2026-09-08 | 2026-09-23 |
| CVE-2026-81352 Heap-based buffer overflow in Microsoft Windows Codecs Library allows an unautho... |
high | 8.8 | — | Microsoft / web media extensions | 2026-09-08 | 2026-09-30 |
| CVE-2026-80093 Use after free in Windows Cloud Files Mini Filter Driver allows an authorized at... |
high | 7.0 | — | Microsoft / windows 10 1809 | 2026-09-08 | 2026-09-10 |
| CVE-2026-80096 Out-of-bounds read in Windows Remote Desktop Services allows an authorized attac... |
high | 8.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-80080 Double free in Microsoft Office Word allows an unauthorized attacker to execute... |
high | 8.8 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-17 |
| CVE-2026-80081 Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to... |
high | 8.8 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-09 |
| CVE-2026-80083 Untrusted pointer dereference in Windows Hyper-V allows an authorized attacker t... |
high | 8.8 | — | Microsoft / windows 11 23h2 | 2026-09-08 | 2026-09-10 |
| CVE-2026-80085 Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attac... |
high | 8.8 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-17 |
| CVE-2026-80074 Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attac... |
high | 8.8 | — | Microsoft / remote desktop client | 2026-09-08 | 2026-09-22 |
| CVE-2026-80075 Heap-based buffer overflow in Windows Work Folders allows an authorized attacker... |
high | 7.8 | — | Microsoft / windows 10 21h2 | 2026-09-08 | 2026-09-24 |
| CVE-2026-80077 Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attac... |
high | 8.8 | — | Microsoft / remote desktop client | 2026-09-08 | 2026-09-22 |
| CVE-2026-78524 Out-of-bounds write in Microsoft Office allows an unauthorized attacker to execu... |
high | 8.8 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-17 |
| CVE-2026-78525 Use after free in Microsoft Office Outlook allows an unauthorized attacker to ex... |
high | 8.8 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-17 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.