September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,826
Low
527
Severity not reported
2,544
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), apache (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-72997 Heap-based buffer overflow in Windows Biometric Service allows an authorized att... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-11 |
| CVE-2026-73000 Heap-based buffer overflow in Windows Biometric Service allows an authorized att... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-11 |
| CVE-2026-73001 Heap-based buffer overflow in Windows Biometric Service allows an authorized att... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-10 |
| CVE-2026-73002 Integer overflow or wraparound in Windows Biometric Service allows an authorized... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-12 |
| CVE-2026-73003 Use after free in Windows Modern Device Management (MDM) allows an authorized at... |
high | 7.0 | — | Microsoft / windows 10 1809 | 2026-09-08 | 2026-09-17 |
| CVE-2026-72992 Heap-based buffer overflow in Windows Biometric Service allows an authorized att... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-11 |
| CVE-2026-72993 Heap-based buffer overflow in Windows Biometric Service allows an authorized att... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-11 |
| CVE-2026-72994 Heap-based buffer overflow in Windows Biometric Service allows an authorized att... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-11 |
| CVE-2026-72995 Heap-based buffer overflow in Windows Biometric Service allows an authorized att... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-10 |
| CVE-2026-72996 Heap-based buffer overflow in Windows Biometric Service allows an authorized att... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-12 |
| CVE-2026-72989 Use of uninitialized resource in Windows Failover Cluster allows an unauthorized... |
high | 7.5 | — | Microsoft / windows 10 1809 | 2026-09-08 | 2026-09-21 |
| CVE-2026-72990 Heap-based buffer overflow in Windows Biometric Service allows an authorized att... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-10 |
| CVE-2026-72991 Heap-based buffer overflow in Windows Biometric Service allows an authorized att... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-14 |
| CVE-2026-72986 Heap-based buffer overflow in Graphic Fonts allows an unauthorized attacker to e... |
high | 8.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-72987 Use after free in Windows DNS allows an unauthorized attacker to execute code ov... |
high | 8.1 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-72988 Heap-based buffer overflow in Windows Biometric Service allows an authorized att... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-11 |
| CVE-2026-72978 Allocation of resources without limits or throttling in Active Directory Federat... |
high | 7.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-72981 Use after free in IP Helper allows an unauthorized attacker to execute code over... |
high | 8.1 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-72972 Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attac... |
high | 8.8 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-17 |
| CVE-2026-72973 Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attac... |
high | 8.8 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-17 |
| CVE-2026-72962 Heap-based buffer overflow in Windows USB Video Driver allows an authorized atta... |
high | 8.2 | — | Microsoft / windows 10 1809 | 2026-09-08 | 2026-09-21 |
| CVE-2026-72963 Use after free in Windows Modern Execution Server allows an authorized attacker... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-17 |
| CVE-2026-72965 Use after free in Windows WebClient Service allows an authorized attacker to ele... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-72967 Heap-based buffer overflow in Windows Network Connection Broker allows an author... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-72957 Heap-based buffer overflow in Windows Deployment Services allows an authorized a... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-72958 Double free in Windows Credential Guard allows an authorized attacker to elevate... |
high | 8.2 | — | Microsoft / windows 11 24h2 | 2026-09-08 | 2026-09-21 |
| CVE-2026-72959 Remote Code Execution in Windows Routing and Remote Access Service (RRAS) allows... |
high | 8.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-72960 Heap-based buffer overflow in Windows Media Player allows an unauthorized attack... |
high | 8.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-21 |
| CVE-2026-72961 Out-of-bounds read in Windows Hyper-V allows an authorized attacker to elevate p... |
high | 8.2 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-21 |
| CVE-2026-72947 Integer underflow (wrap or wraparound) in Windows File History Service allows an... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-21 |
| CVE-2026-72948 Relative path traversal in Windows DNS allows an authorized attacker to elevate... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-72949 Null pointer dereference in Windows SMB Server Network Transport Driver (srvnet.... |
high | 7.5 | — | Microsoft / windows 11 23h2 | 2026-09-08 | 2026-09-21 |
| CVE-2026-72952 Out-of-bounds read in Windows Spaceport.sys allows an authorized attacker to exe... |
high | 7.0 | — | Microsoft / windows 10 1809 | 2026-09-08 | 2026-09-21 |
| CVE-2026-72953 Heap-based buffer overflow in Windows USB Driver allows an authorized attacker t... |
high | 7.8 | — | Microsoft / windows 10 21h2 | 2026-09-08 | 2026-09-21 |
| CVE-2026-72954 Use after free in Windows Deployment Services allows an authorized attacker to e... |
high | 7.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-72941 Heap-based buffer overflow in Windows Biometric Service allows an authorized att... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-11 |
| CVE-2026-72943 Use after free in Windows Deployment Services allows an authorized attacker to e... |
high | 7.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-72944 Heap-based buffer overflow in Windows Fax Service allows an authorized attacker... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-72946 Heap-based buffer overflow in Storage Port Driver allows an authorized attacker... |
high | 7.8 | — | Microsoft / windows 11 24h2 | 2026-09-08 | 2026-09-22 |
| CVE-2026-72936 Use after free in Windows SMB Client allows an unauthorized attacker to execute... |
high | 8.1 | — | Microsoft / windows 11 23h2 | 2026-09-08 | 2026-09-22 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.