September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,826
Low
527
Severity not reported
2,544
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), apache (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-72940 Heap-based buffer overflow in Windows Schannel allows an unauthorized attacker t... |
high | 8.8 | — | Microsoft / windows 11 23h2 | 2026-09-08 | 2026-09-22 |
| CVE-2026-72928 Use after free in Windows DNS allows an authorized attacker to execute code over... |
high | 7.5 | — | Microsoft / windows server 2025 | 2026-09-08 | 2026-09-16 |
| CVE-2026-72929 Improper validation of integrity check value in Windows Installer allows an auth... |
high | 7.8 | — | Microsoft / windows 11 23h2 | 2026-09-08 | 2026-09-22 |
| CVE-2026-72930 Use after free in Windows Secure Socket Tunneling Protocol (SSTP) allows an auth... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-72932 Buffer over-read in Windows Message Queuing Queue Manager allows an unauthorized... |
high | 7.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-72933 Heap-based buffer overflow in Microsoft WDAC OLE DB provider for SQL allows an u... |
high | 8.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-71353 Double free in Windows Routing and Remote Access Service (RRAS) allows an author... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-72926 Use after free in Windows Internet Connection Sharing (ICS) allows an authorized... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-22 |
| CVE-2026-72927 Heap-based buffer overflow in Winsock allows an authorized attacker to elevate p... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-71351 Double free in Windows Routing and Remote Access Service (RRAS) allows an author... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-71352 Integer underflow (wrap or wraparound) in Windows Remote Access Connection Manag... |
high | 8.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-71342 Use after free in Windows Remote Access Connection Manager allows an authorized... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-71343 Heap-based buffer overflow in Windows Remote Access Connection Manager allows an... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-71345 Out-of-bounds write in Windows Spaceport.sys allows an authorized attacker to ex... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-71334 Heap-based buffer overflow in Windows NFS Portmapper allows an authorized attack... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-71336 Integer overflow or wraparound in Windows Work Folder Service allows an authoriz... |
high | 8.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-71337 Stack-based buffer overflow in Windows Storage Management Provider allows an aut... |
high | 7.8 | — | Microsoft / windows 10 21h2 | 2026-09-08 | 2026-09-15 |
| CVE-2026-71340 Use after free in Windows File History Service allows an authorized attacker to... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-15 |
| CVE-2026-71328 Heap-based buffer overflow in Visual Studio allows an unauthorized attacker to e... |
high | 8.8 | — | Microsoft / visual studio 2022 | 2026-09-08 | 2026-09-11 |
| CVE-2026-71330 Exposure of sensitive system information to an unauthorized control sphere in Wi... |
high | 7.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-71332 Use after free in Windows Secure Socket Tunneling Protocol (SSTP) allows an auth... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-16 |
| CVE-2026-71333 Use after free in Windows Remote Access Connection Manager allows an authorized... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-70583 Heap-based buffer overflow in Windows Core Messaging allows an authorized attack... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-28 |
| CVE-2026-70584 Access of resource using incompatible type ('type confusion') in Windows Core Me... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-23 |
| CVE-2026-70585 Use after free in Windows Services for NFS ONCRPC XDR Driver allows an authorize... |
high | 7.0 | — | Microsoft / windows server 2012 | 2026-09-08 | 2026-09-24 |
| CVE-2026-70586 Heap-based buffer overflow in Windows Paint allows an unauthorized attacker to e... |
high | 8.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-70587 Improper null termination in Windows Remote Desktop Protocol allows an unauthori... |
high | 7.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-70573 Heap-based buffer overflow in Windows Biometric Service allows an authorized att... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-11 |
| CVE-2026-70574 Out-of-bounds read in Virtual Hard Disk (VHD) Miniport Driver allows an authoriz... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-70577 Use after free in Windows Modern Device Management (MDM) allows an authorized at... |
high | 7.0 | — | Microsoft / windows 10 1809 | 2026-09-08 | 2026-09-24 |
| CVE-2026-70578 Heap-based buffer overflow in Windows Credential Guard allows an authorized atta... |
high | 7.0 | — | Microsoft / windows 10 21h2 | 2026-09-08 | 2026-09-24 |
| CVE-2026-70579 Out-of-bounds read in Windows Mobile Broadband allows an unauthorized attacker t... |
high | 7.5 | — | Microsoft / windows 10 21h2 | 2026-09-08 | 2026-09-24 |
| CVE-2026-70581 Integer overflow or wraparound in Windows Biometric Service allows an authorized... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-11 |
| CVE-2026-70565 Use after free in Windows AF_UNIX Socket Provider allows an authorized attacker... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-70567 Double free in Windows Display Enhancement Service allows an authorized attacker... |
high | 7.0 | — | Microsoft / windows 11 24h2 | 2026-09-08 | 2026-09-16 |
| CVE-2026-70568 Heap-based buffer overflow in Windows Defender Firewall Service allows an author... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-70569 Out-of-bounds read in Windows Spaceport.sys allows an authorized attacker to ele... |
high | 7.8 | — | Microsoft / windows 11 23h2 | 2026-09-08 | 2026-09-16 |
| CVE-2026-70570 Remote Code Execution in Windows Routing and Remote Access Service (RRAS) allows... |
high | 8.1 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-70572 Integer overflow or wraparound in Windows Biometric Service allows an authorized... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-11 |
| CVE-2026-70351 Integer overflow or wraparound in Microsoft WebP Image Extension allows an unaut... |
high | 8.8 | — | Microsoft / webp image extension | 2026-09-08 | 2026-09-29 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.