September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,826
Low
527
Severity not reported
2,544
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), apache (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-85878 Improper authorization in Azure Database for PostgreSQL allows an authorized att... |
critical | 9.9 | — | Microsoft / azure horizondb | 2026-09-18 | 2026-09-25 |
| CVE-2026-69843 Authentication bypass by spoofing in Microsoft Fabric allows an unauthorized att... |
critical | 10.0 | — | Microsoft / fabric | 2026-09-18 | 2026-09-25 |
| CVE-2026-62874 Insufficient verification of data authenticity in Azure Billing allows an unauth... |
critical | 9.8 | — | Microsoft / azure billing | 2026-09-18 | 2026-10-07 |
| CVE-2026-85889 Missing authentication for critical function in Azure AI Foundry allows an unaut... |
critical | 9.8 | — | Microsoft / azure ai foundry | 2026-09-17 | 2026-09-25 |
| CVE-2026-87701 Improper neutralization of special elements in output used by a downstream compo... |
critical | 9.6 | — | Microsoft / azure cosmos db | 2026-09-17 | 2026-09-29 |
| CVE-2026-83944 Improper access control in Azure Logic Apps allows an unauthorized attacker to e... |
critical | 9.1 | — | Microsoft / azure logic apps | 2026-09-17 | 2026-09-25 |
| CVE-2026-70200 Improper limitation of a pathname to a restricted directory ('path traversal') i... |
critical | 9.8 | — | Microsoft / azure logic apps | 2026-09-17 | 2026-09-25 |
| CVE-2026-70009 Improper limitation of a pathname to a restricted directory ('path traversal') i... |
critical | 9.8 | — | Microsoft / azure arc | 2026-09-17 | 2026-09-25 |
| CVE-2026-69865 Authorization bypass through user-controlled key in Microsoft Container Registry... |
critical | 10.0 | — | Microsoft / azure container registry | 2026-09-17 | 2026-09-29 |
| CVE-2026-69399 Azure Arc Elevation of Privilege Vulnerability |
critical | 9.8 | — | Microsoft / azure arc | 2026-09-17 | 2026-09-25 |
| CVE-2026-66302 External control of file name or path in Skype for Business allows an unauthoriz... |
critical | 9.8 | — | Microsoft / skype for business server | 2026-09-08 | 2026-09-16 |
| CVE-2026-81376 Incomplete comparison with missing factors in Visual Studio Code allows an unaut... |
critical | 9.6 | — | Microsoft / visual studio code | 2026-09-08 | 2026-09-11 |
| CVE-2026-78509 Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized at... |
critical | 9.8 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-17 |
| CVE-2026-78445 Use after free in Windows Services for NFS ONCRPC XDR Driver allows an unauthori... |
critical | 9.8 | — | Microsoft / windows server 2012 | 2026-09-08 | 2026-09-24 |
| CVE-2026-77493 Double free in Microsoft Graphics Component allows an unauthorized attacker to e... |
critical | 9.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-73025 Weak authentication in Windows iSCSI allows an unauthorized attacker to bypass a... |
critical | 9.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-73009 Use after free in Windows Secure Socket Tunneling Protocol (SSTP) allows an unau... |
critical | 9.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-73010 Use after free in Windows Failover Cluster allows an unauthorized attacker to ex... |
critical | 9.8 | — | Microsoft / windows 10 1809 | 2026-09-08 | 2026-09-17 |
| CVE-2026-72983 Use after free in Windows Internet Connection Sharing (ICS) allows an unauthoriz... |
critical | 9.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-72979 Use after free in Windows DHCP Server allows an unauthorized attacker to execute... |
critical | 9.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-72982 Stack-based buffer overflow in Windows Netlogon allows an unauthorized attacker... |
critical | 9.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-72950 Remote Code Execution in Windows Routing and Remote Access Service (RRAS) allows... |
critical | 9.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-70296 Out-of-bounds write in Windows Imaging Component allows an unauthorized attacker... |
critical | 9.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69910 Stack-based buffer overflow in Windows Hyper-V allows an unauthorized attacker t... |
critical | 9.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-16 |
| CVE-2026-69845 Heap-based buffer overflow in Windows DHCP Server allows an unauthorized attacke... |
critical | 9.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69824 Integer underflow (wrap or wraparound) in Microsoft Standard XPS allows an unaut... |
critical | 9.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69829 Heap-based buffer overflow in Windows Shell allows an unauthorized attacker to e... |
critical | 9.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69819 Out-of-bounds write in RPC Runtime allows an unauthorized attacker to execute co... |
critical | 9.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69769 Heap-based buffer overflow in Windows HTTP Print Provider allows an unauthorized... |
critical | 9.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69768 Heap-based buffer overflow in Windows RNDIS allows an unauthorized attacker to e... |
critical | 9.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69730 Use after free in Windows DNS allows an unauthorized attacker to execute code ov... |
critical | 9.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69715 Out-of-bounds read in Windows Direct Show allows an unauthorized attacker to exe... |
critical | 9.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69641 Missing authorization in Microsoft Exchange Server allows an authorized attacker... |
critical | 9.1 | — | Microsoft / exchange server | 2026-09-08 | 2026-09-22 |
| CVE-2026-69595 Use after free in Windows Services for NFS ONCRPC XDR Driver allows an unauthori... |
critical | 9.8 | — | Microsoft / windows server 2012 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69590 Remote Code Execution in Windows Routing and Remote Access Service (RRAS) allows... |
critical | 9.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69586 Integer overflow or wraparound in Microsoft Windows PDF allows an unauthorized a... |
critical | 9.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-21 |
| CVE-2026-69579 Use after free in Windows Message Queuing allows an unauthorized attacker to exe... |
critical | 9.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69525 Use after free in Windows Remote Desktop Services allows an unauthorized attacke... |
critical | 9.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69496 Heap-based buffer overflow in Windows Compressed Folder allows an unauthorized a... |
critical | 9.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69491 Heap-based buffer overflow in Windows Microsoft DirectMusic allows an unauthoriz... |
critical | 9.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.