September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,833
Low
527
Severity not reported
2,537
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), linux (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-69538 Out-of-bounds read in Windows Spaceport.sys allows an authorized attacker to exe... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69528 Missing authentication for critical function in Windows Shell allows an authoriz... |
high | 7.8 | — | Microsoft / windows 11 23h2 | 2026-09-08 | 2026-09-23 |
| CVE-2026-69529 Heap-based buffer overflow in Microsoft Office Access allows an unauthorized att... |
high | 8.8 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-10 |
| CVE-2026-69530 Use after free in Reliable Multicast Transport Driver (RMCAST) allows an unautho... |
high | 8.1 | — | Microsoft / windows 10 1809 | 2026-09-08 | 2026-09-29 |
| CVE-2026-69516 Use after free in Connected Devices Platform Service (Cdpsvc) allows an authoriz... |
high | 7.0 | — | Microsoft / windows 10 1809 | 2026-09-08 | 2026-09-29 |
| CVE-2026-69517 Use after free in Windows Wireless Networking allows an authorized attacker to e... |
high | 7.0 | — | Microsoft / windows 10 1809 | 2026-09-08 | 2026-09-23 |
| CVE-2026-69518 Heap-based buffer overflow in Windows Remote Desktop allows an unauthorized atta... |
high | 8.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69522 Heap-based buffer overflow in Visual Studio allows an unauthorized attacker to e... |
high | 8.8 | — | — | 2026-09-08 | 2026-09-29 |
| CVE-2026-69524 Use after free in Active Directory Domain Services allows an unauthorized attack... |
high | 8.1 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-10-01 |
| CVE-2026-69509 Heap-based buffer overflow in Windows Fax Service allows an authorized attacker... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69510 Stack-based buffer overflow in Windows DHCP Server allows an unauthorized attack... |
high | 8.1 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69511 Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unaut... |
high | 8.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69512 Heap-based buffer overflow in Windows Spaceport.sys allows an authorized attacke... |
high | 8.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-23 |
| CVE-2026-69513 Heap-based buffer overflow in Windows Error Reporting allows an authorized attac... |
high | 7.8 | — | Microsoft / windows 10 1809 | 2026-09-08 | 2026-09-18 |
| CVE-2026-69514 Heap-based buffer overflow in Windows Remote Desktop Services allows an authoriz... |
high | 7.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69501 Untrusted pointer dereference in Windows Secure Kernel Mode allows an authorized... |
high | 7.0 | — | Microsoft / windows 10 21h2 | 2026-09-08 | 2026-09-14 |
| CVE-2026-69503 Stack-based buffer overflow in Windows USB Driver allows an authorized attacker... |
high | 8.0 | — | Microsoft / windows 10 1809 | 2026-09-08 | 2026-09-16 |
| CVE-2026-69505 Out-of-bounds read in Windows NTFS allows an authorized attacker to elevate priv... |
high | 8.0 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69508 Stack-based buffer overflow in Windows MIDI Service Module allows an authorized... |
high | 7.8 | — | Microsoft / windows 11 24h2 | 2026-09-08 | 2026-09-23 |
| CVE-2026-69495 Heap-based buffer overflow in Windows Event Logging Service allows an unauthoriz... |
high | 8.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-28 |
| CVE-2026-69498 Use after free in Windows Win32K allows an authorized attacker to elevate privil... |
high | 7.0 | — | Microsoft / windows 10 1809 | 2026-09-08 | 2026-09-28 |
| CVE-2026-69499 Integer overflow or wraparound in Windows Imaging Component allows an unauthoriz... |
high | 8.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-28 |
| CVE-2026-69500 Use after free in Windows Image Acquisition allows an authorized attacker to ele... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69489 Heap-based buffer overflow in Windows Biometric Service allows an authorized att... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-11 |
| CVE-2026-69492 Heap-based buffer overflow in Windows Partition Management Driver allows an auth... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-28 |
| CVE-2026-69494 Out-of-bounds read in Windows Event Logging Service allows an unauthorized attac... |
high | 8.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-28 |
| CVE-2026-69481 Heap-based buffer overflow in Windows Enterprise App Management allows an author... |
high | 8.0 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-28 |
| CVE-2026-69482 Creation of temporary file in directory with insecure permissions in Windows Err... |
high | 7.1 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-28 |
| CVE-2026-69485 Use of uninitialized resource in Remote Desktop Client allows an authorized atta... |
high | 8.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-29 |
| CVE-2026-69488 Use after free in Windows Device Association Service allows an authorized attack... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-28 |
| CVE-2026-69475 Untrusted pointer dereference in Windows Remote Desktop Services allows an autho... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69476 Heap-based buffer overflow in Windows Biometric Service allows an authorized att... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-11 |
| CVE-2026-69477 Heap-based buffer overflow in Microsoft Office Access allows an authorized attac... |
high | 7.3 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-10 |
| CVE-2026-69478 Heap-based buffer overflow in Windows Device Association Service allows an autho... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-28 |
| CVE-2026-69479 Heap-based buffer overflow in Windows NTFS allows an unauthorized attacker to ex... |
high | 8.4 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69480 Heap-based buffer overflow in Windows Partition Management Driver allows an auth... |
high | 7.8 | — | Microsoft / windows 10 21h2 | 2026-09-08 | 2026-09-28 |
| CVE-2026-69468 Heap-based buffer overflow in Windows Volume Manager Extension Driver allows an... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-28 |
| CVE-2026-69470 Use after free in Windows Connected User Experiences and Telemetry allows an aut... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-28 |
| CVE-2026-69472 Use after free in Windows Devices Human Interface allows an authorized attacker... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-28 |
| CVE-2026-69473 Use after free in Windows Kernel allows an authorized attacker to elevate privil... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.