September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,833
Low
527
Severity not reported
2,537
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), linux (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-68824 Concurrent execution using shared resource with improper synchronization ('race... |
high | 7.0 | — | Microsoft / windows 10 21h2 | 2026-09-08 | 2026-09-17 |
| CVE-2026-68825 Use after free in Windows Bind Filter Driver allows an authorized attacker to el... |
high | 7.0 | — | Microsoft / windows 11 23h2 | 2026-09-08 | 2026-09-17 |
| CVE-2026-68827 Integer underflow (wrap or wraparound) in Windows GDI+ allows an authorized atta... |
high | 8.0 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-68828 Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attac... |
high | 8.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-29 |
| CVE-2026-68786 Heap-based buffer overflow in SQL Server allows an authorized attacker to execut... |
high | 8.8 | — | Microsoft / sql server 2017 | 2026-09-08 | 2026-09-15 |
| CVE-2026-68787 Heap-based buffer overflow in SQL Server allows an authorized attacker to execut... |
high | 7.8 | — | Microsoft / sql server 2017 | 2026-09-08 | 2026-09-15 |
| CVE-2026-67638 Heap-based buffer overflow in SQL Server allows an authorized attacker to execut... |
high | 8.8 | — | Microsoft / sql server 2025 | 2026-09-08 | 2026-09-15 |
| CVE-2026-67639 Heap-based buffer overflow in SQL Server allows an authorized attacker to execut... |
high | 8.8 | — | Microsoft / sql server 2017 | 2026-09-08 | 2026-09-15 |
| CVE-2026-67642 Heap-based buffer overflow in SQL Server allows an authorized attacker to execut... |
high | 8.8 | — | Microsoft / sql server 2025 | 2026-09-08 | 2026-09-15 |
| CVE-2026-68775 Heap-based buffer overflow in SQL Server allows an authorized attacker to execut... |
high | 8.8 | — | Microsoft / sql server 2017 | 2026-09-08 | 2026-09-15 |
| CVE-2026-67385 Use after free in SQL Server allows an authorized attacker to execute code over... |
high | 8.8 | — | Microsoft / sql server 2017 | 2026-09-08 | 2026-09-16 |
| CVE-2026-67388 Heap-based buffer overflow in SQL Server allows an authorized attacker to execut... |
high | 8.8 | — | Microsoft / sql server 2017 | 2026-09-08 | 2026-09-16 |
| CVE-2026-67376 Integer overflow or wraparound in SQL Server allows an unauthorized attacker to... |
high | 7.5 | — | Microsoft / sql server 2017 | 2026-09-08 | 2026-09-16 |
| CVE-2026-67379 Stack-based buffer overflow in SQL Server allows an authorized attacker to execu... |
high | 8.5 | — | Microsoft / sql server 2019 | 2026-09-08 | 2026-09-16 |
| CVE-2026-67380 Heap-based buffer overflow in SQL Server allows an authorized attacker to execut... |
high | 8.8 | — | Microsoft / sql server 2017 | 2026-09-08 | 2026-09-16 |
| CVE-2026-67381 Heap-based buffer overflow in SQL Server allows an authorized attacker to elevat... |
high | 8.8 | — | Microsoft / sql server 2017 | 2026-09-08 | 2026-09-16 |
| CVE-2026-67384 Integer overflow or wraparound in SQL Server allows an authorized attacker to ex... |
high | 8.8 | — | Microsoft / sql server 2017 | 2026-09-08 | 2026-09-16 |
| CVE-2026-66818 Improper privilege management in SQL Server allows an authorized attacker to ele... |
high | 8.8 | — | Microsoft / sql server 2017 | 2026-09-08 | 2026-09-16 |
| CVE-2026-66819 Improper neutralization of special elements used in an sql command ('sql injecti... |
high | 8.8 | — | Microsoft / sql server 2017 | 2026-09-08 | 2026-09-16 |
| CVE-2026-66820 Improper neutralization of special elements used in an sql command ('sql injecti... |
high | 8.8 | — | Microsoft / sql server 2017 | 2026-09-08 | 2026-09-16 |
| CVE-2026-67368 Improper link resolution before file access ('link following') in SQL Server all... |
high | 8.8 | — | Microsoft / sql server 2017 | 2026-09-08 | 2026-09-15 |
| CVE-2026-67370 Improper neutralization of special elements used in an sql command ('sql injecti... |
high | 8.8 | — | Microsoft / sql server 2017 | 2026-09-08 | 2026-09-16 |
| CVE-2026-67373 Heap-based buffer overflow in SQL Server allows an authorized attacker to execut... |
high | 8.8 | — | Microsoft / sql server 2025 | 2026-09-08 | 2026-09-16 |
| CVE-2026-66814 Insufficient granularity of access control in SQL Server allows an authorized at... |
high | 8.8 | — | Microsoft / sql server 2017 | 2026-09-08 | 2026-09-16 |
| CVE-2026-65772 Deserialization of untrusted data in Microsoft Dynamics 365 allows an authorized... |
high | 8.8 | — | Microsoft / dynamics 365 | 2026-09-08 | 2026-10-07 |
| CVE-2026-62895 Permissive cross-domain policy with untrusted domains in Azure Arc allows an una... |
high | 8.8 | — | Microsoft / azure arc sql server extension | 2026-09-08 | 2026-10-20 |
| CVE-2026-62804 External control of file name or path in Microsoft Office Word allows an unautho... |
high | 7.8 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-08 |
| CVE-2026-62810 Heap-based buffer overflow in Active Directory Certificate Services (AD CS) allo... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-30 |
| CVE-2026-62813 Use after free in Active Directory Domain Services allows an authorized attacker... |
high | 7.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-30 |
| CVE-2026-62759 Authentication bypass by spoofing in Windows Netlogon allows an unauthorized att... |
high | 7.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-62744 Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unaut... |
high | 8.8 | — | Microsoft / windows 11 24h2 | 2026-09-08 | 2026-09-28 |
| CVE-2026-62706 Out-of-bounds read in Microsoft Windows Media Foundation allows an unauthorized... |
high | 8.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-62694 Use after free in Windows Installer allows an authorized attacker to elevate pri... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-62697 Use after free in Windows Push Notifications allows an authorized attacker to el... |
high | 7.8 | — | Microsoft / windows 10 21h2 | 2026-09-08 | 2026-09-17 |
| CVE-2026-58611 Improper authorization in XBox Gaming Services allows an authorized attacker to... |
high | 7.8 | — | Microsoft / xbox gaming services | 2026-09-08 | 2026-09-14 |
| CVE-2026-57099 Allocation of resources without limits or throttling in ASP.NET Core allows an u... |
high | 7.5 | — | Microsoft / asp.net core odata | 2026-09-08 | 2026-10-05 |
| CVE-2026-58599 Heap-based buffer overflow in Microsoft Windows Codecs Library allows an unautho... |
high | 7.8 | — | Microsoft / hevc video extensions | 2026-09-08 | 2026-10-01 |
| CVE-2026-58600 Heap-based buffer overflow in Microsoft Windows Codecs Library allows an unautho... |
high | 7.8 | — | Microsoft / hevc video extensions | 2026-09-08 | 2026-10-01 |
| CVE-2026-56172 Use after free in Windows VHD miniport driver allows an authorized attacker to e... |
high | 7.8 | — | Microsoft / windows 10 1809 | 2026-09-08 | 2026-09-17 |
| CVE-2026-56177 Use after free in Windows Server allows an authorized attacker to elevate privil... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-17 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.