September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,826
Low
527
Severity not reported
2,544
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), apache (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-69483 Out-of-bounds read in Windows Image Acquisition allows an authorized attacker to... |
medium | 4.7 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69469 Integer overflow or wraparound in Windows USB Audio Class driver (usbaudio.sys)... |
medium | 6.6 | — | Microsoft / windows 10 1809 | 2026-09-08 | 2026-09-16 |
| CVE-2026-69474 Use after free in Windows Overlay Filter allows an authorized attacker to disclo... |
medium | 4.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69457 Out-of-bounds read in Windows USB Driver allows an authorized attacker to disclo... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69449 Heap-based buffer overflow in Windows BitLocker allows an authorized attacker to... |
medium | 6.7 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-25 |
| CVE-2026-69453 Missing authorization in Microsoft Windows Search Component allows an authorized... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-25 |
| CVE-2026-69425 Improper link resolution before file access ('link following') in Windows NTFS a... |
medium | 4.7 | — | Microsoft / windows 11 23h2 | 2026-09-08 | 2026-09-14 |
| CVE-2026-69415 Missing authentication for critical function in Windows DHCP Server allows an au... |
medium | 6.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69416 Buffer over-read in Windows DHCP Server allows an authorized attacker to deny se... |
medium | 5.7 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69417 Improper neutralization of input during web page generation ('cross-site scripti... |
medium | 5.4 | — | Microsoft / sharepoint server | 2026-09-08 | 2026-09-09 |
| CVE-2026-69405 Missing release of memory after effective lifetime in Windows DHCP Server allows... |
medium | 5.7 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69406 Exposure of sensitive system information to an unauthorized control sphere in Wi... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69409 Execution with unnecessary privileges in Microsoft Office SharePoint allows an a... |
medium | 6.5 | — | Microsoft / sharepoint server | 2026-09-08 | 2026-09-09 |
| CVE-2026-69402 Improper neutralization of input during web page generation ('cross-site scripti... |
medium | 5.4 | — | Microsoft / sharepoint server | 2026-09-08 | 2026-09-10 |
| CVE-2026-69403 Missing authorization in Windows SMB Server allows an authorized attacker to dis... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-21 |
| CVE-2026-69393 Out-of-bounds read in Windows Spaceport.sys allows an authorized attacker to dis... |
medium | 5.7 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-21 |
| CVE-2026-69395 Use of externally-controlled format string in Active Directory Certificate Servi... |
medium | 6.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-29 |
| CVE-2026-69390 Out-of-bounds read in Windows Spaceport.sys allows an authorized attacker to dis... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-17 |
| CVE-2026-69382 Use of a broken or risky cryptographic algorithm in Microsoft Exchange Server al... |
medium | 5.9 | — | Microsoft / exchange server | 2026-09-08 | 2026-09-29 |
| CVE-2026-69375 Authorization bypass through user-controlled key in Microsoft Exchange Server al... |
medium | 6.5 | — | Microsoft / exchange server | 2026-09-08 | 2026-09-29 |
| CVE-2026-69376 Out-of-bounds read in Microsoft Standard XPS allows an authorized attacker to di... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-29 |
| CVE-2026-69381 Out-of-bounds read in Windows Storage Port Driver allows an unauthorized attacke... |
medium | 4.6 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69369 Out-of-bounds read in Windows DNS allows an authorized attacker to disclose info... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69372 Out-of-bounds read in Windows Network File System allows an authorized attacker... |
medium | 5.7 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69373 Integer overflow or wraparound in Windows Overlay Filter allows an authorized at... |
medium | 6.7 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69374 Allocation of resources without limits or throttling in Windows SMB Server allow... |
medium | 6.5 | — | Microsoft / windows 10 21h2 | 2026-09-08 | 2026-09-17 |
| CVE-2026-69367 Out-of-bounds read in Microsoft Standard XPS allows an authorized attacker to di... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-29 |
| CVE-2026-69361 Server-side request forgery (ssrf) in Microsoft Exchange Server allows an author... |
medium | 6.5 | — | Microsoft / exchange server | 2026-09-08 | 2026-09-29 |
| CVE-2026-69350 Heap-based buffer overflow in Windows Overlay Filter allows an authorized attack... |
medium | 6.7 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69351 Exposure of private personal information to an unauthorized actor in Windows Uni... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69353 Out-of-bounds read in Windows Text Shaping allows an authorized attacker to disc... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69344 Out-of-bounds read in Windows Print Spooler Components allows an authorized atta... |
medium | 5.5 | — | Microsoft / windows 10 21h2 | 2026-09-08 | 2026-09-17 |
| CVE-2026-69345 Out-of-bounds read in Microsoft Standard XPS allows an authorized attacker to di... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-30 |
| CVE-2026-69349 Use of uninitialized resource in Windows Management Instrumentation allows an au... |
medium | 5.7 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69339 Exposure of sensitive system information to an unauthorized control sphere in Wi... |
medium | 5.5 | — | Microsoft / windows 11 24h2 | 2026-09-08 | 2026-09-17 |
| CVE-2026-69343 Out-of-bounds read in Windows Overlay Filter allows an authorized attacker to di... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69318 Out-of-bounds read in Windows Imaging Component allows an authorized attacker to... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69321 Missing authentication for critical function in Windows Power Dependency Coordin... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69315 Exposure of sensitive system information to an unauthorized control sphere in Wi... |
medium | 5.5 | — | Microsoft / windows 10 1809 | 2026-09-08 | 2026-09-17 |
| CVE-2026-69316 Buffer over-read in Windows Overlay Filter allows an authorized attacker to disc... |
medium | 4.7 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-17 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.