September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,186
Critical
1,210
High
4,308
Medium
4,071
Low
456
Severity not reported
1,141
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (605), oracle (274), apple (244), adobe (197), dell (137), ibm (104), arubanetworks (101), mongodb (64), apache (53)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-80083 Untrusted pointer dereference in Windows Hyper-V allows an authorized attacker t... |
high | 8.8 | — | Microsoft / windows 11 23h2 | 2026-09-08 | 2026-09-10 |
| CVE-2026-80093 Use after free in Windows Cloud Files Mini Filter Driver allows an authorized at... |
high | 7.0 | — | Microsoft / windows 10 1809 | 2026-09-08 | 2026-09-10 |
| CVE-2026-61686 SolidInvoice is an open-source invoicing platform. |
high | 7.5 | — | — | 2026-09-04 | 2026-09-10 |
| CVE-2026-19436 The Ultimate Gift Cards for WooCommerce WordPress plugin before 3.2.10 does not... |
high | 7.5 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-19439 The Ultimate Gift Cards for WooCommerce WordPress plugin before 3.2.10 does not... |
high | 7.5 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-77771 The miniOrange 2FA WordPress plugin before 6.3.1, miniOrange 2FA WordPress plugi... |
high | 7.5 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-81431 The Registration Form for WooCommerce WordPress plugin before 1.1.3 does not val... |
high | 7.2 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-82925 The Site Reviews WordPress plugin before 8.3.0 does not prevent request data fro... |
high | 8.1 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-9166 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') v... |
high | 7.5 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-81975 Acrobat Reader is affected by a Use After Free vulnerability that could result i... |
high | 7.8 | — | Adobe / acrobat | 2026-09-08 | 2026-09-10 |
| CVE-2026-81976 Acrobat Reader is affected by a Use After Free vulnerability that could result i... |
high | 7.8 | — | Adobe / acrobat | 2026-09-08 | 2026-09-10 |
| CVE-2026-81979 Acrobat Reader is affected by an out-of-bounds write vulnerability that could re... |
high | 7.8 | — | Adobe / acrobat | 2026-09-08 | 2026-09-10 |
| CVE-2026-81980 Acrobat Reader is affected by an out-of-bounds write vulnerability that could re... |
high | 7.8 | — | Adobe / acrobat | 2026-09-08 | 2026-09-10 |
| CVE-2026-81354 Heap-based buffer overflow in Windows Hello allows an authorized attacker to ele... |
high | 8.2 | — | Microsoft / windows 10 1809 | 2026-09-08 | 2026-09-10 |
| CVE-2026-83498 Untrusted pointer dereference in Windows Virtualization-Based Security (VBS) Enc... |
high | 7.8 | — | Microsoft / windows 11 23h2 | 2026-09-08 | 2026-09-10 |
| CVE-2026-83939 Untrusted pointer dereference in Windows Secure Kernel Mode allows an authorized... |
high | 8.2 | — | Microsoft / windows 11 26h1 | 2026-09-08 | 2026-09-10 |
| CVE-2026-81981 Acrobat Reader is affected by an out-of-bounds write vulnerability that could re... |
high | 7.8 | — | Adobe / acrobat | 2026-09-08 | 2026-09-10 |
| CVE-2026-81983 Acrobat Reader is affected by an out-of-bounds write vulnerability that could re... |
high | 7.8 | — | Adobe / acrobat | 2026-09-08 | 2026-09-10 |
| CVE-2026-81985 Acrobat Reader is affected by a Use After Free vulnerability that could result i... |
high | 7.8 | — | Adobe / acrobat | 2026-09-08 | 2026-09-10 |
| CVE-2026-83942 Missing authorization in Windows Kernel allows an authorized attacker to elevate... |
high | 7.8 | — | Microsoft / windows 10 1809 | 2026-09-08 | 2026-09-10 |
| CVE-2026-83968 Use after free in Windows Biometric Service allows an authorized attacker to ele... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-10 |
| CVE-2026-83940 Use after free in Windows Device Association Service allows an authorized attack... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-10 |
| CVE-2026-81383 Use of incorrectly-resolved name or reference in Visual Studio Code allows an un... |
high | 7.4 | — | Microsoft / visual studio code | 2026-09-08 | 2026-09-10 |
| CVE-2026-15019 The Direct Download for WooCommerce plugin for WordPress is vulnerable to Direct... |
high | 7.5 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-81986 Acrobat Reader is affected by a Use After Free vulnerability that could result i... |
high | 7.8 | — | Adobe / acrobat | 2026-09-08 | 2026-09-10 |
| CVE-2026-69778 Heap-based buffer overflow in Microsoft Office Access allows an unauthorized att... |
high | 8.8 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-10 |
| CVE-2026-77907 Heap-based buffer overflow in Visual Studio allows an unauthorized attacker to e... |
high | 8.8 | — | Microsoft / visual studio 2026 | 2026-09-08 | 2026-09-10 |
| CVE-2026-69614 Stack-based buffer overflow in Microsoft Office Access allows an unauthorized at... |
high | 8.8 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-10 |
| CVE-2026-69529 Heap-based buffer overflow in Microsoft Office Access allows an unauthorized att... |
high | 8.8 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-10 |
| CVE-2026-69477 Heap-based buffer overflow in Microsoft Office Access allows an authorized attac... |
high | 7.3 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-10 |
| CVE-2026-86666 A security flaw has been discovered in aircheng-org iWebShop-5 up to 5.15. |
high | 7.3 | — | — | 2026-09-08 | 2026-09-10 |
| CVE-2026-86722 AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains an authe... |
high | 8.1 | — | — | 2026-09-08 | 2026-09-10 |
| CVE-2026-86727 AVideo through 29.0 contains an information disclosure vulnerability in plugin/L... |
high | 7.5 | — | — | 2026-09-08 | 2026-09-10 |
| CVE-2026-86732 Craft CMS versions before 5.10.12 contain a remote code execution vulnerability... |
high | 8.8 | — | — | 2026-09-08 | 2026-09-10 |
| CVE-2026-76202 Adobe Commerce is affected by an Incorrect Authorization vulnerability that coul... |
high | 8.2 | — | Adobe / commerce | 2026-09-08 | 2026-09-10 |
| CVE-2026-61517 Netis NX10 firmware V4.0.1.5808 and V3.0.0.4142 contain an OS command injection... |
high | 7.2 | — | — | 2026-09-08 | 2026-09-10 |
| CVE-2026-81988 Acrobat Reader is affected by a Use After Free vulnerability that could result i... |
high | 7.8 | — | Adobe / acrobat | 2026-09-08 | 2026-09-10 |
| CVE-2026-81989 Acrobat Reader is affected by a Use After Free vulnerability that could result i... |
high | 7.8 | — | Adobe / acrobat | 2026-09-08 | 2026-09-10 |
| CVE-2026-81990 Acrobat Reader is affected by a Use After Free vulnerability that could result i... |
high | 7.8 | — | Adobe / acrobat | 2026-09-08 | 2026-09-10 |
| CVE-2026-87644 Incorrect authorization in Views in Google Chrome on on Windows prior to 153.0.8... |
high | 8.3 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.