September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,186
Critical
1,210
High
4,308
Medium
4,071
Low
456
Severity not reported
1,141
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (605), oracle (274), apple (244), adobe (197), dell (137), ibm (104), arubanetworks (101), mongodb (64), apache (53)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-69895 Out-of-bounds read in Windows Spaceport.sys allows an authorized attacker to dis... |
medium | 4.7 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69853 Use of uninitialized resource in Windows Win32K allows an authorized attacker to... |
medium | 4.7 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69839 Uncaught exception in Windows iSCSI Target Service allows an authorized attacker... |
medium | 6.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69832 Exposure of sensitive system information to an unauthorized control sphere in Wi... |
medium | 4.7 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69808 Out-of-bounds read in Windows Win32K allows an authorized attacker to disclose i... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69770 Use of uninitialized resource in Windows Spaceport.sys allows an authorized atta... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69723 Exposure of sensitive system information to an unauthorized control sphere in Wi... |
medium | 5.7 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69713 Dependency on vulnerable third-party component in Windows Secure Boot allows an... |
medium | 4.4 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69684 Generation of error message containing sensitive information in Windows Error Re... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69679 Out-of-bounds read in Windows DHCP Server allows an authorized attacker to deny... |
medium | 5.7 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69672 Use of uninitialized resource in Windows DNS allows an authorized attacker to di... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69637 Out-of-bounds read in Windows DHCP Server allows an authorized attacker to deny... |
medium | 5.7 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69624 Incomplete list of disallowed inputs in Active Directory Certificate Services (A... |
medium | 6.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69627 Out-of-bounds read in Windows Remote Desktop Licensing Service allows an authori... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69618 Out-of-bounds read in Windows SMB Client allows an authorized attacker to disclo... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69616 Out-of-bounds read in Windows Remote Desktop Services allows an authorized attac... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69568 Out-of-bounds read in Windows Storage Spaces Controller allows an authorized att... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69569 Untrusted pointer dereference in Windows Print Spooler Components allows an auth... |
medium | 5.7 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69572 Out-of-bounds read in Windows SMB Client allows an authorized attacker to disclo... |
medium | 5.7 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69566 Heap-based buffer overflow in Windows NTFS allows an unauthorized attacker to ex... |
medium | 6.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69552 Generation of error message containing sensitive information in Windows Print Sp... |
medium | 5.7 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69554 Missing authentication for critical function in Microsoft Windows Search Compone... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69548 Heap-based buffer overflow in Windows RNDIS allows an unauthorized attacker to d... |
medium | 4.6 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69527 Out-of-bounds read in Windows USB Mass Storage Class Driver allows an authorized... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69504 Out-of-bounds read in Windows NTFS allows an authorized attacker to disclose inf... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69497 Missing release of memory after effective lifetime in Windows DHCP Server allows... |
medium | 6.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69483 Out-of-bounds read in Windows Image Acquisition allows an authorized attacker to... |
medium | 4.7 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69490 Out-of-bounds read in Windows USB Mass Storage Class Driver allows an unauthoriz... |
medium | 6.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69474 Use after free in Windows Overlay Filter allows an authorized attacker to disclo... |
medium | 4.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69457 Out-of-bounds read in Windows USB Driver allows an authorized attacker to disclo... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69415 Missing authentication for critical function in Windows DHCP Server allows an au... |
medium | 6.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69416 Buffer over-read in Windows DHCP Server allows an authorized attacker to deny se... |
medium | 5.7 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69406 Exposure of sensitive system information to an unauthorized control sphere in Wi... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69405 Missing release of memory after effective lifetime in Windows DHCP Server allows... |
medium | 5.7 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69381 Out-of-bounds read in Windows Storage Port Driver allows an unauthorized attacke... |
medium | 4.6 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69372 Out-of-bounds read in Windows Network File System allows an authorized attacker... |
medium | 5.7 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69373 Integer overflow or wraparound in Windows Overlay Filter allows an authorized at... |
medium | 6.7 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69369 Out-of-bounds read in Windows DNS allows an authorized attacker to disclose info... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69349 Use of uninitialized resource in Windows Management Instrumentation allows an au... |
medium | 5.7 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69350 Heap-based buffer overflow in Windows Overlay Filter allows an authorized attack... |
medium | 6.7 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.