September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,186
Critical
1,210
High
4,308
Medium
4,071
Low
456
Severity not reported
1,141
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (605), oracle (274), apple (244), adobe (197), dell (137), ibm (104), arubanetworks (101), mongodb (64), apache (53)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-83979 Use after free in Windows Biometric Service allows an authorized attacker to ele... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-10 |
| CVE-2026-83952 Heap-based buffer overflow in Windows Resilient File System (ReFS) allows an aut... |
high | 7.8 | — | Microsoft / windows 11 24h2 | 2026-09-08 | 2026-09-10 |
| CVE-2026-83969 Heap-based buffer overflow in Windows Biometric Service allows an authorized att... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-10 |
| CVE-2026-80083 Untrusted pointer dereference in Windows Hyper-V allows an authorized attacker t... |
high | 8.8 | — | Microsoft / windows 11 23h2 | 2026-09-08 | 2026-09-10 |
| CVE-2026-80093 Use after free in Windows Cloud Files Mini Filter Driver allows an authorized at... |
high | 7.0 | — | Microsoft / windows 10 1809 | 2026-09-08 | 2026-09-10 |
| CVE-2026-81354 Heap-based buffer overflow in Windows Hello allows an authorized attacker to ele... |
high | 8.2 | — | Microsoft / windows 10 1809 | 2026-09-08 | 2026-09-10 |
| CVE-2026-83498 Untrusted pointer dereference in Windows Virtualization-Based Security (VBS) Enc... |
high | 7.8 | — | Microsoft / windows 11 23h2 | 2026-09-08 | 2026-09-10 |
| CVE-2026-83939 Untrusted pointer dereference in Windows Secure Kernel Mode allows an authorized... |
high | 8.2 | — | Microsoft / windows 11 26h1 | 2026-09-08 | 2026-09-10 |
| CVE-2026-83942 Missing authorization in Windows Kernel allows an authorized attacker to elevate... |
high | 7.8 | — | Microsoft / windows 10 1809 | 2026-09-08 | 2026-09-10 |
| CVE-2026-83968 Use after free in Windows Biometric Service allows an authorized attacker to ele... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-10 |
| CVE-2026-83940 Use after free in Windows Device Association Service allows an authorized attack... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-10 |
| CVE-2026-81383 Use of incorrectly-resolved name or reference in Visual Studio Code allows an un... |
high | 7.4 | — | Microsoft / visual studio code | 2026-09-08 | 2026-09-10 |
| CVE-2026-69778 Heap-based buffer overflow in Microsoft Office Access allows an unauthorized att... |
high | 8.8 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-10 |
| CVE-2026-77907 Heap-based buffer overflow in Visual Studio allows an unauthorized attacker to e... |
high | 8.8 | — | Microsoft / visual studio 2026 | 2026-09-08 | 2026-09-10 |
| CVE-2026-69614 Stack-based buffer overflow in Microsoft Office Access allows an unauthorized at... |
high | 8.8 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-10 |
| CVE-2026-69529 Heap-based buffer overflow in Microsoft Office Access allows an unauthorized att... |
high | 8.8 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-10 |
| CVE-2026-69477 Heap-based buffer overflow in Microsoft Office Access allows an authorized attac... |
high | 7.3 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-10 |
| CVE-2026-85877 Heap-based buffer overflow in Windows Print Spooler Components allows an unautho... |
high | 8.8 | — | Microsoft / windows 11 24h2 | 2026-09-08 | 2026-09-09 |
| CVE-2026-81385 Deserialization of untrusted data in Microsoft Office Publisher allows an unauth... |
high | 8.8 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-09 |
| CVE-2026-69742 Integer overflow or wraparound in Microsoft Office Publisher allows an unauthori... |
high | 8.8 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-09 |
| CVE-2026-69285 Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker t... |
high | 8.8 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-09 |
| CVE-2026-69442 Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker t... |
high | 8.8 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-09 |
| CVE-2026-69629 Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized at... |
high | 8.8 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-09 |
| CVE-2026-83975 Heap-based buffer overflow in Windows Biometric Service allows an authorized att... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-09 |
| CVE-2026-83986 Heap-based buffer overflow in Windows Biometric Service allows an authorized att... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-09 |
| CVE-2026-80081 Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to... |
high | 8.8 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-09 |
| CVE-2026-78519 Use of uninitialized resource in Microsoft Office Outlook allows an unauthorized... |
high | 8.8 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-09 |
| CVE-2026-69857 Authorization bypass through user-controlled key in Azure Cosmos DB allows an au... |
high | 8.8 | — | Microsoft / azure cosmos db | 2026-09-03 | 2026-09-09 |
| CVE-2026-69268 Improper access control in Microsoft Office SharePoint allows an authorized atta... |
high | 8.8 | — | Microsoft / sharepoint server | 2026-09-08 | 2026-09-09 |
| CVE-2026-69273 Improper access control in Microsoft Office SharePoint allows an authorized atta... |
high | 8.8 | — | Microsoft / sharepoint server | 2026-09-08 | 2026-09-09 |
| CVE-2026-69282 Improper access control in Microsoft Office SharePoint allows an authorized atta... |
high | 8.8 | — | Microsoft / sharepoint server | 2026-09-08 | 2026-09-09 |
| CVE-2026-69464 Execution with unnecessary privileges in Microsoft Office SharePoint allows an a... |
high | 8.8 | — | Microsoft / sharepoint server | 2026-09-08 | 2026-09-09 |
| CVE-2026-69465 Missing authorization in Microsoft Office SharePoint allows an authorized attack... |
high | 8.8 | — | Microsoft / sharepoint server | 2026-09-08 | 2026-09-09 |
| CVE-2026-78447 Heap-based buffer overflow in Windows Biometric Service allows an authorized att... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-09 |
| CVE-2026-69683 Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an auth... |
high | 7.7 | — | Microsoft / sharepoint server | 2026-09-08 | 2026-09-09 |
| CVE-2026-69716 Improper neutralization of special elements used in an sql command ('sql injecti... |
high | 8.8 | — | Microsoft / sharepoint server | 2026-09-08 | 2026-09-09 |
| CVE-2026-69724 Missing authorization in Microsoft Office SharePoint allows an authorized attack... |
high | 8.8 | — | Microsoft / sharepoint server | 2026-09-08 | 2026-09-09 |
| CVE-2026-69804 Time-of-check time-of-use (toctou) race condition in Microsoft Office SharePoint... |
high | 7.5 | — | Microsoft / sharepoint server | 2026-09-08 | 2026-09-09 |
| CVE-2026-69764 Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attac... |
high | 8.8 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-09 |
| CVE-2026-70178 Missing authorization in Microsoft Fabric allows an authorized attacker to eleva... |
high | 8.8 | — | Microsoft / fabric | 2026-09-03 | 2026-09-08 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.