September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,182
Critical
1,210
High
4,307
Medium
4,068
Low
456
Severity not reported
1,141
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (605), oracle (274), apple (244), adobe (197), dell (137), ibm (104), arubanetworks (101), mongodb (64), apache (53)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-81392 Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to... |
medium | 5.5 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-17 |
| CVE-2026-81393 Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to... |
medium | 5.5 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-17 |
| CVE-2026-81394 Exposure of sensitive system information to an unauthorized control sphere in Mi... |
medium | 5.5 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-17 |
| CVE-2026-81387 Exposure of sensitive system information to an unauthorized control sphere in Mi... |
medium | 5.5 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-17 |
| CVE-2026-80091 Use of uninitialized resource in Microsoft Office allows an unauthorized attacke... |
medium | 6.5 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-17 |
| CVE-2026-80086 Out-of-bounds read in Microsoft Office PowerPoint allows an unauthorized attacke... |
medium | 6.5 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-17 |
| CVE-2026-80087 Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker t... |
medium | 6.5 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-17 |
| CVE-2026-80088 Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to d... |
medium | 6.5 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-17 |
| CVE-2026-80089 Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclo... |
medium | 6.5 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-17 |
| CVE-2026-80090 Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to d... |
medium | 6.5 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-17 |
| CVE-2026-80076 Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclo... |
medium | 6.5 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-17 |
| CVE-2026-80078 Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclo... |
medium | 6.5 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-17 |
| CVE-2026-80082 Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclo... |
medium | 6.5 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-17 |
| CVE-2026-78515 Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to... |
medium | 6.5 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-17 |
| CVE-2026-78520 Out-of-bounds read in Microsoft Office Outlook allows an unauthorized attacker t... |
medium | 6.5 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-17 |
| CVE-2026-78506 Improper null termination in Microsoft Office Word allows an unauthorized attack... |
medium | 5.5 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-17 |
| CVE-2026-78513 Out-of-bounds read in Microsoft Office PowerPoint allows an unauthorized attacke... |
medium | 5.5 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-17 |
| CVE-2026-78502 Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to d... |
medium | 6.5 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-17 |
| CVE-2026-78503 Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to d... |
medium | 6.5 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-17 |
| CVE-2026-76854 Netcore NR255-V version 1.5.130703 contains a sensitive information disclosure v... |
medium | 6.5 | — | — | 2026-09-15 | 2026-09-17 |
| CVE-2026-76859 Netcore NR255-V version 1.5.130703 contains a sensitive information disclosure v... |
medium | 6.5 | — | — | 2026-09-15 | 2026-09-17 |
| CVE-2026-76864 NR255-V version 1.5.130703 fails to sanitize QoS rule names before they are pars... |
medium | 4.8 | — | — | 2026-09-15 | 2026-09-17 |
| CVE-2026-72975 Out-of-bounds read in Microsoft Office PowerPoint allows an unauthorized attacke... |
medium | 6.5 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-17 |
| CVE-2026-72976 Out-of-bounds read in Microsoft Office Word allows an authorized attacker to dis... |
medium | 5.0 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-17 |
| CVE-2026-72977 Out-of-bounds read in Microsoft Office PowerPoint allows an unauthorized attacke... |
medium | 6.5 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-17 |
| CVE-2026-72974 Buffer over-read in Microsoft Office Excel allows an unauthorized attacker to di... |
medium | 6.5 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-17 |
| CVE-2026-72938 Access of resource using incompatible type ('type confusion') in Microsoft Offic... |
medium | 6.5 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-17 |
| CVE-2026-69734 Integer overflow or wraparound in Microsoft Office Word allows an unauthorized a... |
medium | 6.5 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-17 |
| CVE-2026-69719 Buffer over-read in Microsoft Office Word allows an unauthorized attacker to dis... |
medium | 6.5 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-17 |
| CVE-2026-69626 Buffer over-read in Microsoft Office allows an unauthorized attacker to disclose... |
medium | 6.5 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-17 |
| CVE-2026-81320 A flaw was found in hawtio-operator. |
medium | 5.5 | — | — | 2026-09-15 | 2026-09-17 |
| CVE-2026-73443 On affected platforms running Arista EOS with VRRPv2 IP-AH authentication config... |
medium | 4.7 | — | — | 2026-09-16 | 2026-09-17 |
| CVE-2026-73457 Under certain circumstances on affected platforms running Arista EOS with gRPC N... |
medium | 5.3 | — | — | 2026-09-16 | 2026-09-17 |
| CVE-2026-73462 On affected platforms running Arista EOS with IGMP (Internet Group Management Pr... |
medium | 6.5 | — | — | 2026-09-16 | 2026-09-17 |
| CVE-2026-72980 Uncontrolled search path element in Windows Hello allows an authorized attacker... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-17 |
| CVE-2026-72999 Out-of-bounds read in Windows USB Hub Driver allows an unauthorized attacker to... |
medium | 6.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-17 |
| CVE-2026-73004 Missing authentication for critical function in Windows Autopilot allows an auth... |
medium | 5.5 | — | Microsoft / windows 10 21h2 | 2026-09-08 | 2026-09-17 |
| CVE-2026-91739 Missing authorization in Transactions Platform in Google Chrome prior to 153.0.8... |
medium | 4.2 | — | Google / chrome | 2026-09-15 | 2026-09-17 |
| CVE-2026-91740 Uninitialized resource in Skia in Google Chrome prior to 153.0.8010.47 allowed a... |
medium | 4.3 | — | Google / chrome | 2026-09-15 | 2026-09-17 |
| CVE-2026-91744 Race condition in PlatformIntegration in Google Chrome on on Mac prior to 153.0.... |
medium | 5.3 | — | Google / chrome | 2026-09-15 | 2026-09-17 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.