September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,186
Critical
1,210
High
4,308
Medium
4,071
Low
456
Severity not reported
1,141
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (605), oracle (274), apple (244), adobe (197), dell (137), ibm (104), arubanetworks (101), mongodb (64), apache (53)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-69415 Missing authentication for critical function in Windows DHCP Server allows an au... |
medium | 6.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69416 Buffer over-read in Windows DHCP Server allows an authorized attacker to deny se... |
medium | 5.7 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69406 Exposure of sensitive system information to an unauthorized control sphere in Wi... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69405 Missing release of memory after effective lifetime in Windows DHCP Server allows... |
medium | 5.7 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69381 Out-of-bounds read in Windows Storage Port Driver allows an unauthorized attacke... |
medium | 4.6 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69372 Out-of-bounds read in Windows Network File System allows an authorized attacker... |
medium | 5.7 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69373 Integer overflow or wraparound in Windows Overlay Filter allows an authorized at... |
medium | 6.7 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69369 Out-of-bounds read in Windows DNS allows an authorized attacker to disclose info... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69349 Use of uninitialized resource in Windows Management Instrumentation allows an au... |
medium | 5.7 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69350 Heap-based buffer overflow in Windows Overlay Filter allows an authorized attack... |
medium | 6.7 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69351 Exposure of private personal information to an unauthorized actor in Windows Uni... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69353 Out-of-bounds read in Windows Text Shaping allows an authorized attacker to disc... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69343 Out-of-bounds read in Windows Overlay Filter allows an authorized attacker to di... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69321 Missing authentication for critical function in Windows Power Dependency Coordin... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69318 Out-of-bounds read in Windows Imaging Component allows an authorized attacker to... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69297 Storing passwords in a recoverable format in Windows DHCP Server allows an autho... |
medium | 6.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69286 Out-of-bounds read in Windows USB Audio Class driver (usbaudio.sys) allows an au... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69288 Use of uninitialized resource in Windows GDI+ allows an authorized attacker to d... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-68898 Out-of-bounds read in Windows iSCSI allows an unauthorized attacker to deny serv... |
medium | 6.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-68851 Buffer over-read in Windows NTFS allows an authorized attacker to disclose infor... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-68874 Out-of-bounds read in Windows Program Compatibility Assistant Service allows an... |
medium | 5.7 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-68833 Heap-based buffer overflow in Windows NTFS allows an unauthorized attacker to ex... |
medium | 6.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-68830 Improper link resolution before file access ('link following') in Windows Univer... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-68831 Files or directories accessible to external parties in Windows Defender Firewall... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-62801 Improper limitation of a pathname to a restricted directory ('path traversal') i... |
medium | 6.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-70575 Null pointer dereference in Windows Schannel allows an authorized attacker to de... |
medium | 6.5 | — | Microsoft / windows 11 23h2 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69531 Unintended proxy or intermediary ('confused deputy') in Microsoft Windows Speech... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-81380 Improper neutralization of special elements used in a command ('command injectio... |
medium | 5.9 | — | Microsoft / visual studio code | 2026-09-08 | 2026-09-23 |
| CVE-2026-78441 Out-of-bounds read in Windows OLE DB allows an unauthorized attacker to disclose... |
medium | 6.5 | — | Microsoft / sql server 2017 | 2026-09-08 | 2026-09-23 |
| CVE-2026-69771 Improper link resolution before file access ('link following') in Windows Contai... |
medium | 4.7 | — | Microsoft / windows 11 23h2 | 2026-09-08 | 2026-09-22 |
| CVE-2026-69792 Concurrent execution using shared resource with improper synchronization ('race... |
medium | 4.7 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-22 |
| CVE-2026-69794 Buffer over-read in Windows Encrypting File System (EFS) allows an authorized at... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-22 |
| CVE-2026-69674 Missing authentication for critical function in Windows Modern Device Management... |
medium | 5.5 | — | Microsoft / windows 10 1809 | 2026-09-08 | 2026-09-22 |
| CVE-2026-69741 Out-of-bounds read in Windows Spaceport.sys allows an authorized attacker to dis... |
medium | 5.5 | — | Microsoft / windows 10 21h2 | 2026-09-08 | 2026-09-22 |
| CVE-2026-72964 Missing authentication for critical function in Windows Internet Connection Shar... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-21 |
| CVE-2026-72945 Use of uninitialized resource in Windows Task Scheduler allows an authorized att... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-21 |
| CVE-2026-69393 Out-of-bounds read in Windows Spaceport.sys allows an authorized attacker to dis... |
medium | 5.7 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-21 |
| CVE-2026-69403 Missing authorization in Windows SMB Server allows an authorized attacker to dis... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-21 |
| CVE-2026-85875 Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to... |
medium | 5.5 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-17 |
| CVE-2026-81958 Use of uninitialized resource in Microsoft Office Excel allows an unauthorized a... |
medium | 5.5 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-17 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.