September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,186
Critical
1,210
High
4,308
Medium
4,071
Low
456
Severity not reported
1,141
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (605), oracle (274), apple (244), adobe (197), dell (137), ibm (104), arubanetworks (101), mongodb (64), apache (53)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-69339 Exposure of sensitive system information to an unauthorized control sphere in Wi... |
medium | 5.5 | — | Microsoft / windows 11 24h2 | 2026-09-08 | 2026-09-17 |
| CVE-2026-69374 Allocation of resources without limits or throttling in Windows SMB Server allow... |
medium | 6.5 | — | Microsoft / windows 10 21h2 | 2026-09-08 | 2026-09-17 |
| CVE-2026-69390 Out-of-bounds read in Windows Spaceport.sys allows an authorized attacker to dis... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-17 |
| CVE-2026-69507 Insertion of sensitive information into externally-accessible file or directory... |
medium | 5.7 | — | Microsoft / windows 11 23h2 | 2026-09-08 | 2026-09-17 |
| CVE-2026-69267 Insufficient granularity of access control in Windows Connected User Experiences... |
medium | 6.5 | — | Microsoft / windows 10 1809 | 2026-09-08 | 2026-09-17 |
| CVE-2026-68886 Use after free in Windows Network Connection Broker allows an authorized attacke... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-17 |
| CVE-2026-68873 Insertion of sensitive information into log file in Windows Program Compatibilit... |
medium | 5.5 | — | Microsoft / windows 11 23h2 | 2026-09-08 | 2026-09-17 |
| CVE-2026-69820 Heap-based buffer overflow in Windows Hello allows an authorized attacker to ele... |
medium | 6.7 | — | Microsoft / windows 10 21h2 | 2026-09-08 | 2026-09-16 |
| CVE-2026-68849 Out-of-bounds read in Windows Bluetooth Port Driver allows an authorized attacke... |
medium | 4.7 | — | Microsoft / windows 10 21h2 | 2026-09-08 | 2026-09-16 |
| CVE-2026-69642 Improper neutralization of input during web page generation ('cross-site scripti... |
medium | 6.1 | — | Microsoft / skype for business server | 2026-09-08 | 2026-09-16 |
| CVE-2026-66308 Out-of-bounds read in Skype for Business allows an authorized attacker to deny s... |
medium | 6.5 | — | Microsoft / skype for business server | 2026-09-08 | 2026-09-16 |
| CVE-2026-66306 Generation of error message containing sensitive information in Skype for Busine... |
medium | 6.5 | — | Microsoft / skype for business server | 2026-09-08 | 2026-09-16 |
| CVE-2026-66303 Null pointer dereference in Skype for Business allows an authorized attacker to... |
medium | 6.5 | — | Microsoft / skype for business server | 2026-09-08 | 2026-09-16 |
| CVE-2026-63523 Improper neutralization of input during web page generation ('cross-site scripti... |
medium | 6.1 | — | Microsoft / skype for business server | 2026-09-08 | 2026-09-16 |
| CVE-2026-70019 Windows hard link in Windows Compressed Folder allows an unauthorized attacker t... |
medium | 6.5 | — | Microsoft / windows 11 23h2 | 2026-09-08 | 2026-09-16 |
| CVE-2026-69874 Untrusted pointer dereference in Windows ALPC allows an authorized attacker to e... |
medium | 6.4 | — | Microsoft / windows 10 1809 | 2026-09-08 | 2026-09-16 |
| CVE-2026-69862 Out-of-bounds read in Windows Wireless Wide Area Network Service allows an autho... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-16 |
| CVE-2026-69469 Integer overflow or wraparound in Windows USB Audio Class driver (usbaudio.sys)... |
medium | 6.6 | — | Microsoft / windows 10 1809 | 2026-09-08 | 2026-09-16 |
| CVE-2026-68842 Exposure of sensitive system information to an unauthorized control sphere in Wi... |
medium | 5.5 | — | Microsoft / windows 11 24h2 | 2026-09-08 | 2026-09-16 |
| CVE-2026-67633 Out-of-bounds read in SQL Server allows an authorized attacker to deny service o... |
medium | 6.5 | — | Microsoft / sql server 2017 | 2026-09-08 | 2026-09-16 |
| CVE-2026-67386 Use of uninitialized resource in SQL Server allows an authorized attacker to dis... |
medium | 6.5 | — | Microsoft / sql server 2017 | 2026-09-08 | 2026-09-16 |
| CVE-2026-67383 Generation of error message containing sensitive information in SQL Server allow... |
medium | 6.5 | — | Microsoft / sql server 2025 | 2026-09-08 | 2026-09-16 |
| CVE-2026-67369 Out-of-bounds read in SQL Server allows an authorized attacker to disclose infor... |
medium | 6.5 | — | Microsoft / sql server 2025 | 2026-09-08 | 2026-09-16 |
| CVE-2026-66816 Insufficient logging in SQL Server allows an authorized attacker to bypass a sec... |
medium | 6.5 | — | Microsoft / sql server 2022 | 2026-09-08 | 2026-09-16 |
| CVE-2026-68785 Heap-based buffer overflow in SQL Server allows an authorized attacker to execut... |
medium | 4.9 | — | Microsoft / sql server 2017 | 2026-09-08 | 2026-09-15 |
| CVE-2026-68784 Out-of-bounds read in SQL Server allows an authorized attacker to disclose infor... |
medium | 6.5 | — | Microsoft / sql server 2017 | 2026-09-08 | 2026-09-15 |
| CVE-2026-68781 Out-of-bounds read in SQL Server allows an authorized attacker to disclose infor... |
medium | 6.5 | — | Microsoft / sql server 2017 | 2026-09-08 | 2026-09-15 |
| CVE-2026-68780 Out-of-bounds read in SQL Server allows an authorized attacker to disclose infor... |
medium | 6.5 | — | Microsoft / sql server 2017 | 2026-09-08 | 2026-09-15 |
| CVE-2026-68779 Out-of-bounds read in SQL Server allows an authorized attacker to disclose infor... |
medium | 6.5 | — | Microsoft / sql server 2017 | 2026-09-08 | 2026-09-15 |
| CVE-2026-68778 Out-of-bounds read in SQL Server allows an authorized attacker to disclose infor... |
medium | 6.5 | — | Microsoft / sql server 2017 | 2026-09-08 | 2026-09-15 |
| CVE-2026-68777 Out-of-bounds read in SQL Server allows an authorized attacker to disclose infor... |
medium | 6.5 | — | Microsoft / sql server 2017 | 2026-09-08 | 2026-09-15 |
| CVE-2026-68776 Use of uninitialized resource in SQL Server allows an authorized attacker to dis... |
medium | 6.5 | — | Microsoft / sql server 2017 | 2026-09-08 | 2026-09-15 |
| CVE-2026-67648 Use of uninitialized resource in SQL Server allows an authorized attacker to dis... |
medium | 6.5 | — | Microsoft / sql server 2017 | 2026-09-08 | 2026-09-15 |
| CVE-2026-67645 Out-of-bounds read in SQL Server allows an authorized attacker to disclose infor... |
medium | 6.5 | — | Microsoft / sql server 2017 | 2026-09-08 | 2026-09-15 |
| CVE-2026-67641 Integer overflow or wraparound in SQL Server allows an authorized attacker to de... |
medium | 6.5 | — | Microsoft / sql server 2022 | 2026-09-08 | 2026-09-15 |
| CVE-2026-67393 Buffer over-read in SQL Server allows an authorized attacker to disclose informa... |
medium | 6.5 | — | Microsoft / sql server 2017 | 2026-09-08 | 2026-09-15 |
| CVE-2026-67390 Buffer over-read in SQL Server allows an authorized attacker to disclose informa... |
medium | 6.5 | — | Microsoft / sql server 2017 | 2026-09-08 | 2026-09-15 |
| CVE-2026-67389 Out-of-bounds read in SQL Server allows an authorized attacker to disclose infor... |
medium | 6.5 | — | Microsoft / sql server 2022 | 2026-09-08 | 2026-09-15 |
| CVE-2026-73029 Buffer over-read in SQL Server allows an authorized attacker to disclose informa... |
medium | 6.5 | — | Microsoft / sql server 2019 | 2026-09-08 | 2026-09-15 |
| CVE-2026-77488 Integer underflow (wrap or wraparound) in SQL Server allows an authorized attack... |
medium | 5.5 | — | Microsoft / sql server 2017 | 2026-09-08 | 2026-09-15 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.