September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,186
Critical
1,210
High
4,308
Medium
4,071
Low
456
Severity not reported
1,141
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (605), oracle (274), apple (244), adobe (197), dell (137), ibm (104), arubanetworks (101), mongodb (64), apache (53)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-69425 Improper link resolution before file access ('link following') in Windows NTFS a... |
medium | 4.7 | — | Microsoft / windows 11 23h2 | 2026-09-08 | 2026-09-14 |
| CVE-2026-69591 Out-of-bounds read in Windows NTFS allows an authorized attacker to disclose inf... |
medium | 5.7 | — | Microsoft / windows 10 1809 | 2026-09-08 | 2026-09-14 |
| CVE-2026-81377 Improper limitation of a pathname to a restricted directory ('path traversal') i... |
medium | 6.5 | — | Microsoft / visual studio code | 2026-09-08 | 2026-09-11 |
| CVE-2026-78455 Out-of-bounds read in Xbox allows an unauthorized attacker to disclose informati... |
medium | 4.3 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-11 |
| CVE-2026-78451 Untrusted pointer dereference in Microsoft Windows SCSI Class System File allows... |
medium | 6.8 | — | Microsoft / windows 10 1809 | 2026-09-08 | 2026-09-11 |
| CVE-2026-78452 Out-of-bounds read in Microsoft Windows SCSI Class System File allows an unautho... |
medium | 4.6 | — | Microsoft / windows 10 1809 | 2026-09-08 | 2026-09-11 |
| CVE-2026-78454 Out-of-bounds read in Windows CD-ROM Driver allows an authorized attacker to dis... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-11 |
| CVE-2026-69615 Improper neutralization of input during web page generation ('cross-site scripti... |
medium | 4.8 | — | Microsoft / sharepoint server | 2026-09-08 | 2026-09-10 |
| CVE-2026-69402 Improper neutralization of input during web page generation ('cross-site scripti... |
medium | 5.4 | — | Microsoft / sharepoint server | 2026-09-08 | 2026-09-10 |
| CVE-2026-73008 Exposure of private personal information to an unauthorized actor in Windows Bio... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-10 |
| CVE-2026-69781 Missing release of memory after effective lifetime in Windows DHCP Client allows... |
medium | 6.5 | — | Microsoft / windows 11 24h2 | 2026-09-08 | 2026-09-10 |
| CVE-2026-72956 Untrusted pointer dereference in Microsoft Office PowerPoint allows an unauthori... |
medium | 6.5 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-10 |
| CVE-2026-83501 Out-of-bounds read in Windows Virtualization-Based Security (VBS) Enclave allows... |
medium | 5.5 | — | Microsoft / windows 11 23h2 | 2026-09-08 | 2026-09-10 |
| CVE-2026-80084 Out-of-bounds read in Microsoft Office Outlook allows an unauthorized attacker t... |
medium | 6.5 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-10 |
| CVE-2026-83991 Missing authentication for critical function in Windows Cloud Files Mini Filter... |
medium | 5.5 | — | Microsoft / windows 10 1809 | 2026-09-08 | 2026-09-09 |
| CVE-2026-69690 Improper neutralization of input during web page generation ('cross-site scripti... |
medium | 5.4 | — | Microsoft / sharepoint server | 2026-09-08 | 2026-09-09 |
| CVE-2026-80073 Out-of-bounds read in Microsoft Office Outlook allows an unauthorized attacker t... |
medium | 6.5 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-09 |
| CVE-2026-69409 Execution with unnecessary privileges in Microsoft Office SharePoint allows an a... |
medium | 6.5 | — | Microsoft / sharepoint server | 2026-09-08 | 2026-09-09 |
| CVE-2026-69417 Improper neutralization of input during web page generation ('cross-site scripti... |
medium | 5.4 | — | Microsoft / sharepoint server | 2026-09-08 | 2026-09-09 |
| CVE-2026-69636 Improper neutralization of special elements used in an sql command ('sql injecti... |
medium | 6.5 | — | Microsoft / sharepoint server | 2026-09-08 | 2026-09-09 |
| CVE-2026-78522 Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to d... |
medium | 6.5 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-08 |
| CVE-2026-80079 Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to d... |
medium | 6.5 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-08 |
| CVE-2026-83949 Buffer over-read in Microsoft Office Word allows an unauthorized attacker to dis... |
medium | 5.5 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-08 |
| CVE-2026-83951 Buffer over-read in Microsoft Office Word allows an unauthorized attacker to dis... |
medium | 5.5 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-08 |
| CVE-2026-69904 Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an auth... |
low | 3.5 | — | Microsoft / sharepoint server | 2026-09-08 | 2026-09-09 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.