September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,186
Critical
1,210
High
4,308
Medium
4,071
Low
456
Severity not reported
1,141
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (605), oracle (274), apple (244), adobe (197), dell (137), ibm (104), arubanetworks (101), mongodb (64), apache (53)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-78510 Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker t... |
high | 8.4 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-25 |
| CVE-2026-85892 Concurrent execution using shared resource with improper synchronization ('race... |
high | 7.8 | — | Microsoft / edge chromium | 2026-09-14 | 2026-09-25 |
| CVE-2026-68791 Incorrect authorization in Azure Machine Learning allows an unauthorized attacke... |
high | 7.5 | — | Microsoft / azure machine learning | 2026-09-17 | 2026-09-25 |
| CVE-2026-77903 Authentication bypass by spoofing in Microsoft Dataverse allows an unauthorized... |
high | 8.1 | — | Microsoft / dataverse | 2026-09-17 | 2026-09-25 |
| CVE-2026-85885 Improper neutralization of special elements used in a command ('command injectio... |
high | 8.8 | — | Microsoft / 365 copilot | 2026-09-17 | 2026-09-25 |
| CVE-2026-85917 Server-side request forgery (ssrf) in Azure AI Foundry allows an unauthorized at... |
high | 7.5 | — | Microsoft / foundry | 2026-09-17 | 2026-09-25 |
| CVE-2026-69486 Heap-based buffer overflow in Microsoft Edge (Chromium-based) allows an unauthor... |
high | 8.8 | — | Microsoft / edge chromium | 2026-09-15 | 2026-09-25 |
| CVE-2026-69389 Heap-based buffer overflow in Windows Storage Management Provider allows an auth... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-25 |
| CVE-2026-69391 Stack-based buffer overflow in Windows Broker Infrastructure Service allows an a... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-25 |
| CVE-2026-69392 Use after free in Windows Shell allows an authorized attacker to elevate privile... |
high | 7.8 | — | Microsoft / windows 11 23h2 | 2026-09-08 | 2026-09-25 |
| CVE-2026-69394 Heap-based buffer overflow in Windows Audio Service allows an authorized attacke... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-25 |
| CVE-2026-69396 Use after free in Windows NDIS allows an authorized attacker to elevate privileg... |
high | 7.1 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-25 |
| CVE-2026-69433 Heap-based buffer overflow in Windows Error Reporting allows an authorized attac... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-25 |
| CVE-2026-69434 Heap-based buffer overflow in Windows URL Moniker allows an unauthorized attacke... |
high | 8.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-25 |
| CVE-2026-69440 Time-of-check time-of-use (toctou) race condition in Windows MIDI Service Module... |
high | 7.0 | — | Microsoft / windows 11 24h2 | 2026-09-08 | 2026-09-25 |
| CVE-2026-69441 Concurrent execution using shared resource with improper synchronization ('race... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-25 |
| CVE-2026-69444 Heap-based buffer overflow in Microsoft Windows Speech allows an authorized atta... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-25 |
| CVE-2026-69445 Improper limitation of a pathname to a restricted directory ('path traversal') i... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-25 |
| CVE-2026-69447 Heap-based buffer overflow in Windows Audio Service allows an authorized attacke... |
high | 7.8 | — | Microsoft / windows 11 23h2 | 2026-09-08 | 2026-09-25 |
| CVE-2026-69448 Concurrent execution using shared resource with improper synchronization ('race... |
high | 7.0 | — | Microsoft / windows 10 21h2 | 2026-09-08 | 2026-09-25 |
| CVE-2026-69451 Use after free in Windows Management Instrumentation allows an authorized attack... |
high | 7.1 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-25 |
| CVE-2026-69455 Heap-based buffer overflow in Windows Remote Access Connection Manager allows an... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-25 |
| CVE-2026-69456 Heap-based buffer overflow in Microsoft Windows Speech allows an authorized atta... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-25 |
| CVE-2026-69458 Out-of-bounds read in Windows BitLocker allows an authorized attacker to elevate... |
high | 8.0 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-25 |
| CVE-2026-84001 Out-of-bounds read in Windows Key Distribution Center allows an unauthorized att... |
high | 7.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-85360 Use after free in Windows Kernel allows an authorized attacker to elevate privil... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-83995 Heap-based buffer overflow in Windows NTFS allows an authorized attacker to elev... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-83996 Heap-based buffer overflow in Windows Error Reporting allows an authorized attac... |
high | 8.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-84000 Heap-based buffer overflow in Microsoft Graphics Component allows an authorized... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-83989 Out-of-bounds read in Windows Services for NFS ONCRPC XDR Driver allows an unaut... |
high | 7.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-83992 Heap-based buffer overflow in Windows Imaging Component allows an unauthorized a... |
high | 8.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-80096 Out-of-bounds read in Windows Remote Desktop Services allows an authorized attac... |
high | 8.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-81355 Heap-based buffer overflow in Virtual Hard Disk (VHD) Miniport Driver allows an... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-78523 Use after free in Windows DNS allows an unauthorized attacker to deny service ov... |
high | 7.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-80075 Heap-based buffer overflow in Windows Work Folders allows an authorized attacker... |
high | 7.8 | — | Microsoft / windows 10 21h2 | 2026-09-08 | 2026-09-24 |
| CVE-2026-78449 Use after free in Reliable Multicast Transport Driver (RMCAST) allows an unautho... |
high | 8.1 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-77904 Heap-based buffer overflow in Windows Volume Manager Extension Driver allows an... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-77905 Use after free in Windows Management Instrumentation allows an authorized attack... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-77893 Out-of-bounds read in Windows DHCP Server allows an unauthorized attacker to den... |
high | 7.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-77894 Concurrent execution using shared resource with improper synchronization ('race... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.