September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,833
Low
527
Severity not reported
2,537
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), linux (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-81983 Acrobat Reader is affected by an out-of-bounds write vulnerability that could re... |
high | 7.8 | — | Adobe / acrobat | 2026-09-08 | 2026-09-10 |
| CVE-2026-80161 Acrobat Reader is affected by an Access of Resource Using Incompatible Type ('Ty... |
high | 7.8 | — | Adobe / acrobat | 2026-09-08 | 2026-09-10 |
| CVE-2026-81192 `OpenTelemetry.Resources.Host` NuGet package, which provides OpenTelemetry resou... |
high | 7.0 | — | — | 2026-09-08 | 2026-09-10 |
| CVE-2026-81973 Acrobat Reader is affected by a Use After Free vulnerability that could result i... |
high | 7.8 | — | Adobe / acrobat | 2026-09-08 | 2026-09-10 |
| CVE-2026-81975 Acrobat Reader is affected by a Use After Free vulnerability that could result i... |
high | 7.8 | — | Adobe / acrobat | 2026-09-08 | 2026-09-10 |
| CVE-2026-79907 Acrobat Reader is affected by a Double Free vulnerability that could result in a... |
high | 7.8 | — | Adobe / acrobat | 2026-09-08 | 2026-09-10 |
| CVE-2026-79908 Acrobat Reader is affected by an out-of-bounds write vulnerability that could re... |
high | 7.8 | — | Adobe / acrobat | 2026-09-08 | 2026-09-10 |
| CVE-2026-79909 Acrobat Reader is affected by a Use After Free vulnerability that could result i... |
high | 7.8 | — | Adobe / acrobat | 2026-09-08 | 2026-09-10 |
| CVE-2026-77827 Maono Link 3.8.13 MaonoAiServices Windows service allows local privilege escalat... |
high | 7.1 | — | — | 2026-09-08 | 2026-09-14 |
| CVE-2026-19651 IBM Enterprise Build of Quarkus 3.27.1 through 3.27.5, and 3.33.1 through 3.33.3... |
high | 7.4 | — | — | 2026-09-08 | 2026-09-09 |
| CVE-2026-30754 A memory corruption vulnerability exists in FFmpeg before 8.1. |
high | 8.8 | — | Ffmpeg / ffmpeg | 2026-09-08 | 2026-10-15 |
| CVE-2026-86808 A security vulnerability has been detected in moltis-org moltis up to 20260818.1... |
high | 7.3 | — | — | 2026-09-08 | 2026-09-11 |
| CVE-2026-86810 A vulnerability was detected in Open-Web-Analytics up to 1.9.1. |
high | 7.3 | — | — | 2026-09-08 | 2026-09-10 |
| CVE-2026-86806 A weakness has been identified in opengeos GeoLibre up to 2.3.0. |
high | 7.3 | — | — | 2026-09-08 | 2026-09-09 |
| CVE-2026-84942 Improper input validation in the Vega expression function implementation in Open... |
high | 8.7 | — | — | 2026-09-08 | 2026-09-09 |
| CVE-2026-82007 Photoshop Desktop is affected by an Integer Overflow or Wraparound vulnerability... |
high | 7.8 | — | Adobe / photoshop | 2026-09-08 | 2026-09-11 |
| CVE-2026-82005 Photoshop Desktop is affected by an out-of-bounds write vulnerability that could... |
high | 7.8 | — | Adobe / photoshop | 2026-09-08 | 2026-09-11 |
| CVE-2026-82006 Photoshop Desktop is affected by a Heap-based Buffer Overflow vulnerability that... |
high | 7.8 | — | Adobe / photoshop | 2026-09-08 | 2026-09-11 |
| CVE-2026-78834 A code execution vulnerability exists in CMSimple 5.22 in the CoAuthors plugin. |
high | 8.8 | — | — | 2026-09-08 | 2026-09-09 |
| CVE-2026-78545 The Okta Access Gateway does not sanitize the application label field before inc... |
high | 7.2 | — | Okta / access gateway | 2026-09-08 | 2026-09-29 |
| CVE-2026-78550 The Okta Access Gateway management console passes user-supplied input to eval()... |
high | 7.2 | — | Okta / access gateway | 2026-09-08 | 2026-09-29 |
| CVE-2026-76190 ColdFusion is affected by an Improper Neutralization of Directives in Dynamicall... |
high | 8.6 | — | Adobe / coldfusion | 2026-09-08 | 2026-09-18 |
| CVE-2026-76199 Photoshop Desktop is affected by an Uncontrolled Search Path Element vulnerabili... |
high | 8.6 | — | Adobe / photoshop | 2026-09-08 | 2026-09-11 |
| CVE-2026-75991 Illustrator is affected by an Improper Input Validation vulnerability that could... |
high | 8.6 | — | Adobe / illustrator | 2026-09-08 | 2026-09-18 |
| CVE-2026-75992 Illustrator is affected by an out-of-bounds write vulnerability that could resul... |
high | 7.8 | — | Adobe / illustrator | 2026-09-08 | 2026-09-18 |
| CVE-2026-75993 ColdFusion is affected by a reflected Cross-Site Scripting (XSS) vulnerability. |
high | 8.5 | — | Adobe / coldfusion | 2026-09-08 | 2026-09-18 |
| CVE-2026-75998 ColdFusion is affected by an Improper Access Control vulnerability that could le... |
high | 7.5 | — | Adobe / coldfusion | 2026-09-08 | 2026-09-18 |
| CVE-2026-75999 ColdFusion is affected by an Improper Input Validation vulnerability that could... |
high | 8.4 | — | Adobe / coldfusion | 2026-09-08 | 2026-09-18 |
| CVE-2026-75771 Photoshop Desktop is affected by an Integer Overflow or Wraparound vulnerability... |
high | 7.8 | — | Adobe / photoshop | 2026-09-08 | 2026-09-11 |
| CVE-2026-75862 Photoshop Desktop is affected by an Integer Overflow or Wraparound vulnerability... |
high | 7.8 | — | Adobe / photoshop | 2026-09-08 | 2026-09-11 |
| CVE-2026-75863 Photoshop Desktop is affected by an Integer Overflow or Wraparound vulnerability... |
high | 7.8 | — | Adobe / photoshop | 2026-09-08 | 2026-09-11 |
| CVE-2026-75990 Illustrator is affected by an Incorrect Authorization vulnerability that could r... |
high | 8.6 | — | Adobe / illustrator | 2026-09-08 | 2026-09-18 |
| CVE-2026-75631 Photoshop Desktop is affected by an out-of-bounds write vulnerability that could... |
high | 7.8 | — | Adobe / photoshop | 2026-09-08 | 2026-09-14 |
| CVE-2026-28659 In MicroXR Blobstore, there is a possible way to access other app's files due to... |
high | 7.8 | — | Google / android xr | 2026-09-08 | 2026-10-05 |
| CVE-2026-86716 A vulnerability was determined in Cesanta mJS up to 1.26. |
high | 7.3 | — | — | 2026-09-08 | 2026-09-08 |
| CVE-2026-82536 Roo-Code through 3.54.0 contains an auto-approve bypass vulnerability in the she... |
high | 8.8 | — | — | 2026-09-08 | 2026-09-19 |
| CVE-2026-82537 Roo-Code through 3.54.0 contains an auto-approve bypass vulnerability that allow... |
high | 8.8 | — | — | 2026-09-08 | 2026-09-11 |
| CVE-2026-77774 Adobe Commerce is affected by an Incorrect Authorization vulnerability that coul... |
high | 8.6 | — | Adobe / commerce | 2026-09-08 | 2026-09-09 |
| CVE-2026-76202 Adobe Commerce is affected by an Incorrect Authorization vulnerability that coul... |
high | 8.2 | — | Adobe / commerce | 2026-09-08 | 2026-09-10 |
| CVE-2026-77108 Adobe Commerce is affected by an Incorrect Authorization vulnerability that coul... |
high | 7.5 | — | Adobe / commerce | 2026-09-08 | 2026-09-11 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.