September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,290
Critical
1,223
High
4,344
Medium
4,103
Low
460
Severity not reported
1,160
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-83420 Vulnerability in the PeopleSoft Enterprise FIN Engineering Brazil product of Ora... |
high | 7.8 | — | — | 2026-09-15 | 2026-09-17 |
| CVE-2026-84829 The Optimole WordPress plugin before 4.2.12 does not properly escape a user supp... |
high | 8.8 | — | — | 2026-09-16 | 2026-09-17 |
| CVE-2026-78472 The Ni WooCommerce Sales Report WordPress plugin before 4.2.0 does not sanitise... |
high | 8.6 | — | — | 2026-09-16 | 2026-09-17 |
| CVE-2026-74926 The MultiVendorX WordPress plugin before 5.0.16 does not verify that a user owns... |
high | 7.1 | — | — | 2026-09-16 | 2026-09-17 |
| CVE-2026-76550 The WP Import Export Lite WordPress plugin before 3.9.34 does not validate a use... |
high | 7.2 | — | — | 2026-09-16 | 2026-09-17 |
| CVE-2026-76551 The WP Import Export Lite WordPress plugin before 3.9.33 does not restrict which... |
high | 7.2 | — | — | 2026-09-16 | 2026-09-17 |
| CVE-2026-76552 The WP Import Export Lite WordPress plugin before 3.9.33 does not validate the t... |
high | 8.8 | — | — | 2026-09-16 | 2026-09-17 |
| CVE-2026-91948 FreeRDP versions before 3.31.0 contain an out-of-bounds write vulnerability in s... |
high | 7.5 | — | — | 2026-09-15 | 2026-09-17 |
| CVE-2026-86359 Dell Repository Manager, versions prior to 3.5.2, contains an Incorrect Default... |
high | 8.5 | — | — | 2026-09-16 | 2026-09-17 |
| CVE-2026-84512 A buffer overflow was addressed with improved bounds checking. |
high | 8.8 | — | Apple / macos | 2026-09-14 | 2026-09-17 |
| CVE-2026-73454 On affected platforms running Arista EOS with gRPC Network Security Interface (g... |
high | 8.1 | — | — | 2026-09-16 | 2026-09-17 |
| CVE-2026-73461 On affected EOS platforms with AAA-based gRPC authorization enabled for OpenConf... |
high | 8.0 | — | — | 2026-09-16 | 2026-09-17 |
| CVE-2026-73464 On affected platforms running Arista EOS with gRPC Network Management Interface... |
high | 8.8 | — | — | 2026-09-16 | 2026-09-17 |
| CVE-2026-73439 On affected platforms running Arista EOS, if OpenConfig is configured and runnin... |
high | 7.5 | — | — | 2026-09-16 | 2026-09-17 |
| CVE-2026-65398 An out-of-bounds access issue was addressed with improved bounds checking. |
high | 7.8 | — | Apple / ipados | 2026-09-14 | 2026-09-17 |
| CVE-2026-69814 Use after free in Windows Credential Providers allows an authorized attacker to... |
high | 7.0 | — | Microsoft / windows 11 23h2 | 2026-09-08 | 2026-09-16 |
| CVE-2026-69816 Use after free in Windows Accounts Control allows an authorized attacker to elev... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-16 |
| CVE-2026-69818 Use after free in Windows Win32K allows an authorized attacker to elevate privil... |
high | 7.0 | — | Microsoft / windows 11 24h2 | 2026-09-08 | 2026-09-16 |
| CVE-2026-69822 Numeric truncation error in Windows Kerberos allows an authorized attacker to el... |
high | 7.8 | — | Microsoft / windows 10 1809 | 2026-09-08 | 2026-09-16 |
| CVE-2026-70567 Double free in Windows Display Enhancement Service allows an authorized attacker... |
high | 7.0 | — | Microsoft / windows 11 24h2 | 2026-09-08 | 2026-09-16 |
| CVE-2026-81048 Dell ThinOS 10, versions prior to 2605_10.2616, contain an Improper Neutralizati... |
high | 8.8 | — | Dell / thinos | 2026-09-10 | 2026-09-16 |
| CVE-2026-70569 Out-of-bounds read in Windows Spaceport.sys allows an authorized attacker to ele... |
high | 7.8 | — | Microsoft / windows 11 23h2 | 2026-09-08 | 2026-09-16 |
| CVE-2026-81468 Dell ThinOS 10, versions prior to 2605_10. |
high | 7.2 | — | Dell / thinos | 2026-09-10 | 2026-09-16 |
| CVE-2026-85616 Snipe-IT versions before 8.6.2 contain an authorization bypass vulnerability in... |
high | 8.5 | — | Snipeitapp / snipe-it | 2026-09-04 | 2026-09-16 |
| CVE-2026-85617 snipe-it versions before 8.6.3 contain an authorization bypass vulnerability in... |
high | 8.8 | — | Snipeitapp / snipe-it | 2026-09-04 | 2026-09-16 |
| CVE-2026-85152 undici 8.10.0 omits the destination origin from the cache and request-deduplicat... |
high | 7.4 | — | Nodejs / undici | 2026-09-04 | 2026-09-16 |
| CVE-2026-19534 undici's WebSocket client crashes the whole Node.js process during the opening h... |
high | 7.5 | — | Nodejs / undici | 2026-09-04 | 2026-09-16 |
| CVE-2026-82053 A security issue exists in MongoDB's LDAP authorization integration where pooled... |
high | 8.1 | — | Mongodb / mongodb | 2026-09-08 | 2026-09-16 |
| CVE-2026-82075 An uncontrolled resource consumption weakness exists in the request-handling pat... |
high | 7.5 | — | Mongodb / mongodb | 2026-09-08 | 2026-09-16 |
| CVE-2026-82071 Insufficient validation of storage engine configuration options in MongoDB Serve... |
high | 8.1 | — | Mongodb / mongodb | 2026-09-08 | 2026-09-16 |
| CVE-2026-69209 Http4s is a Scala interface for HTTP services. |
high | 7.5 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-69217 Http4s is a Scala interface for HTTP services. |
high | 8.7 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-88975 Http4s is a Scala interface for HTTP services. |
high | 7.5 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-69202 Http4s is a Scala interface for HTTP services. |
high | 7.5 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-69203 Http4s is a Scala interface for HTTP services. |
high | 7.5 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-69205 Http4s is a Scala interface for HTTP services. |
high | 8.7 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-82067 Improper handling of case sensitivity in the configuration validation component... |
high | 8.1 | — | Mongodb / mongodb | 2026-09-08 | 2026-09-16 |
| CVE-2026-82066 A heap out-of-bounds read security issue exists in the query planning component... |
high | 8.1 | — | Mongodb / mongodb | 2026-09-08 | 2026-09-16 |
| CVE-2026-82064 A security issue in MongoDB Server allows an unauthenticated network user to cau... |
high | 7.5 | — | Mongodb / mongodb | 2026-09-08 | 2026-09-16 |
| CVE-2026-82061 A use-after-free security issue exists in the server's query execution memory tr... |
high | 8.1 | — | Mongodb / mongodb | 2026-09-08 | 2026-09-16 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.