September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,290
Critical
1,223
High
4,344
Medium
4,103
Low
460
Severity not reported
1,160
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-82774 Improper neutralization of special elements used in an OS command ('OS Command I... |
high | 8.8 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-82777 Improper neutralization of special elements used in an OS command ('OS Command I... |
high | 8.8 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-82779 Improper neutralization of special elements used in an OS command ('OS Command I... |
high | 8.8 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-82780 Unrestricted upload of file with dangerous type issue exists in CONPROSYS TM Ser... |
high | 8.8 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-82789 An improper neutralization of directives in dynamically evaluated code ('Eval In... |
high | 8.8 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-82791 Improper neutralization of special elements used in an OS command ('OS Command I... |
high | 8.8 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-82793 Unrestricted upload of file with dangerous type issue exists in Contec CAN 2.0B... |
high | 7.2 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-82794 SolarView Compact contains an OS command Injection vulnerability in in Schedule... |
high | 8.8 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-77853 Improper neutralization of special elements used in an OS command ('OS Command I... |
high | 8.8 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-80217 Hidden functionality issue exists in FF-RFI079I4 and FF-RFI078I4, which may allo... |
high | 8.8 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-84408 QND contains an improper access control vulnerability in a named pipe, which may... |
high | 8.8 | — | — | 2026-09-16 | 2026-09-16 |
| CVE-2026-88263 XikeStor Layer3 switches miss authentication for downloading configuration data. |
high | 7.5 | — | — | 2026-09-16 | 2026-09-16 |
| CVE-2026-69646 Improper verification of cryptographic signature in Skype for Business allows an... |
high | 8.3 | — | Microsoft / skype for business server | 2026-09-08 | 2026-09-16 |
| CVE-2026-89157 PCRE2 before 10.48, on 32-bit platforms, has a pcre2_pattern_convert out-of-boun... |
high | 7.4 | — | Pcre / pcre2 | 2026-09-11 | 2026-09-16 |
| CVE-2026-15955 IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 could allow a remote at... |
high | 7.5 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-13107 IBM Business Automation Workflow containers and traditional may use programming... |
high | 7.1 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-13275 IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 throu... |
high | 7.1 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-13287 IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 throu... |
high | 7.1 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-12667 IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 throu... |
high | 7.1 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-66307 Integer underflow (wrap or wraparound) in Skype for Business allows an unauthori... |
high | 7.5 | — | Microsoft / skype for business server | 2026-09-08 | 2026-09-16 |
| CVE-2026-66305 Use of client-side authentication in Skype for Business allows an authorized att... |
high | 7.1 | — | Microsoft / skype for business server | 2026-09-08 | 2026-09-16 |
| CVE-2026-66304 Server-side request forgery (ssrf) in Skype for Business allows an unauthorized... |
high | 7.5 | — | Microsoft / skype for business server | 2026-09-08 | 2026-09-16 |
| CVE-2026-17133 IBM App Connect Enterprise 13.0.1.0 through 13.0.8.0, and 12.0.1.0 through 12.0.... |
high | 7.8 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-17156 IBM App Connect Enterprise 13.0.1.0 through 13.0.8.0, and 12.0.1.0 through 12.0.... |
high | 7.8 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-17416 IBM App Connect Enterprise 13.0.1.0 through 13.0.8.0, and 12.0.1.0 through 12.0.... |
high | 7.8 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-17467 IBM Cloud Pak for Data System (Yosemite 1.0) 3.0.5.2 could allow a remote attack... |
high | 8.2 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-11926 IBM Verify Identity Access could allow a remote attacker to cause a denial of se... |
high | 7.5 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-12358 IBM Verify Identity Access could allow a remote attacker to cause a denial of se... |
high | 7.5 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-13260 IBM Verify Identity Access could allow a remote attacker to cause a denial of se... |
high | 7.5 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-13293 IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 throu... |
high | 8.8 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-19290 IBM Sterling File Gateway 6.2.0.0 through 6.2.0.6_1, 6.2.1.0 - 6.2.1.2, 6.2.2.0... |
high | 7.5 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-12756 IBM Business Automation Workflow containers and traditional is vulnerable to an... |
high | 7.1 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-11728 IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 throu... |
high | 8.1 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-11729 IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 throu... |
high | 8.5 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-11929 IBM Security Verify Identity Access Reverse Proxy in certain configurations may... |
high | 7.5 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-11934 IBM Verify Identity Access could allow an administrator to execute additional co... |
high | 7.2 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-12354 IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 throu... |
high | 7.5 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-12355 IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 throu... |
high | 8.1 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-12752 IBM Business Automation Workflow containers and traditional is vulnerable to an... |
high | 7.1 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-78088 The Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe plu... |
high | 8.8 | — | — | 2026-09-16 | 2026-09-16 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.