September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,290
Critical
1,223
High
4,344
Medium
4,103
Low
460
Severity not reported
1,160
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-76825 RestrictedPython is a tool that helps define a subset of the Python language for... |
high | 8.4 | — | — | 2026-09-16 | 2026-09-16 |
| CVE-2026-27556 A low-privileged remote attacker can exploit a local file inclusion vulnerabilit... |
high | 8.8 | — | — | 2026-09-16 | 2026-09-16 |
| CVE-2026-27559 A low-privileged remote attacker can exploit a command injection vulnerability i... |
high | 8.8 | — | — | 2026-09-16 | 2026-09-16 |
| CVE-2026-27560 A high-privileged remote attacker can exploit a command injection vulnerability... |
high | 7.2 | — | — | 2026-09-16 | 2026-09-16 |
| CVE-2026-27561 A high-privileged remote attacker can exploit a command injection vulnerability... |
high | 7.2 | — | — | 2026-09-16 | 2026-09-16 |
| CVE-2026-27564 A high-privileged remote attacker can exploit a command injection vulnerability... |
high | 7.2 | — | — | 2026-09-16 | 2026-09-16 |
| CVE-2026-27554 A low-privileged remote attacker can exploit a command injection vulnerability i... |
high | 8.8 | — | — | 2026-09-16 | 2026-09-16 |
| CVE-2026-27555 A low-privileged remote attacker can exploit a local file inclusion vulnerabilit... |
high | 8.8 | — | — | 2026-09-16 | 2026-09-16 |
| CVE-2026-27549 A low-privileged remote attacker can exploit a command injection vulnerability i... |
high | 8.8 | — | — | 2026-09-16 | 2026-09-16 |
| CVE-2026-27550 A low-privileged remote attacker can exploit a command injection vulnerability i... |
high | 8.8 | — | — | 2026-09-16 | 2026-09-16 |
| CVE-2026-27551 A low-privileged remote attacker can exploit a command injection vulnerability i... |
high | 8.8 | — | — | 2026-09-16 | 2026-09-16 |
| CVE-2026-18595 The WP-Lister Lite for eBay plugin for WordPress is vulnerable to Stored Cross-S... |
high | 7.2 | — | — | 2026-09-16 | 2026-09-16 |
| CVE-2026-27547 A low-privileged remote attacker can exploit a command injection vulnerability i... |
high | 8.8 | — | — | 2026-09-16 | 2026-09-16 |
| CVE-2026-27552 A low-privileged remote attacker can exploit improper authorization in the /inde... |
high | 8.1 | — | — | 2026-09-16 | 2026-09-16 |
| CVE-2026-27557 An unauthenticated remote attacker can exploit a path traversal vulnerability in... |
high | 7.5 | — | — | 2026-09-16 | 2026-09-16 |
| CVE-2026-27562 A high-privileged remote attacker can exploit a command injection vulnerability... |
high | 7.2 | — | — | 2026-09-16 | 2026-09-16 |
| CVE-2026-89161 In PCRE2 before 10.48, pcre2_jit_match mishandles a previously copied subject be... |
high | 7.8 | — | Pcre / pcre2 | 2026-09-11 | 2026-09-16 |
| CVE-2026-2380 On affected platforms running Arista EOS with OpenConfig-related services (i.e.,... |
high | 7.4 | — | — | 2026-09-16 | 2026-09-16 |
| CVE-2026-73435 On affected platforms running Arista EOS with Open Shortest Path First version 2... |
high | 8.2 | — | — | 2026-09-16 | 2026-09-16 |
| CVE-2026-73455 On affected platforms running Arista EOS with Open Shortest Path First version 3... |
high | 7.5 | — | — | 2026-09-16 | 2026-09-16 |
| CVE-2026-73458 On affected platforms running Arista EOS with authenticated Bidirectional Forwar... |
high | 8.2 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-69921 Heap-based buffer overflow in Windows Print Spooler Components allows an authori... |
high | 7.8 | — | Microsoft / windows 10 21h2 | 2026-09-08 | 2026-09-16 |
| CVE-2026-92406 A vulnerability was detected in SourceCodester Inventory and Monitoring System 1... |
high | 7.3 | — | — | 2026-09-16 | 2026-09-16 |
| CVE-2026-69907 Improper handling of insufficient permissions or privileges in Windows Enterpris... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-16 |
| CVE-2026-69900 Untrusted pointer dereference in Kernel Streaming WOW Thunk Service Driver allow... |
high | 7.8 | — | Microsoft / windows 10 21h2 | 2026-09-08 | 2026-09-16 |
| CVE-2026-43686 A use-after-free issue was addressed with improved memory management. |
high | 8.8 | — | Apple / ipados | 2026-09-14 | 2026-09-16 |
| CVE-2026-45768 Suricata is a network Intrusion Detection System, Intrusion Prevention System an... |
high | 7.5 | — | Oisf / suricata | 2026-09-10 | 2026-09-16 |
| CVE-2026-45769 Suricata is a network Intrusion Detection System, Intrusion Prevention System an... |
high | 7.5 | — | Oisf / suricata | 2026-09-10 | 2026-09-16 |
| CVE-2026-45770 Suricata is a network Intrusion Detection System, Intrusion Prevention System an... |
high | 7.5 | — | Oisf / suricata | 2026-09-10 | 2026-09-16 |
| CVE-2026-84546 An out-of-bounds write issue was addressed with improved bounds checking. |
high | 8.4 | — | Apple / ipados | 2026-09-14 | 2026-09-16 |
| CVE-2026-84497 A buffer overflow was addressed with improved size validation. |
high | 7.8 | — | Apple / ipados | 2026-09-14 | 2026-09-16 |
| CVE-2026-84611 An out-of-bounds write issue was addressed with improved bounds checking. |
high | 7.3 | — | Apple / ipados | 2026-09-14 | 2026-09-16 |
| CVE-2026-84629 This issue was addressed with additional entitlement checks. |
high | 7.5 | — | Apple / ipados | 2026-09-14 | 2026-09-16 |
| CVE-2026-84632 The issue was addressed with improved memory handling. |
high | 7.3 | — | Apple / ipados | 2026-09-14 | 2026-09-16 |
| CVE-2026-92401 A vulnerability was identified in ChangeWeDer crm up to c07bd4c97141521af6475034... |
high | 7.3 | — | — | 2026-09-16 | 2026-09-16 |
| CVE-2026-85731 oras-go is a Go library for managing OCI artifacts. |
high | 8.8 | — | — | 2026-09-16 | 2026-09-16 |
| CVE-2026-57112 PraisonAI is a multi-agent teams system. |
high | 8.3 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-57133 PraisonAI is a multi-agent teams system. |
high | 8.8 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-9336 IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to a denial of servi... |
high | 7.5 | — | Ibm / websphere application server | 2026-09-10 | 2026-09-16 |
| CVE-2026-88036 Improper neutralization of special elements in data query logic in the GridFS co... |
high | 8.3 | — | Mongodb / c driver | 2026-09-10 | 2026-09-16 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.