September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,290
Critical
1,223
High
4,344
Medium
4,103
Low
460
Severity not reported
1,160
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-87084 Tanium addressed a server-side request forgery vulnerability in Enforce. |
high | 7.7 | — | Tanium / enforce | 2026-09-09 | 2026-09-16 |
| CVE-2026-87075 Tanium addressed an improper access controls vulnerability in Comply. |
high | 8.1 | — | Tanium / comply | 2026-09-09 | 2026-09-16 |
| CVE-2026-87072 Tanium addressed an improper access controls vulnerability in Comply. |
high | 7.1 | — | Tanium / comply | 2026-09-09 | 2026-09-16 |
| CVE-2026-87030 Tanium addressed a path traversal vulnerability in Comply. |
high | 8.5 | — | Tanium / comply | 2026-09-09 | 2026-09-16 |
| CVE-2026-87817 GitPython before 3.1.60 fails to properly validate the git directory location, a... |
high | 8.8 | — | Gitpython Project / gitpython | 2026-09-09 | 2026-09-16 |
| CVE-2026-87023 Tanium addressed a path traversal vulnerability in Comply. |
high | 8.5 | — | Tanium / comply | 2026-09-09 | 2026-09-16 |
| CVE-2026-87021 Tanium addressed an unauthorized code execution vulnerability in Comply. |
high | 7.2 | — | Tanium / comply | 2026-09-09 | 2026-09-16 |
| CVE-2026-87036 Tanium addressed an improper access controls vulnerability in Comply. |
high | 8.1 | — | Tanium / comply | 2026-09-09 | 2026-09-16 |
| CVE-2026-87034 Tanium addressed a SQL injection vulnerability in Comply. |
high | 8.3 | — | Tanium / comply | 2026-09-09 | 2026-09-16 |
| CVE-2026-61915 An issue was discovered in Cyrus IMAP before 3.12.4. |
high | 7.1 | — | Cyrus / imap | 2026-09-09 | 2026-09-16 |
| CVE-2026-90710 A vulnerability was determined in taisan tarzan-cms 1.0.0. |
high | 7.3 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-90690 A weakness has been identified in 0x4m4 HexStrike AI up to d689933ff579d839c676c... |
high | 7.3 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-90619 A vulnerability has been found in 0x4m4 HexStrike AI up to d689933ff579d839c676c... |
high | 7.3 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-90603 A vulnerability was identified in Anil-matcha Open-Generative-AI up to 1.0.11/2.... |
high | 7.3 | — | — | 2026-09-13 | 2026-09-16 |
| CVE-2026-90593 A vulnerability was determined in embedded-graphics up to 0.8.2. |
high | 7.3 | — | — | 2026-09-13 | 2026-09-16 |
| CVE-2026-90522 A vulnerability was determined in jaychouchannel Tourism-Management-System up to... |
high | 7.3 | — | — | 2026-09-13 | 2026-09-16 |
| CVE-2026-89774 In the Linux kernel, the following vulnerability has been resolved:
Bluetooth:... |
high | 8.8 | — | — | 2026-09-16 | 2026-09-16 |
| CVE-2026-87995 Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI plat... |
high | 8.7 | — | Openwebui / open webui | 2026-09-09 | 2026-09-16 |
| CVE-2026-87996 Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI plat... |
high | 7.7 | — | Openwebui / open webui | 2026-09-09 | 2026-09-16 |
| CVE-2026-87998 Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI plat... |
high | 7.1 | — | Openwebui / open webui | 2026-09-09 | 2026-09-16 |
| CVE-2026-87999 Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI plat... |
high | 7.1 | — | Openwebui / open webui | 2026-09-09 | 2026-09-16 |
| CVE-2026-73022 Use after free in Windows Modern Device Management (MDM) allows an authorized at... |
high | 7.0 | — | Microsoft / windows 10 1809 | 2026-09-08 | 2026-09-16 |
| CVE-2026-72928 Use after free in Windows DNS allows an authorized attacker to execute code over... |
high | 7.5 | — | Microsoft / windows server 2025 | 2026-09-08 | 2026-09-16 |
| CVE-2026-77500 Release of invalid pointer or reference in Windows Device Association Service al... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-16 |
| CVE-2026-77899 Use after free in Windows Security Center allows an authorized attacker to eleva... |
high | 7.0 | — | Microsoft / windows 11 24h2 | 2026-09-08 | 2026-09-16 |
| CVE-2026-71332 Use after free in Windows Secure Socket Tunneling Protocol (SSTP) allows an auth... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-16 |
| CVE-2026-84543 An out-of-bounds access issue was addressed with improved bounds checking. |
high | 7.5 | — | Apple / macos | 2026-09-14 | 2026-09-16 |
| CVE-2026-86894 A logic issue was addressed with improved checks. |
high | 7.5 | — | Apple / macos | 2026-09-14 | 2026-09-16 |
| CVE-2026-65390 An integer overflow was addressed with improved input validation. |
high | 8.8 | — | Apple / safari | 2026-09-14 | 2026-09-16 |
| CVE-2026-65391 An out-of-bounds write issue was addressed with improved bounds checking. |
high | 8.8 | — | Apple / safari | 2026-09-14 | 2026-09-16 |
| CVE-2026-84003 Authentication bypass by capture-replay in Microsoft Authentication Library (MSA... |
high | 7.4 | — | Microsoft / azure\/msal-node | 2026-09-08 | 2026-09-16 |
| CVE-2026-67211 OOM Denial of Service via Unbounded Map Pre-Sizing in Apache OpenNLP SymSpellMod... |
high | 7.5 | — | Apache / opennlp | 2026-09-11 | 2026-09-16 |
| CVE-2026-91990 Tornado before 6.5.8 contains a memory amplification vulnerability in parse_mult... |
high | 7.5 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-56839 PraisonAI is a multi-agent teams system. |
high | 7.3 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-55072 Pimcore is an Open Source Data & Experience Management Platform. |
high | 8.5 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-55416 Pimcore is an Open Source Data & Experience Management Platform. |
high | 8.8 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-65838 Skipper is an HTTP router and reverse proxy for service composition. |
high | 8.2 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-29811 CyberPanel before 2.4.4 attempts to detect an "alais" domain (i.e., a second dom... |
high | 7.7 | — | — | 2026-09-13 | 2026-09-16 |
| CVE-2026-83941 Missing authorization in Entra ID allows an authorized attacker to elevate privi... |
high | 8.8 | — | Microsoft / entra id | 2026-09-08 | 2026-09-16 |
| CVE-2026-67388 Heap-based buffer overflow in SQL Server allows an authorized attacker to execut... |
high | 8.8 | — | Microsoft / sql server 2017 | 2026-09-08 | 2026-09-16 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.