September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,290
Critical
1,223
High
4,344
Medium
4,103
Low
460
Severity not reported
1,160
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-83978 Heap-based buffer overflow in Windows Biometric Service allows an authorized att... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-15 |
| CVE-2026-90535 Flowise versions before 3.1.4 contain an unauthenticated denial of service vulne... |
high | 7.5 | — | Flowiseai / flowise | 2026-09-12 | 2026-09-15 |
| CVE-2026-67638 Heap-based buffer overflow in SQL Server allows an authorized attacker to execut... |
high | 8.8 | — | Microsoft / sql server 2025 | 2026-09-08 | 2026-09-15 |
| CVE-2026-67368 Improper link resolution before file access ('link following') in SQL Server all... |
high | 8.8 | — | Microsoft / sql server 2017 | 2026-09-08 | 2026-09-15 |
| CVE-2026-14199 Only self-managed Grafana instances with Auth Proxy authentication and identity... |
high | 8.1 | — | Grafana / grafana | 2026-09-02 | 2026-09-15 |
| CVE-2026-90858 A flaw has been found in subhajitkhan online-clinic-management-system up to e9ee... |
high | 7.3 | — | — | 2026-09-15 | 2026-09-15 |
| CVE-2026-90880 A security flaw has been discovered in D-Link DSL-3782 2016-07-28. |
high | 7.4 | — | — | 2026-09-15 | 2026-09-15 |
| CVE-2026-90617 A vulnerability was detected in GH05TCREW PentestAgent up to cf882dabea3ed91cef0... |
high | 7.3 | — | — | 2026-09-14 | 2026-09-15 |
| CVE-2026-3416 The API Publisher component previously used a non-cryptographic pseudorandom num... |
high | 7.5 | — | Wso2 / api control plane | 2026-09-03 | 2026-09-15 |
| CVE-2026-84553 A resource exhaustion issue was addressed with improved input validation. |
high | 7.5 | — | Apple / macos | 2026-09-14 | 2026-09-15 |
| CVE-2026-84568 A path traversal issue was addressed with improved path validation. |
high | 7.8 | — | Apple / macos | 2026-09-14 | 2026-09-15 |
| CVE-2026-84631 This issue was addressed with additional entitlement checks. |
high | 7.8 | — | Apple / macos | 2026-09-14 | 2026-09-15 |
| CVE-2026-86917 A permissions issue was addressed with additional restrictions. |
high | 7.8 | — | Apple / macos | 2026-09-14 | 2026-09-15 |
| CVE-2026-90708 A weakness has been identified in Yot CMS up to 3.3.1. |
high | 7.3 | — | — | 2026-09-14 | 2026-09-15 |
| CVE-2026-90537 WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a m... |
high | 8.2 | — | — | 2026-09-12 | 2026-09-15 |
| CVE-2026-89242 WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a s... |
high | 7.2 | — | — | 2026-09-11 | 2026-09-15 |
| CVE-2026-84042 A flaw was found in crun. |
high | 7.8 | — | — | 2026-09-10 | 2026-09-15 |
| CVE-2026-72708 SPIP before 4.4.18 contains an unauthenticated blind SQL injection vulnerability... |
high | 7.5 | — | — | 2026-09-11 | 2026-09-15 |
| CVE-2026-9176 IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to a security bypass... |
high | 7.1 | — | Ibm / websphere application server | 2026-09-10 | 2026-09-15 |
| CVE-2026-9327 IBM WebSphere Application Server 9.0, and 8.5 could allow an authenticated user... |
high | 8.1 | — | Ibm / websphere application server | 2026-09-10 | 2026-09-15 |
| CVE-2026-87011 Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI plat... |
high | 7.5 | — | Openwebui / open webui | 2026-09-09 | 2026-09-15 |
| CVE-2026-90805 A flaw has been found in subhajitkhan online-clinic-management-system up to e9ee... |
high | 7.3 | — | — | 2026-09-14 | 2026-09-15 |
| CVE-2026-78130 strongSwan 4.2.0 through 6.0.7 has a NULL pointer dereference in the x509 plugin... |
high | 7.5 | — | Strongswan / strongswan | 2026-09-11 | 2026-09-15 |
| CVE-2026-73028 Improper access control in SQL Server allows an authorized attacker to elevate p... |
high | 8.8 | — | Microsoft / sql server 2017 | 2026-09-08 | 2026-09-15 |
| CVE-2026-77480 Insufficient granularity of access control in SQL Server allows an authorized at... |
high | 8.8 | — | Microsoft / sql server 2017 | 2026-09-08 | 2026-09-15 |
| CVE-2026-77482 Heap-based buffer overflow in SQL Server allows an unauthorized attacker to exec... |
high | 8.8 | — | Microsoft / sql server 2017 | 2026-09-08 | 2026-09-15 |
| CVE-2026-77483 Weak authentication in SQL Server allows an authorized attacker to elevate privi... |
high | 8.8 | — | Microsoft / sql server 2017 | 2026-09-08 | 2026-09-15 |
| CVE-2026-77484 Deserialization of untrusted data in SQL Server allows an authorized attacker to... |
high | 8.8 | — | Microsoft / sql server 2019 | 2026-09-08 | 2026-09-15 |
| CVE-2026-77485 Use after free in SQL Server allows an authorized attacker to elevate privileges... |
high | 7.0 | — | Microsoft / sql server 2017 | 2026-09-08 | 2026-09-15 |
| CVE-2026-77486 Integer overflow or wraparound in SQL Server allows an unauthorized attacker to... |
high | 8.8 | — | Microsoft / sql server 2017 | 2026-09-08 | 2026-09-15 |
| CVE-2026-77487 Improper access control in SQL Server allows an authorized attacker to elevate p... |
high | 8.8 | — | Microsoft / sql server 2017 | 2026-09-08 | 2026-09-15 |
| CVE-2026-87016 Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI plat... |
high | 8.1 | — | Openwebui / open webui | 2026-09-09 | 2026-09-15 |
| CVE-2026-18905 IBM ContextForge MCP Gateway (`mcp-contextforge-gateway`) <= v1.0.6 MCP Context... |
high | 7.7 | — | Ibm / contextforge | 2026-09-04 | 2026-09-15 |
| CVE-2026-91004 A vulnerability has been found in SourceCodester Online Faculty Clearance System... |
high | 7.3 | — | — | 2026-09-15 | 2026-09-15 |
| CVE-2026-90819 A weakness has been identified in a2aproject a2a-java 1.2.0. |
high | 7.3 | — | — | 2026-09-14 | 2026-09-15 |
| CVE-2026-90841 A security flaw has been discovered in PHPGurukul Blood Donor Management System... |
high | 7.3 | — | — | 2026-09-15 | 2026-09-15 |
| CVE-2026-90846 A vulnerability has been found in PHPGurukul Daily Expense Tracker System 1.1. |
high | 7.3 | — | — | 2026-09-15 | 2026-09-15 |
| CVE-2026-90879 A vulnerability was identified in zyx0814 FilePress up to 3.0.1. |
high | 7.3 | — | — | 2026-09-15 | 2026-09-15 |
| CVE-2026-90524 A security flaw has been discovered in jaychouchannel Tourism-Management-System... |
high | 7.3 | — | — | 2026-09-13 | 2026-09-15 |
| CVE-2026-90493 A vulnerability was detected in Tonec Internet Download Manager up to 6.42 Build... |
high | 8.8 | — | — | 2026-09-13 | 2026-09-15 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.