September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,290
Critical
1,223
High
4,344
Medium
4,103
Low
460
Severity not reported
1,160
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-83999 Improper link resolution before file access ('link following') in Windows Resili... |
high | 7.0 | — | Microsoft / windows 11 24h2 | 2026-09-08 | 2026-09-11 |
| CVE-2026-81789 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') v... |
high | 8.6 | — | — | 2026-09-10 | 2026-09-11 |
| CVE-2026-77111 Adobe Commerce is affected by an Incorrect Authorization vulnerability that coul... |
high | 8.7 | — | Adobe / commerce | 2026-09-08 | 2026-09-11 |
| CVE-2026-72941 Heap-based buffer overflow in Windows Biometric Service allows an authorized att... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-11 |
| CVE-2026-69777 Heap-based buffer overflow in Windows DHCP Client allows an authorized attacker... |
high | 8.0 | — | Microsoft / windows 11 24h2 | 2026-09-08 | 2026-09-11 |
| CVE-2026-69352 Heap-based buffer overflow in Windows Biometric Service allows an authorized att... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-11 |
| CVE-2026-85237 A vulnerability in MISP's email-based one-time password (OTP) authentication flo... |
high | 8.1 | — | Misp-project / misp | 2026-09-03 | 2026-09-11 |
| CVE-2026-85236 A cross-site request forgery (CSRF) vulnerability existed in the cullEmptyEvents... |
high | 8.8 | — | Misp-project / misp | 2026-09-03 | 2026-09-11 |
| CVE-2026-87606 Missing authorization in SiteIsolation in Google Chrome prior to 153.0.8010.36 a... |
high | 8.1 | — | Google / chrome | 2026-09-09 | 2026-09-11 |
| CVE-2026-69773 Heap-based buffer overflow in Windows Biometric Service allows an authorized att... |
high | 8.0 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-11 |
| CVE-2026-69593 Heap-based buffer overflow in Windows Biometric Service allows an authorized att... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-11 |
| CVE-2026-69589 Heap-based buffer overflow in Windows Biometric Service allows an authorized att... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-11 |
| CVE-2026-69583 Heap-based buffer overflow in Windows Biometric Service allows an authorized att... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-11 |
| CVE-2026-69489 Heap-based buffer overflow in Windows Biometric Service allows an authorized att... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-11 |
| CVE-2026-69476 Heap-based buffer overflow in Windows Biometric Service allows an authorized att... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-11 |
| CVE-2026-70581 Integer overflow or wraparound in Windows Biometric Service allows an authorized... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-11 |
| CVE-2026-70573 Heap-based buffer overflow in Windows Biometric Service allows an authorized att... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-11 |
| CVE-2026-69787 Heap-based buffer overflow in Windows Biometric Service allows an authorized att... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-11 |
| CVE-2026-72993 Heap-based buffer overflow in Windows Biometric Service allows an authorized att... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-11 |
| CVE-2026-72988 Heap-based buffer overflow in Windows Biometric Service allows an authorized att... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-11 |
| CVE-2026-83988 Heap-based buffer overflow in Windows Biometric Service allows an authorized att... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-11 |
| CVE-2026-17037 The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordP... |
high | 7.2 | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-79963 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application... |
high | 7.4 | — | Dell / secure connect gateway | 2026-09-09 | 2026-09-11 |
| CVE-2026-78492 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application... |
high | 7.4 | — | Dell / secure connect gateway | 2026-09-09 | 2026-09-11 |
| CVE-2026-78484 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application... |
high | 7.8 | — | Dell / secure connect gateway | 2026-09-09 | 2026-09-11 |
| CVE-2026-78493 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application... |
high | 7.8 | — | Dell / secure connect gateway | 2026-09-09 | 2026-09-11 |
| CVE-2026-41870 Missing Authorization, Improper Control of Generation of Code ('Code Injection')... |
high | 8.8 | — | Apache / nutch | 2026-09-09 | 2026-09-11 |
| CVE-2026-21090 Out-of-bounds write in libsaviextractor.so prior to SMR Sep-2026 Release 1 allow... |
high | 7.8 | — | Samsung / android | 2026-09-09 | 2026-09-11 |
| CVE-2026-21091 Out-of-bounds write in libcodec2secevrcdec.so prior to SMR Sep-2026 Release 1 al... |
high | 7.8 | — | Samsung / android | 2026-09-09 | 2026-09-11 |
| CVE-2026-21094 Improper input validation in wpa_supplicant prior to SMR Sep-2026 Release 1 allo... |
high | 8.8 | — | Samsung / android | 2026-09-09 | 2026-09-11 |
| CVE-2026-67277 MikroTik RouterOS Missing Authentication for Critical Function Vulnerability |
high | 8.2 | Listed | MikroTik / RouterOS | 2026-09-05 | 2026-09-11 |
| CVE-2026-85217 A maliciously crafted add-in, when installed and executed in Autodesk Fusion Des... |
high | 8.6 | — | — | 2026-09-10 | 2026-09-11 |
| CVE-2026-82079 A stack-based buffer overflow vulnerability in the Nintendo Switch local wireles... |
high | 8.4 | — | — | 2026-09-10 | 2026-09-11 |
| CVE-2026-79987 A remote, authenticated, non-admin Craft CMS Control Panel user with only the ac... |
high | 8.8 | — | — | 2026-09-10 | 2026-09-11 |
| CVE-2026-79972 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application... |
high | 7.2 | — | Dell / secure connect gateway | 2026-09-09 | 2026-09-11 |
| CVE-2026-78494 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application... |
high | 7.4 | — | Dell / secure connect gateway | 2026-09-09 | 2026-09-11 |
| CVE-2026-79641 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application... |
high | 7.5 | — | Dell / secure connect gateway | 2026-09-09 | 2026-09-11 |
| CVE-2026-79637 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application... |
high | 7.7 | — | Dell / secure connect gateway | 2026-09-09 | 2026-09-11 |
| CVE-2026-73769 A vulnerability in the web-based management interface of vulnerable CPPM systems... |
high | 7.2 | — | — | 2026-09-09 | 2026-09-11 |
| CVE-2026-73787 A vulnerability in the CPPM web interface could allow an authenticated remote at... |
high | 7.2 | — | — | 2026-09-09 | 2026-09-11 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.