September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,290
Critical
1,223
High
4,344
Medium
4,103
Low
460
Severity not reported
1,160
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-23855 Dell iDRAC9, 14G versions prior to 7.00.00.184, 15G/16G versions prior to 7.30.1... |
high | 7.2 | — | — | 2026-09-09 | 2026-09-11 |
| CVE-2026-21087 Out-of-bounds write in libmdnie.so prior to SMR Sep-2026 Release 1 allows local... |
high | 7.8 | — | Samsung / android | 2026-09-09 | 2026-09-11 |
| CVE-2026-19584 Velociraptor allows for the creation of notebook backups in its default enabled... |
high | 7.7 | — | — | 2026-09-10 | 2026-09-11 |
| CVE-2026-83976 Heap-based buffer overflow in Windows Biometric Service allows an authorized att... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-10 |
| CVE-2026-83955 Heap-based buffer overflow in Windows Biometric Service allows an authorized att... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-10 |
| CVE-2026-81804 Unauthenticated Sensitive Data Exposure in ZHBackup – Backup, Restore & Migratio... |
high | 7.5 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-19303 IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacke... |
high | 8.1 | — | Langflow / langflow | 2026-09-04 | 2026-09-10 |
| CVE-2026-19283 IBM Observability with Instana (Agent) Build 1.0.303 through 1.0.323 IBM Instana... |
high | 7.7 | — | — | 2026-09-04 | 2026-09-10 |
| CVE-2026-18175 IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to manipulate databas... |
high | 7.5 | — | Ibm / i | 2026-09-04 | 2026-09-10 |
| CVE-2026-14873 The Bulk Password Reset plugin for WordPress is vulnerable to privilege escalati... |
high | 8.0 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-87471 Incorrect authorization in ServiceWorker in Google Chrome prior to 153.0.8010.36... |
high | 8.1 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-53932 laravel-backup-restore restores database backups made with spatie/laravel-backup... |
high | 8.0 | — | — | 2026-09-04 | 2026-09-10 |
| CVE-2026-48019 Laravel is a web application framework. |
high | 8.9 | — | — | 2026-09-04 | 2026-09-10 |
| CVE-2026-21088 Improper input validation in loading a subtitle frame in libsubextractor.so prio... |
high | 7.8 | — | Samsung / android | 2026-09-09 | 2026-09-10 |
| CVE-2026-21089 Improper input validation in removing style tag in libsubextractor.so prior to S... |
high | 7.8 | — | Samsung / android | 2026-09-09 | 2026-09-10 |
| CVE-2026-21100 Improper access control in SystemUI prior to SMR Sep-2026 Release 1 allows local... |
high | 7.1 | — | Samsung / android | 2026-09-09 | 2026-09-10 |
| CVE-2026-8862 IBM Netezza Software 11.3.0.3 through Interim Fix 002 has credentials that are h... |
high | 7.5 | — | Ibm / netezza performance server | 2026-09-03 | 2026-09-10 |
| CVE-2026-57866 Server side request forgery in Apache Impala versions 4.4.x and 4.5.x. |
high | 8.8 | — | Apache / impala | 2026-09-09 | 2026-09-10 |
| CVE-2026-65181 Insufficient authorization of Data Source tables in Impala 2.7-4.5 allows a clie... |
high | 8.1 | — | Apache / impala | 2026-09-09 | 2026-09-10 |
| CVE-2026-73334 Potential problem for users of the org.apache.parquet.crypto.keytools package in... |
high | 8.1 | — | Apache / parquet | 2026-09-09 | 2026-09-10 |
| CVE-2026-87933 A vulnerability was found in DaveGamble cJSON up to 1.7.19. |
high | 7.3 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-87993 The consul-template library is vulnerable to an information disclosure issue in... |
high | 7.7 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-88021 Consul and Consul Enterprise are vulnerable to an authorization bypass in the Co... |
high | 7.1 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-87431 Missing authorization in Extensions in Google Chrome prior to 153.0.8010.36 allo... |
high | 7.5 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-86259 OpenMAIC before 1.0.1 skips server-side request forgery validation in non-produc... |
high | 7.5 | — | — | 2026-09-06 | 2026-09-10 |
| CVE-2026-81192 `OpenTelemetry.Resources.Host` NuGet package, which provides OpenTelemetry resou... |
high | 7.0 | — | — | 2026-09-08 | 2026-09-10 |
| CVE-2026-87806 Parse Server versions <= 8.6.87 and >= 9.0.0 < 9.10.1-alpha.7 contain an authent... |
high | 7.4 | — | — | 2026-09-09 | 2026-09-10 |
| CVE-2026-64836 ICEcoder versions through 8.1 contain a path traversal vulnerability in the file... |
high | 8.8 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-64837 ICEcoder through 8.1 passes an unescaped filesystem path into a shell command in... |
high | 8.8 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-64838 ICEcoder versions through 8.1 fail to properly validate the oldFileName paramete... |
high | 8.3 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-88937 knowns through 0.33.0 fails to properly validate template destination paths in t... |
high | 8.8 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-73693 FileRun before 2026.3.0 contains an OS command injection vulnerability in the Ph... |
high | 8.8 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-73699 FileRun before 2026.3.0 contains a PHP object injection vulnerability that allow... |
high | 7.2 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-89043 passport-saml-encrypted through 0.1.13 contains an XML signature wrapping vulner... |
high | 7.4 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-53938 OpenIDC/cjose is a C library implementing the Javascript Object Signing and Encr... |
high | 8.2 | — | — | 2026-09-09 | 2026-09-10 |
| CVE-2026-88045 rclone is a command-line program to sync files and directories to and from diffe... |
high | 7.5 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-89046 zstd-jni versions 1.5.5-6 through 1.5.7-13 contain an out-of-bounds read vulnera... |
high | 8.2 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-87090 Consul and Consul Enterprise are vulnerable to an authorization bypass in the ca... |
high | 8.3 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-87499 Incorrect authorization in Network in Google Chrome prior to 153.0.8010.36 allow... |
high | 8.1 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87505 Incorrect authorization in FileSystem in Google Chrome prior to 153.0.8010.36 al... |
high | 8.1 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.