September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,290
Critical
1,223
High
4,344
Medium
4,103
Low
460
Severity not reported
1,160
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-9034 Use After Free vulnerability in Arm Ltd Bifrost GPU Userspace Driver, Arm Ltd Va... |
high | 7.8 | — | — | 2026-09-08 | 2026-09-10 |
| CVE-2026-7476 Use After Free vulnerability in Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valha... |
high | 7.8 | — | — | 2026-09-08 | 2026-09-10 |
| CVE-2026-7477 Use After Free vulnerability in Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valha... |
high | 7.8 | — | — | 2026-09-08 | 2026-09-10 |
| CVE-2026-79602 A guest with a PCI device assigned that has at least a BAR on the IO port
space... |
high | 8.8 | — | — | 2026-09-08 | 2026-09-10 |
| CVE-2026-62646 A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). |
high | 7.4 | — | — | 2026-09-08 | 2026-09-10 |
| CVE-2026-5729 Use After Free vulnerability in Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5... |
high | 7.8 | — | — | 2026-09-08 | 2026-09-10 |
| CVE-2026-0860 Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Arm... |
high | 7.5 | — | — | 2026-09-08 | 2026-09-10 |
| CVE-2026-69298 Integer overflow or wraparound in Windows Biometric Service allows an authorized... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-10 |
| CVE-2026-69323 Heap-based buffer overflow in Windows Biometric Service allows an authorized att... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-10 |
| CVE-2026-69467 Stack-based buffer overflow in Microsoft Graphics Component allows an authorized... |
high | 7.8 | — | Microsoft / windows 10 21h2 | 2026-09-08 | 2026-09-10 |
| CVE-2026-69580 Heap-based buffer overflow in Windows Biometric Service allows an authorized att... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-10 |
| CVE-2026-72990 Heap-based buffer overflow in Windows Biometric Service allows an authorized att... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-10 |
| CVE-2026-72995 Heap-based buffer overflow in Windows Biometric Service allows an authorized att... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-10 |
| CVE-2026-73001 Heap-based buffer overflow in Windows Biometric Service allows an authorized att... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-10 |
| CVE-2026-73006 Stack-based buffer overflow in Microsoft Graphics Component allows an unauthoriz... |
high | 8.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-10 |
| CVE-2026-73011 Heap-based buffer overflow in Windows Biometric Service allows an authorized att... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-10 |
| CVE-2026-73021 Heap-based buffer overflow in Windows Biometric Service allows an authorized att... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-10 |
| CVE-2026-73026 Heap-based buffer overflow in Windows Biometric Service allows an authorized att... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-10 |
| CVE-2026-87537 Missing authorization in Extensions in Google Chrome prior to 153.0.8010.36 allo... |
high | 8.1 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87536 Use after free in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote at... |
high | 8.8 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87533 Use after free in DevTools in Google Chrome prior to 153.0.8010.36 allowed a loc... |
high | 8.1 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-9040 A race condition vulnerability in Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Val... |
high | 7.7 | — | — | 2026-09-08 | 2026-09-10 |
| CVE-2026-88271 GeoVision GV-LPC2211 V1.13 allows a Guest user to overwrite device configuration... |
high | 8.8 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-88272 GeoVision GV-LPC2211 V1.13 allows an administrator-controlled username containin... |
high | 7.2 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-88277 GeoVision GV-LPC2211 V1.13 allows an authenticated ONVIF user to inject shell co... |
high | 8.8 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-87925 A vulnerability was detected in Rizwan17 inventory-management-system up to bfe78... |
high | 7.3 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-86208 A security flaw has been discovered in SourceCodester Class and Exam Timetabling... |
high | 7.3 | — | — | 2026-09-06 | 2026-09-10 |
| CVE-2026-86213 A vulnerability was found in Mstfakts College-Management-System. |
high | 7.3 | — | — | 2026-09-06 | 2026-09-10 |
| CVE-2026-86810 A vulnerability was detected in Open-Web-Analytics up to 1.9.1. |
high | 7.3 | — | — | 2026-09-08 | 2026-09-10 |
| CVE-2026-84819 Unauthenticated Cross Site Scripting (XSS) in WPAdverts <= 2.3.3 versions. |
high | 7.1 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-81794 Unauthenticated Broken Access Control in Shirt Product Designer for WooCommerce... |
high | 7.5 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-81801 Subscriber Settings Change in WP-Stateless <= 4.4.1 versions. |
high | 8.1 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-79324 Missing authorization in the Address Delete controller in Mageplaza GDPR for Mag... |
high | 7.5 | — | Mageplaza / gdpr | 2026-09-09 | 2026-09-10 |
| CVE-2026-79323 Information disclosure in the blogComments GraphQL query in Magefan Blog GraphQL... |
high | 7.5 | — | Mageplaza / magefan blog | 2026-09-09 | 2026-09-10 |
| CVE-2026-79322 SQL injection in the RelatedProduct block in Mageplaza Blog for Magento 2 (magep... |
high | 8.6 | — | Mageplaza / mageplaza blog | 2026-09-09 | 2026-09-10 |
| CVE-2026-81996 Acrobat Reader is affected by an Incorrect Authorization vulnerability that coul... |
high | 8.8 | — | Adobe / acrobat | 2026-09-08 | 2026-09-10 |
| CVE-2026-73763 A vulnerability exists in a management component that could allow an unauthentic... |
high | 8.8 | — | Hpe / arubaos-cx | 2026-09-01 | 2026-09-10 |
| CVE-2026-88874 AVideo through revision c3edcc274c389816d434acadac07ee78eaf330c1 (master, 2026-0... |
high | 7.5 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-88286 GeoVision GV-LPC2211 V1.13 improperly manages PTZ connection state, allowing an... |
high | 7.5 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-88287 GeoVision GV-LPC2211 V1.13 fails to bound the number of Scopes tokens in unauthe... |
high | 7.5 | — | — | 2026-09-10 | 2026-09-10 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.