September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,290
Critical
1,223
High
4,344
Medium
4,103
Low
460
Severity not reported
1,160
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-88289 GeoVision GV-LPC2211 V1.14 (260903) fails to validate attacker-controlled variab... |
high | 7.5 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-88290 GeoVision GV-LPC2211 V1.14 (260903) allows unauthenticated clients to declare un... |
high | 7.5 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-88273 GeoVision GV-LPC2211 V1.13 allows an administrator-controlled PPPoE username to... |
high | 7.2 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-88274 GeoVision GV-LPC2211 V1.13 allows an administrator-controlled wireless SSID cont... |
high | 7.2 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-88275 GeoVision GV-LPC2211 V1.13 allows an administrator-controlled WPA-PSK containing... |
high | 7.2 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-88276 GeoVision GV-LPC2211 V1.13 allows administrator-controlled WEP key values contai... |
high | 7.2 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-88282 GeoVision GV-LPC2211 V1.13 allows an administrator-controlled FTP username conta... |
high | 7.2 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-87569 Missing authorization in Views in Google Chrome prior to 153.0.8010.36 allowed a... |
high | 8.8 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87570 Incorrect authorization in SiteIsolation in Google Chrome prior to 153.0.8010.36... |
high | 8.8 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87433 Race condition in FileAPI in Google Chrome prior to 153.0.8010.36 allowed a remo... |
high | 8.8 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87450 Incorrect authorization in Permissions in Google Chrome prior to 153.0.8010.36 a... |
high | 7.5 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-86541 knowns versions before 0.30.0 contain a path traversal vulnerability in the hand... |
high | 8.3 | — | — | 2026-09-07 | 2026-09-10 |
| CVE-2026-86712 SiYuan before 3.8.2 trusts the attacker-writable text/siyuan clipboard MIME type... |
high | 8.8 | — | — | 2026-09-08 | 2026-09-10 |
| CVE-2026-86600 In affected Snowflake drivers, WORKLOAD_IDENTITY authentication requests a cloud... |
high | 8.2 | — | — | 2026-09-08 | 2026-09-10 |
| CVE-2026-86729 WWBN AVideo through commit e01e41ecc (no patched version available) exposes get_... |
high | 7.4 | — | — | 2026-09-08 | 2026-09-10 |
| CVE-2026-86438 Lara Dashboard before 1.3.2 fails to authorize the MarketplaceModuleBrowser inst... |
high | 7.2 | — | — | 2026-09-07 | 2026-09-10 |
| CVE-2026-86117 Coolify through 4.3.17 contains an authentication bypass vulnerability in the OA... |
high | 8.1 | — | — | 2026-09-05 | 2026-09-10 |
| CVE-2026-85623 goose 1.37.0 executes arbitrary commands from recipe stdio extensions and retry.... |
high | 8.8 | — | — | 2026-09-04 | 2026-09-10 |
| CVE-2026-85664 Chroma 1.5.9 fails to validate maximum bounds on HNSW index parameters max_neigh... |
high | 7.5 | — | — | 2026-09-04 | 2026-09-10 |
| CVE-2026-85674 aider (aider-chat) automatically loads a .aider.conf.yml configuration file from... |
high | 7.8 | — | — | 2026-09-04 | 2026-09-10 |
| CVE-2026-85581 SiYuan before v3.8.2 contains a denial of service vulnerability in the unauthent... |
high | 7.5 | — | — | 2026-09-04 | 2026-09-10 |
| CVE-2026-85610 OpenPanel before 2.3.0 fails to properly validate chart formula expressions, all... |
high | 8.8 | — | — | 2026-09-04 | 2026-09-10 |
| CVE-2026-85525 Improper OCSP response validation in the Snowflake Python, Go, JDBC, and Node.js... |
high | 7.4 | — | — | 2026-09-04 | 2026-09-10 |
| CVE-2026-81799 Unauthenticated Broken Access Control in Return Refund and Exchange For WooComme... |
high | 7.5 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-81805 Unauthenticated Privilege Escalation in SiteSkite <= 2.1.5 versions. |
high | 8.1 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-80113 PassMark PerformanceTest before 11.1 build 1012, BurnInTest before 11.1 build 10... |
high | 7.1 | — | — | 2026-09-04 | 2026-09-10 |
| CVE-2026-80118 PassMark PerformanceTest before 11.1 build 1012, BurnInTest before 11.1 build 10... |
high | 7.1 | — | — | 2026-09-04 | 2026-09-10 |
| CVE-2026-77110 Adobe Commerce is affected by an Improper Limitation of a Pathname to a Restrict... |
high | 7.6 | — | Adobe / commerce | 2026-09-08 | 2026-09-10 |
| CVE-2026-71808 A SQL Injection vulnerability in Siam Ordering (siam-server) 1.0.0 allows remote... |
high | 8.8 | — | — | 2026-09-09 | 2026-09-10 |
| CVE-2026-71613 Buffer Overflow vulnerability in GPAC c2dee3aff638cd96f9617ac5b17dc2868cd90ef3 a... |
high | 7.8 | — | — | 2026-09-09 | 2026-09-10 |
| CVE-2026-42804 A stack-based buffer overflow vulnerability exists in the Bosch Sensortec BHI360... |
high | 7.6 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-42805 A stack-based buffer overflow vulnerability exists in the Bosch Sensortec BHI385... |
high | 8.4 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-42807 A heap-based buffer overflow vulnerability in the PC bridge protocol decoder of... |
high | 8.0 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-19298 IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacke... |
high | 8.8 | — | Langflow / langflow | 2026-09-04 | 2026-09-10 |
| CVE-2026-16826 IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local attacker to execute arbitrary c... |
high | 7.8 | — | Ibm / i | 2026-09-04 | 2026-09-10 |
| CVE-2026-17255 IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of... |
high | 7.5 | — | Ibm / i | 2026-09-04 | 2026-09-10 |
| CVE-2026-81992 Acrobat Reader is affected by a Heap-based Buffer Overflow vulnerability that co... |
high | 7.8 | — | Adobe / acrobat | 2026-09-08 | 2026-09-10 |
| CVE-2026-81987 Acrobat Reader is affected by an Integer Overflow or Wraparound vulnerability th... |
high | 7.8 | — | Adobe / acrobat | 2026-09-08 | 2026-09-10 |
| CVE-2026-80161 Acrobat Reader is affected by an Access of Resource Using Incompatible Type ('Ty... |
high | 7.8 | — | Adobe / acrobat | 2026-09-08 | 2026-09-10 |
| CVE-2026-79907 Acrobat Reader is affected by a Double Free vulnerability that could result in a... |
high | 7.8 | — | Adobe / acrobat | 2026-09-08 | 2026-09-10 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.