September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,290
Critical
1,223
High
4,344
Medium
4,103
Low
460
Severity not reported
1,160
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-87467 Race condition in Updater in Google Chrome on on Windows prior to 153.0.8010.36... |
high | 8.1 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87479 Insufficient policy enforcement in Extensions in Google Chrome prior to 153.0.80... |
high | 8.3 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87480 Use after free in Printing in Google Chrome prior to 153.0.8010.36 allowed a rem... |
high | 8.3 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87440 Out of bounds read in Media in Google Chrome prior to 153.0.8010.36 allowed a re... |
high | 8.8 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87444 Memory corruption in Codecs in Google Chrome prior to 153.0.8010.36 allowed a re... |
high | 8.8 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87457 Race condition in Updater in Google Chrome on on Windows prior to 153.0.8010.36... |
high | 8.1 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87460 Use after free in Platform in Google Chrome prior to 153.0.8010.36 allowed a rem... |
high | 8.8 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87430 Buffer overflow in WebRTC in Google Chrome prior to 153.0.8010.36 allowed a remo... |
high | 8.8 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2022-37969 Microsoft Windows Common Log File System (CLFS) Driver Privilege Escalation Vuln... |
high | 7.8 | Listed | Microsoft / Windows | 2022-09-13 | 2026-09-10 |
| CVE-2016-7255 Microsoft Win32k Privilege Escalation Vulnerability |
high | 7.8 | Listed | Microsoft / Win32k | 2016-11-10 | 2026-09-10 |
| CVE-2026-84942 Improper input validation in the Vega expression function implementation in Open... |
high | 8.7 | — | — | 2026-09-08 | 2026-09-09 |
| CVE-2026-49310 Permission control vulnerability in the event notification module. |
high | 8.6 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-49314 OOB write vulnerability in the rendering and composition module. |
high | 7.3 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-49315 DoS vulnerability in the input device module. |
high | 7.1 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-84366 Scrapy is a high-level web crawling and scraping framework for Python. |
high | 7.4 | — | — | 2026-09-01 | 2026-09-09 |
| CVE-2026-84370 SVGO, short for SVG Optimizer, is a Node.js library and command-line application... |
high | 8.2 | — | — | 2026-09-01 | 2026-09-09 |
| CVE-2026-84374 Laravel Excel provides supercharged Excel exports and imports in Laravel. |
high | 7.5 | — | — | 2026-09-01 | 2026-09-09 |
| CVE-2026-84989 ntopng is a web-based network traffic monitoring application. |
high | 7.1 | — | — | 2026-09-03 | 2026-09-09 |
| CVE-2026-48486 Signum Node is a HDD-mined cryptocurrency using an energy efficient and fair Pro... |
high | 7.5 | — | — | 2026-09-03 | 2026-09-09 |
| CVE-2026-63219 GeoNetwork is a catalog application to manage spatially referenced resources. |
high | 8.6 | — | — | 2026-09-03 | 2026-09-09 |
| CVE-2026-33630 c-ares is an asynchronous resolver library. |
high | 7.5 | — | — | 2026-09-03 | 2026-09-09 |
| CVE-2026-44506 Medplum is a developer platform that enables development of healthcare apps. |
high | 8.2 | — | — | 2026-09-03 | 2026-09-09 |
| CVE-2026-53728 Medplum is a developer platform that enables development of healthcare apps. |
high | 7.1 | — | — | 2026-09-03 | 2026-09-09 |
| CVE-2026-63376 toml-node is a TOML parser for Node.js and the browser. |
high | 8.2 | — | — | 2026-09-03 | 2026-09-09 |
| CVE-2026-77465 toml-node is a TOML parser for Node.js and the browser. |
high | 7.5 | — | — | 2026-09-03 | 2026-09-09 |
| CVE-2026-49832 DSpace open source software is a repository application which provides durable a... |
high | 8.0 | — | — | 2026-09-02 | 2026-09-09 |
| CVE-2026-84381 HTTPX2 is a next generation HTTP client for Python. |
high | 8.1 | — | — | 2026-09-02 | 2026-09-09 |
| CVE-2026-84382 HTTPX2 is a next generation HTTP client for Python. |
high | 7.5 | — | — | 2026-09-02 | 2026-09-09 |
| CVE-2026-45730 Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. |
high | 8.3 | — | — | 2026-09-02 | 2026-09-09 |
| CVE-2026-52831 Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. |
high | 8.0 | — | — | 2026-09-02 | 2026-09-09 |
| CVE-2026-52833 Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. |
high | 8.0 | — | — | 2026-09-02 | 2026-09-09 |
| CVE-2026-53635 Open edX Platform enables the authoring and delivery of online learning at any s... |
high | 7.6 | — | — | 2026-09-02 | 2026-09-09 |
| CVE-2026-79755 Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. |
high | 8.0 | — | — | 2026-09-02 | 2026-09-09 |
| CVE-2026-82404 TOON is a compact, human-readable serialization of JSON data for LLM prompts. |
high | 8.3 | — | — | 2026-09-02 | 2026-09-09 |
| CVE-2026-85091 zlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vulnerability... |
high | 7.4 | — | — | 2026-09-03 | 2026-09-09 |
| CVE-2026-79572 An XXE (XML External Entity) vulnerability in the level-rule module of Distribut... |
high | 7.5 | — | — | 2026-09-08 | 2026-09-09 |
| CVE-2026-79617 Incorrect Permission Assignment for Critical Resource vulnerability in TÜBİTAK B... |
high | 7.1 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-78839 An arbitrary file upload vulnerability in AppNitro MachForm v30 allows attackers... |
high | 8.1 | — | — | 2026-09-04 | 2026-09-09 |
| CVE-2026-75166 Insecure Permission vulnerability in MBS-Solutions X-Serie Gateway firmware V6_0... |
high | 8.8 | — | — | 2026-09-04 | 2026-09-09 |
| CVE-2026-71622 SQL injection vulnerability in Zhao-github APiAdmin v.5.0.1 allows a remote atta... |
high | 7.4 | — | — | 2026-09-04 | 2026-09-09 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.