September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,321
Critical
1,226
High
4,361
Medium
4,108
Low
460
Severity not reported
1,166
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (964), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-84383 libheif is a HEIF and AVIF file format decoder and encoder. |
critical | 9.8 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-20325 As part of Cisco's ongoing commitment to proactive security and product quality,... |
critical | 9.9 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-86462 Apache Airflow FAB provider: changing a user's password through the Admin user-e... |
critical | 9.1 | — | Apache / apache-airflow-providers-fab | 2026-09-16 | 2026-09-18 |
| CVE-2026-82311 Apache Airflow FAB provider: resetting a user's password does not delete that us... |
critical | 9.8 | — | Apache / apache-airflow-providers-fab | 2026-09-16 | 2026-09-18 |
| CVE-2026-76187 Apache Airflow Keycloak provider: the unauthenticated token endpoint accepts a c... |
critical | 9.8 | — | Apache / apache-airflow-providers-keycloak | 2026-09-16 | 2026-09-18 |
| CVE-2026-76186 Apache Airflow Keycloak provider: from Airflow 3.3 the Keycloak auth manager tak... |
critical | 9.1 | — | Apache / apache-airflow-providers-keycloak | 2026-09-16 | 2026-09-18 |
| CVE-2026-75156 Apache Airflow FAB provider versions 3.7.3 through 3.8.0 do not validate the iss... |
critical | 9.1 | — | Apache / apache-airflow-providers-fab | 2026-09-08 | 2026-09-18 |
| CVE-2026-75746 ColdFusion is affected by an Improper Neutralization of Special Elements used in... |
critical | 9.1 | — | Adobe / coldfusion | 2026-09-08 | 2026-09-18 |
| CVE-2026-87544 Incorrect authorization in Extensions in Google Chrome prior to 153.0.8010.36 al... |
critical | 9.8 | — | Google / chrome | 2026-09-09 | 2026-09-18 |
| CVE-2026-20237 As part of Cisco's ongoing commitment to proactive security and product quality,... |
critical | 9.1 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-20322 As part of Cisco's ongoing commitment to proactive security and product quality,... |
critical | 9.9 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-20326 As part of Cisco's ongoing commitment to proactive security and product quality,... |
critical | 9.8 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-28384 An improper sanitization of the compression_algorithm parameter in Canonical LXD... |
critical | 9.9 | — | Canonical / lxd | 2026-03-12 | 2026-09-18 |
| CVE-2026-20284 A vulnerability in the SXP REST API of Cisco ISE could allow an authenticated, r... |
critical | 9.1 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-47691 Netty is a network application framework for development of protocol servers and... |
critical | 10.0 | — | Netty / netty | 2026-06-12 | 2026-09-18 |
| CVE-2026-45674 Netty is a network application framework for development of protocol servers and... |
critical | 10.0 | — | Netty / netty | 2026-06-12 | 2026-09-18 |
| CVE-2026-42581 Netty is an asynchronous, event-driven network application framework. |
critical | 9.8 | — | Netty / netty | 2026-05-13 | 2026-09-18 |
| CVE-2026-42579 Netty is an asynchronous, event-driven network application framework. |
critical | 9.1 | — | Netty / netty | 2026-05-13 | 2026-09-18 |
| CVE-2026-27446 Missing Authentication for Critical Function (CWE-306) vulnerability in Apache A... |
critical | 9.8 | — | Apache / artemis | 2026-03-04 | 2026-09-18 |
| CVE-2026-20279 As part of Cisco's ongoing commitment to proactive security and product quality,... |
critical | 9.8 | — | — | 2026-09-02 | 2026-09-18 |
| CVE-2026-84609 A permissions issue was addressed with improved path validation. |
critical | 9.8 | — | Apple / ipados | 2026-09-14 | 2026-09-18 |
| CVE-2018-13410 Info-ZIP Zip 3.0, when the -T and -TT command-line options are used, allows atta... |
critical | 9.8 | — | Info-zip Project / zip | 2018-07-06 | 2026-09-18 |
| CVE-2026-20341 A vulnerability in the sftunnel inter-device communication protocol of Cisco Sec... |
critical | 9.1 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-20324 A vulnerability in the sftunnel inter-device communication protocol of Cisco Sec... |
critical | 9.9 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-20242 A vulnerability in the External Database Access feature of Cisco Secure Firewall... |
critical | 9.8 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-20194 As part of Cisco's ongoing commitment to proactive security and product quality,... |
critical | 9.1 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-68536 Server-Side Request Forgery / Local File Inclusion in Apache MyFace Core. |
critical | 9.8 | — | — | 2026-09-16 | 2026-09-17 |
| CVE-2026-63472 Vendure is an open-source headless commerce platform. |
critical | 9.1 | — | — | 2026-09-17 | 2026-09-17 |
| CVE-2026-62101 Unauthenticated Broken Authentication in EduAdmin Booking <= 5.4.2 versions. |
critical | 9.8 | — | — | 2026-09-17 | 2026-09-17 |
| CVE-2026-62108 Unauthenticated Broken Authentication in Headless Single Sign On <= 1.7.0 versio... |
critical | 9.8 | — | — | 2026-09-17 | 2026-09-17 |
| CVE-2026-92935 vm2 is a sandbox for running untrusted Node.js code. |
critical | 9.0 | — | — | 2026-09-17 | 2026-09-17 |
| CVE-2026-92940 vm2 versions 3.11.3 through 3.11.6 expose the host process's real https.globalAg... |
critical | 10.0 | — | — | 2026-09-17 | 2026-09-17 |
| CVE-2026-92946 vm2 before 3.11.7 contains a remote code execution vulnerability when require.ex... |
critical | 10.0 | — | — | 2026-09-17 | 2026-09-17 |
| CVE-2026-92951 vm2 before 3.11.7 contains an incorrect authorization vulnerability in the exter... |
critical | 9.9 | — | — | 2026-09-17 | 2026-09-17 |
| CVE-2026-92956 vm2 versions 3.10.1 through 3.11.6 contain a sandbox escape reachable from a def... |
critical | 10.0 | — | — | 2026-09-17 | 2026-09-17 |
| CVE-2026-78509 Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized at... |
critical | 9.8 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-17 |
| CVE-2026-67631 Heap-based buffer overflow in SQL Server allows an unauthorized attacker to exec... |
critical | 9.8 | — | Microsoft / sql server 2017 | 2026-09-08 | 2026-09-17 |
| CVE-2026-67636 Out-of-bounds read in SQL Server allows an unauthorized attacker to execute code... |
critical | 9.0 | — | Microsoft / sql server 2019 | 2026-09-08 | 2026-09-17 |
| CVE-2026-67643 Heap-based buffer overflow in SQL Server allows an unauthorized attacker to exec... |
critical | 9.8 | — | Microsoft / sql server 2022 | 2026-09-08 | 2026-09-17 |
| CVE-2026-67378 Untrusted pointer dereference in SQL Server allows an unauthorized attacker to e... |
critical | 9.0 | — | Microsoft / sql server 2019 | 2026-09-08 | 2026-09-17 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.