September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,290
Critical
1,223
High
4,344
Medium
4,103
Low
460
Severity not reported
1,160
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-67071 HCL DevOps Deploy / HCL Launch is susceptible to an information disclosure vulne... |
medium | 6.5 | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-4036 An improper neutralization of special elements used in an SQL command ('SQL inje... |
medium | 6.5 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-40531 An integer overflow or wraparound vulnerability in File Operation in Synology Di... |
medium | 4.3 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-40532 A direct request ('forced browsing') vulnerability in Wallpaper Path in Synology... |
medium | 6.5 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-16777 The Store Exporter – Export WooCommerce Products, Orders, Subscriptions, Custome... |
medium | 4.9 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-13635 An improper encoding or escaping of output vulnerability in Auth API in Synology... |
medium | 5.3 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-13471 The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for W... |
medium | 4.3 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-11757 Improper neutralization of input during web page generation ('cross-site scripti... |
medium | 6.1 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-56988 In multiple functions of bluetooth_cco.cc, there is a possible use-after-free du... |
medium | 6.4 | — | Google / android | 2026-09-15 | 2026-09-18 |
| CVE-2026-56972 In multiple locations, there is a possible out-of-bounds write due to an incorre... |
medium | 6.7 | — | Google / android | 2026-09-15 | 2026-09-18 |
| CVE-2026-56973 In multiple locations, there is a possible escalation of privilege due to a logi... |
medium | 6.7 | — | Google / android | 2026-09-15 | 2026-09-18 |
| CVE-2026-56975 In Cellular Modem, there is a possible denial of service due to improper input v... |
medium | 6.5 | — | Google / android | 2026-09-15 | 2026-09-18 |
| CVE-2026-56979 In multiple locations, there is a possible permission bypass due to a logic erro... |
medium | 6.7 | — | Google / android | 2026-09-15 | 2026-09-18 |
| CVE-2026-85083 The ANJIA AJL33PC0801 IP camera uses a hard-coded credential for bootloader auth... |
medium | 6.8 | — | — | 2026-09-11 | 2026-09-18 |
| CVE-2026-68953 The affected products are vulnerable to an authentication bypass that allows una... |
medium | 6.5 | — | — | 2026-09-15 | 2026-09-18 |
| CVE-2026-84524 An out-of-bounds read was addressed with improved bounds checking. |
medium | 4.3 | — | Apple / ipados | 2026-09-14 | 2026-09-18 |
| CVE-2026-66372 The affected products use insufficiently random values, which allows web session... |
medium | 6.8 | — | — | 2026-09-15 | 2026-09-18 |
| CVE-2026-84526 An out-of-bounds write issue was addressed with improved bounds checking. |
medium | 4.3 | — | Apple / ipados | 2026-09-14 | 2026-09-18 |
| CVE-2026-84532 An out-of-bounds read issue was addressed with improved input validation. |
medium | 5.4 | — | Apple / ipados | 2026-09-14 | 2026-09-18 |
| CVE-2026-82567 The myPRO Manager notification gateway exposes an unauthenticated HTTP endpoint... |
medium | 6.3 | — | — | 2026-09-15 | 2026-09-18 |
| CVE-2026-90439 NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_v3_module... |
medium | 6.5 | — | — | 2026-09-15 | 2026-09-18 |
| CVE-2026-1759 Improper handling of insufficient permissions or privileges vulnerability in Sec... |
medium | 6.5 | — | — | 2026-09-15 | 2026-09-18 |
| CVE-2026-91826 Stack-based buffer overflow vulnerability in Samsung Opensource rLottie allows a... |
medium | 4.4 | — | — | 2026-09-15 | 2026-09-18 |
| CVE-2026-92259 Integer overflow or wraparound vulnerability in Samsung Opensource Escargot allo... |
medium | 5.5 | — | — | 2026-09-15 | 2026-09-18 |
| CVE-2026-89207 A vulnerability has been identified in WTV676-HB6035 Web Interface (All versions... |
medium | 6.5 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-28966 An out-of-bounds write issue was addressed with improved bounds checking. |
medium | 4.3 | — | Apple / ipados | 2026-09-14 | 2026-09-18 |
| CVE-2026-19596 An XML External Entity (XXE) vulnerability exists in the XML collector of multip... |
medium | 5.9 | — | — | 2026-09-10 | 2026-09-18 |
| CVE-2026-89089 A SQL injection vulnerability exists in the JasperReports-based reporting featur... |
medium | 6.5 | — | — | 2026-09-10 | 2026-09-18 |
| CVE-2026-59341 A security vulnerability exists in the Sealed Secrets controller's unauthenticat... |
medium | 4.2 | — | — | 2026-09-15 | 2026-09-18 |
| CVE-2026-28968 An out-of-bounds write issue was addressed with improved bounds checking. |
medium | 5.5 | — | Apple / ipados | 2026-09-14 | 2026-09-18 |
| CVE-2026-87076 Tanium addressed an information disclosure vulnerability in Discover. |
medium | 6.5 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-87113 Tanium addressed an improper access controls vulnerability in Threat Response. |
medium | 6.3 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-87116 Tanium addressed a server-side request forgery vulnerability in Threat Response. |
medium | 6.5 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-65360 A race condition was addressed with improved state handling. |
medium | 4.7 | — | Apple / ipados | 2026-09-14 | 2026-09-18 |
| CVE-2026-84859 ScadaLTS 2.8.1-release-candidate build 0 is affected by an Authenticated Blind S... |
medium | 6.5 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-92413 A flaw has been found in Artifex MuPDF up to b6d17493700c621c0e70036980a6ebd06d2... |
medium | 4.3 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-83278 Vulnerability in the Helidon product of Oracle Fusion Middleware (component: hel... |
medium | 6.8 | — | — | 2026-09-15 | 2026-09-18 |
| CVE-2026-90890 ASRock Polychrome SYNC/RGB software utility developed by ASRock Inc. |
medium | 5.5 | — | — | 2026-09-14 | 2026-09-18 |
| CVE-2026-90891 ASRock Polychrome SYNC/RGB software utility developed by ASRock Inc. |
medium | 5.5 | — | — | 2026-09-14 | 2026-09-18 |
| CVE-2026-93531 A weakness has been identified in gedelumbung HospitalManagement up to c2d455437... |
medium | 4.3 | — | — | 2026-09-18 | 2026-09-18 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.