September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,321
Critical
1,226
High
4,361
Medium
4,108
Low
460
Severity not reported
1,166
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (964), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-73010 Use after free in Windows Failover Cluster allows an unauthorized attacker to ex... |
critical | 9.8 | — | Microsoft / windows 10 1809 | 2026-09-08 | 2026-09-17 |
| CVE-2026-92395 @fastify/proxy-addr is a Fastify plugin that determines a request's client addre... |
critical | 9.1 | — | — | 2026-09-16 | 2026-09-17 |
| CVE-2026-91738 Improper input validation in ANGLE in Google Chrome prior to 153.0.8010.47 allow... |
critical | 9.6 | — | Google / chrome | 2026-09-15 | 2026-09-17 |
| CVE-2026-12793 The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnera... |
critical | 9.8 | — | — | 2026-09-16 | 2026-09-17 |
| CVE-2026-20274 As part of Cisco's ongoing commitment to proactive security and product quality,... |
critical | 9.8 | — | Cisco / ios xr | 2026-09-02 | 2026-09-17 |
| CVE-2026-91729 Use after free in DigitalCredentials in Google Chrome prior to 153.0.8010.47 all... |
critical | 9.6 | — | Google / chrome | 2026-09-15 | 2026-09-17 |
| CVE-2026-91728 Integer overflow in V8 in Google Chrome prior to 153.0.8010.47 allowed a remote... |
critical | 9.6 | — | Google / chrome | 2026-09-15 | 2026-09-17 |
| CVE-2026-65381 A validation issue existed in the entitlement verification. |
critical | 10.0 | — | Apple / macos | 2026-09-14 | 2026-09-17 |
| CVE-2026-43790 The issue was addressed with improved memory handling. |
critical | 9.1 | — | Apple / macos | 2026-09-14 | 2026-09-17 |
| CVE-2026-11921 IBM Verify Identity Access containers may not apply management password change o... |
critical | 9.1 | — | — | 2026-09-15 | 2026-09-17 |
| CVE-2026-11928 IBM Verify Identity Access is vulnerable to a buffer overflow attack. |
critical | 9.8 | — | — | 2026-09-15 | 2026-09-17 |
| CVE-2026-92941 vm2 versions from 3.11.3 before 3.11.7 expose the host tls module to NodeVM sand... |
critical | 10.0 | — | — | 2026-09-17 | 2026-09-17 |
| CVE-2026-92947 vm2 before 3.11.7 exposes Node's shared Buffer pool to sandboxed code, allowing... |
critical | 10.0 | — | — | 2026-09-17 | 2026-09-17 |
| CVE-2026-83229 Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (compone... |
critical | 9.1 | — | — | 2026-09-15 | 2026-09-17 |
| CVE-2026-83103 Vulnerability in the Oracle Forms product of Oracle Fusion Middleware (component... |
critical | 9.1 | — | — | 2026-09-15 | 2026-09-17 |
| CVE-2026-83105 Vulnerability in the Oracle Forms product of Oracle Fusion Middleware (component... |
critical | 9.0 | — | — | 2026-09-15 | 2026-09-17 |
| CVE-2026-83107 Vulnerability in the Oracle Forms product of Oracle Fusion Middleware (component... |
critical | 9.1 | — | — | 2026-09-15 | 2026-09-17 |
| CVE-2026-83064 Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware... |
critical | 9.1 | — | — | 2026-09-15 | 2026-09-17 |
| CVE-2026-83058 Vulnerability in the Oracle Internet Directory product of Oracle Fusion Middlewa... |
critical | 9.9 | — | — | 2026-09-15 | 2026-09-17 |
| CVE-2026-83056 Vulnerability in the Oracle Internet Directory product of Oracle Fusion Middlewa... |
critical | 9.9 | — | — | 2026-09-15 | 2026-09-17 |
| CVE-2026-83057 Vulnerability in the Oracle Internet Directory product of Oracle Fusion Middlewa... |
critical | 9.9 | — | — | 2026-09-15 | 2026-09-17 |
| CVE-2026-83055 Vulnerability in the Oracle Internet Directory product of Oracle Fusion Middlewa... |
critical | 9.9 | — | — | 2026-09-15 | 2026-09-17 |
| CVE-2026-92955 vm2 before 3.11.8 contains a sandbox escape vulnerability in NodeVM that allows... |
critical | 10.0 | — | — | 2026-09-17 | 2026-09-17 |
| CVE-2026-92960 vm2 before 3.11.6 fails to restrict access to os and dns builtins under the buil... |
critical | 10.0 | — | — | 2026-09-17 | 2026-09-17 |
| CVE-2026-92934 vm2 before 3.11.8 contains an incomplete fix for Error.cause sanitization that a... |
critical | 9.0 | — | — | 2026-09-17 | 2026-09-17 |
| CVE-2026-92939 vm2 3.11.3 through 3.11.6 exposes the host Node.js crypto module to a NodeVM san... |
critical | 9.9 | — | — | 2026-09-17 | 2026-09-17 |
| CVE-2026-57139 PraisonAI is a multi-agent teams system. |
critical | 9.8 | — | — | 2026-09-15 | 2026-09-17 |
| CVE-2026-57147 PraisonAI is a multi-agent teams system. |
critical | 9.8 | — | — | 2026-09-15 | 2026-09-17 |
| CVE-2026-83282 Vulnerability in the Oracle Business Intelligence Enterprise Edition product of... |
critical | 9.9 | — | — | 2026-09-15 | 2026-09-17 |
| CVE-2026-83260 Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component:... |
critical | 9.1 | — | — | 2026-09-15 | 2026-09-17 |
| CVE-2026-83268 Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component:... |
critical | 9.1 | — | — | 2026-09-15 | 2026-09-17 |
| CVE-2026-83196 Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (compone... |
critical | 9.1 | — | — | 2026-09-15 | 2026-09-17 |
| CVE-2026-57138 PraisonAI is a multi-agent teams system. |
critical | 9.9 | — | — | 2026-09-15 | 2026-09-17 |
| CVE-2026-91718 Use after free in Core in Google Chrome prior to 153.0.8010.47 allowed a remote... |
critical | 9.6 | — | Google / chrome | 2026-09-15 | 2026-09-17 |
| CVE-2026-91716 Use after free in Auth in Google Chrome prior to 153.0.8010.47 allowed a remote... |
critical | 9.6 | — | Google / chrome | 2026-09-15 | 2026-09-17 |
| CVE-2026-91710 Use after free in WebAppInstalls in Google Chrome prior to 153.0.8010.47 allowed... |
critical | 9.6 | — | Google / chrome | 2026-09-15 | 2026-09-17 |
| CVE-2026-76420 A vulnerability in the internal configuration of the Apache JServ Protocol (AJP)... |
critical | 9.0 | — | — | 2026-09-16 | 2026-09-17 |
| CVE-2026-76423 A vulnerability in the REST API of Cisco ISE and Cisco ISE-PIC could allow an un... |
critical | 10.0 | — | — | 2026-09-16 | 2026-09-17 |
| CVE-2026-73447 A privileged attacker can exploit certain operation to execute arbitrary command... |
critical | 9.1 | — | — | 2026-09-16 | 2026-09-17 |
| CVE-2026-73456 Under certain circumstances on affected platforms running Arista EOS with gRPC N... |
critical | 10.0 | — | — | 2026-09-16 | 2026-09-17 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.