September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,290
Critical
1,223
High
4,344
Medium
4,103
Low
460
Severity not reported
1,160
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-56989 In multiple locations, there is a possible out-of-bounds write due to a missing... |
medium | 6.7 | — | Google / android | 2026-09-15 | 2026-09-18 |
| CVE-2026-56992 In multiple files, there is a possible permission bypass due to a confused deput... |
medium | 6.7 | — | Google / android | 2026-09-15 | 2026-09-18 |
| CVE-2026-84636 An authorization issue was addressed with improved state management. |
medium | 5.5 | — | Apple / ipados | 2026-09-14 | 2026-09-18 |
| CVE-2026-57035 In multiple locations, there is a possible out-of-bounds write due to a missing... |
medium | 6.7 | — | Google / android | 2026-09-15 | 2026-09-18 |
| CVE-2026-57042 In multiple functions of DreamPickerReceiver.kt, there is a possible permission... |
medium | 6.7 | — | Google / android | 2026-09-15 | 2026-09-18 |
| CVE-2026-84567 The issue was addressed with improved memory handling. |
medium | 5.5 | — | Apple / macos | 2026-09-14 | 2026-09-18 |
| CVE-2026-84564 An uninitialized memory issue was addressed with improved memory initialization. |
medium | 4.3 | — | Apple / ipados | 2026-09-14 | 2026-09-18 |
| CVE-2026-84531 An out-of-bounds write issue was addressed with improved bounds checking. |
medium | 6.2 | — | Apple / ipados | 2026-09-14 | 2026-09-18 |
| CVE-2026-84527 A logging issue was addressed with improved data redaction. |
medium | 5.5 | — | Apple / ipados | 2026-09-14 | 2026-09-18 |
| CVE-2026-93383 Information leak in Permissions in Google Chrome prior to 153.0.8010.52 allowed... |
medium | 4.3 | — | Google / chrome | 2026-09-17 | 2026-09-18 |
| CVE-2026-93385 Information leak in Paint in Google Chrome prior to 153.0.8010.52 allowed a remo... |
medium | 6.5 | — | Google / chrome | 2026-09-17 | 2026-09-18 |
| CVE-2026-93386 UI misrepresentation in WebAppInstalls in Google Chrome prior to 153.0.8010.52 a... |
medium | 5.4 | — | Google / chrome | 2026-09-17 | 2026-09-18 |
| CVE-2026-83347 Vulnerability in the Oracle Net Services component of Oracle Database Server. |
medium | 6.5 | — | — | 2026-09-15 | 2026-09-18 |
| CVE-2026-93387 Improper state validation in Skia in Google Chrome prior to 153.0.8010.52 allowe... |
medium | 4.3 | — | Google / chrome | 2026-09-17 | 2026-09-18 |
| CVE-2026-84514 This issue was addressed with additional entitlement checks. |
medium | 5.5 | — | Apple / macos | 2026-09-14 | 2026-09-18 |
| CVE-2026-84513 A privacy issue was addressed with improved private data redaction for log entri... |
medium | 5.5 | — | Apple / ipados | 2026-09-14 | 2026-09-18 |
| CVE-2026-84510 A heap buffer overflow was addressed with improved bounds checking. |
medium | 6.5 | — | Apple / ipados | 2026-09-14 | 2026-09-18 |
| CVE-2026-86870 A heap buffer overflow was addressed with improved bounds checking. |
medium | 6.5 | — | Apple / ipados | 2026-09-14 | 2026-09-18 |
| CVE-2026-84574 A permissions issue was addressed with improved state management. |
medium | 4.4 | — | Apple / macos | 2026-09-14 | 2026-09-18 |
| CVE-2026-81921 Concrete CMS 8.5.3 through 9.5.2 enabled the OAuth 2.0 refresh-token grant using... |
medium | 5.4 | — | Concretecms / concrete cms | 2026-09-15 | 2026-09-18 |
| CVE-2026-81920 Concrete CMS below 9.5.3 was vulnerable to Cross-Site Request Forgery in the das... |
medium | 4.3 | — | Concretecms / concrete cms | 2026-09-15 | 2026-09-18 |
| CVE-2026-81919 Concrete CMS below 9.5.3 did not validate an anti-CSRF token on the block-arrang... |
medium | 4.3 | — | Concretecms / concrete cms | 2026-09-15 | 2026-09-18 |
| CVE-2026-81916 Concrete CMS before 9.5.3 evaluated the authorization check for an Express entry... |
medium | 4.3 | — | Concretecms / concrete cms | 2026-09-11 | 2026-09-18 |
| CVE-2026-81917 Concrete CMS below 9.5.3 does not apply HTML output escaping to the file descrip... |
medium | 5.4 | — | Concretecms / concrete cms | 2026-09-11 | 2026-09-18 |
| CVE-2026-91707 The The Divi theme for WordPress is vulnerable to arbitrary shortcode execution... |
medium | 5.3 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-92561 The Booking Calendar plugin for WordPress is vulnerable to Reflected Cross-Site... |
medium | 6.1 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-89064 The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to Ins... |
medium | 5.3 | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-89138 The Filter Gallery plugin for WordPress is vulnerable to authorization bypass in... |
medium | 4.3 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-89278 The GPTranslate – Multilingual AI Translation Agent for WordPress: Translate You... |
medium | 5.3 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-84909 The Custom Twitter Feeds – A Tweets Widget or X Feed Widget plugin for WordPress... |
medium | 6.4 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-75880 An authenticated client could attach a consumer with a selector containing craft... |
medium | 6.5 | — | Apache / artemis | 2026-09-10 | 2026-09-18 |
| CVE-2026-75017 The Magazine Blocks – Blog Designer, Magazine & Newspaper Website Builder, Page... |
medium | 4.3 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-20285 A vulnerability in the web-based management interface of Cisco Identity Services... |
medium | 4.3 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-20350 A vulnerability in the web-based management interface of Cisco ThousandEyes Virt... |
medium | 4.7 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-16582 The Booking for Appointments and Events Calendar – Amelia plugin for WordPress i... |
medium | 5.3 | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-17576 The InfiniteWP Client plugin for WordPress is vulnerable to SQL Injection via th... |
medium | 6.5 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-18317 The Foxtool All-in-One: Contact chat button, Custom login, Media optimize images... |
medium | 4.3 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-17586 The VK All in One Expansion Unit plugin for WordPress is vulnerable to Stored Cr... |
medium | 6.4 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-14311 The Booking for Appointments and Events Calendar – Amelia plugin for WordPress i... |
medium | 5.4 | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-15650 The RT Mega Menu – Mega Menu Builder for Elementor & Gutenberg plugin for WordPr... |
medium | 6.4 | — | — | 2026-09-18 | 2026-09-18 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.