September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,290
Critical
1,223
High
4,344
Medium
4,103
Low
460
Severity not reported
1,160
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-21822 HCLSoftware AppScan 360° was affected by a Path Traversal vulnerability in the A... |
medium | 6.3 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-86909 A logic issue was addressed with improved state management. |
medium | 4.4 | — | Apple / macos | 2026-09-14 | 2026-09-18 |
| CVE-2026-20120 A vulnerability in the access control list (ACL) Object Group Search (OGS) imple... |
medium | 5.8 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-20121 A vulnerability in the access control list (ACL) Object Group Search (OGS) imple... |
medium | 5.3 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-20248 A vulnerability in the DNS over TCP implementation of Cisco Secure Firewall Adap... |
medium | 6.8 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-20283 A vulnerability in the IPsec Open API endpoint of Cisco ISE could allow an authe... |
medium | 6.5 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-20286 A vulnerability in the web-based management interface of Cisco Identify Services... |
medium | 4.3 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-20287 As part of Cisco's ongoing commitment to proactive security and product quality,... |
medium | 6.5 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-20290 A vulnerability in SSL/TLS certificate parsing in the Snort 2 Detection Engine o... |
medium | 5.8 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-20309 A vulnerability in the web-based management interface of Cisco Identity Services... |
medium | 6.1 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-76438 A vulnerability in the web-based management interface of Cisco BroadWorks CommPi... |
medium | 6.5 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-93308 A vulnerability was found in O-RAN-SC SMO OAM 2025-06-10. |
medium | 4.3 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-93313 A vulnerability was found in Freedesktop Poppler 26.07.0. |
medium | 6.3 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-92991 The Biggop Library is vulnerable to Cross-Site Scripting via the ‘display_id’ pa... |
medium | 5.4 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-75016 The Magazine Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scri... |
medium | 6.4 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-89330 The EmbedPress – PDF Embedder, 3D PDF FlipBook, Google Reviews, YouTube Videos,... |
medium | 6.1 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-92714 The Download Manager plugin for WordPress is vulnerable to Insecure Direct Objec... |
medium | 6.5 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-14472 The Kubio AI Page Builder plugin for WordPress is vulnerable to Stored Cross-Sit... |
medium | 6.4 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-17607 The WP Inventory Manager plugin for WordPress is vulnerable to SQL Injection via... |
medium | 6.5 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-90981 The Newsletter – Send awesome emails from WordPress plugin for WordPress is vuln... |
medium | 6.1 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-90884 The WP Recipe Maker plugin for WordPress is vulnerable to Stored Cross-Site Scri... |
medium | 5.4 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-84635 A logic issue was addressed with improved state management. |
medium | 6.5 | — | Apple / safari | 2026-09-14 | 2026-09-18 |
| CVE-2026-58698 In ap_pmic_poll_msg_handler of ap_pmic_ipc.c, there is a possible permission byp... |
medium | 6.7 | — | Google / android | 2026-09-15 | 2026-09-18 |
| CVE-2026-58716 In multiple locations, there is a possible time-of-check to time-of-use due to a... |
medium | 6.7 | — | Google / android | 2026-09-15 | 2026-09-18 |
| CVE-2026-58773 In link_load_gnss_image of link_device.c, there is a possible out-of-bounds writ... |
medium | 6.7 | — | Google / android | 2026-09-15 | 2026-09-18 |
| CVE-2026-86924 A memory corruption issue was addressed with improved input validation. |
medium | 5.5 | — | Apple / ipados | 2026-09-14 | 2026-09-18 |
| CVE-2026-58767 In multiple functions of arm-smmu-v3.c, there is a possible escalation of privil... |
medium | 6.7 | — | Google / android | 2026-09-15 | 2026-09-18 |
| CVE-2026-58765 In GPU, there is a possible permission bypass due to a logic error in the code. |
medium | 6.7 | — | Google / android | 2026-09-15 | 2026-09-18 |
| CVE-2026-58755 In smmu_install_nested_ste of arm-smmu-v3.c, there is a possible escalation of p... |
medium | 6.7 | — | Google / android | 2026-09-15 | 2026-09-18 |
| CVE-2026-58751 In multiple functions of arm-smmu-v3.c, there is a possible use-after-free due t... |
medium | 6.7 | — | Google / android | 2026-09-15 | 2026-09-18 |
| CVE-2026-58747 In smmu_detach_dev of arm-smmu-v3.c, there is a possible permission bypass due t... |
medium | 6.7 | — | Google / android | 2026-09-15 | 2026-09-18 |
| CVE-2026-58739 In platform_msg_handler_init of default_msg_handlers.c, there is a possible conf... |
medium | 6.7 | — | Google / android | 2026-09-15 | 2026-09-18 |
| CVE-2026-58731 In multiple functions of physmem_extmem_linux.c, there is a possible out-of-boun... |
medium | 6.2 | — | Google / android | 2026-09-15 | 2026-09-18 |
| CVE-2026-58726 In FsmReleaseKey of fsm.c, there is a possible permission bypass due to a missin... |
medium | 6.7 | — | Google / android | 2026-09-15 | 2026-09-18 |
| CVE-2026-58718 In smmu_detach_dev_nested of arm-smmu-v3.c, there is a possible escalation of pr... |
medium | 6.7 | — | Google / android | 2026-09-15 | 2026-09-18 |
| CVE-2026-58721 In multiple locations, there is a possible information disclosure due to uniniti... |
medium | 4.4 | — | Google / android | 2026-09-15 | 2026-09-18 |
| CVE-2026-86911 This issue was addressed with improved state management. |
medium | 5.5 | — | Apple / macos | 2026-09-14 | 2026-09-18 |
| CVE-2026-86897 This issue was addressed with additional entitlement checks. |
medium | 5.5 | — | Apple / safari | 2026-09-14 | 2026-09-18 |
| CVE-2026-86910 A permissions issue was addressed with improved path validation. |
medium | 5.5 | — | Apple / macos | 2026-09-14 | 2026-09-18 |
| CVE-2026-85544 Some Hikvision intercom products utilize an immutable factory value which should... |
medium | 6.1 | — | — | 2026-09-10 | 2026-09-18 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.