September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,290
Critical
1,223
High
4,344
Medium
4,103
Low
460
Severity not reported
1,160
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-84533 A cryptographic issue was addressed with improved integrity checks. |
medium | 5.3 | — | Apple / ipados | 2026-09-14 | 2026-09-17 |
| CVE-2026-43696 An authorization issue was addressed with improved entitlement checks. |
medium | 5.3 | — | Apple / macos | 2026-09-14 | 2026-09-17 |
| CVE-2026-63461 Vendure is an open-source headless commerce platform. |
medium | 5.3 | — | — | 2026-09-17 | 2026-09-17 |
| CVE-2026-92527 A vulnerability has been found in chatwoot up to 4.17.1. |
medium | 6.3 | — | — | 2026-09-16 | 2026-09-17 |
| CVE-2026-86311 The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress... |
medium | 6.4 | — | — | 2026-09-17 | 2026-09-17 |
| CVE-2026-66573 Contributor Cross Site Scripting (XSS) in JetTabs <= 2.3.3.1 versions. |
medium | 6.5 | — | — | 2026-09-17 | 2026-09-17 |
| CVE-2026-66575 Unauthenticated Insecure Direct Object References (IDOR) in King Addons for Elem... |
medium | 5.3 | — | — | 2026-09-17 | 2026-09-17 |
| CVE-2026-66576 Contributor Cross Site Scripting (XSS) in JetBlocks For Elementor <= 1.5.2 versi... |
medium | 6.5 | — | — | 2026-09-17 | 2026-09-17 |
| CVE-2026-66578 Contributor Cross Site Scripting (XSS) in PropertyHive <= 2.2.6 versions. |
medium | 6.5 | — | — | 2026-09-17 | 2026-09-17 |
| CVE-2026-66608 Contributor Server Side Request Forgery (SSRF) in Unlimited Elements For Element... |
medium | 6.4 | — | — | 2026-09-17 | 2026-09-17 |
| CVE-2026-66676 Unauthenticated Broken Access Control in Easy Invoice <= 2.3.8 versions. |
medium | 5.3 | — | — | 2026-09-17 | 2026-09-17 |
| CVE-2026-74000 Contributor Broken Access Control in Simple Membership <= 4.8.2 versions. |
medium | 5.3 | — | — | 2026-09-17 | 2026-09-17 |
| CVE-2026-74005 Unauthenticated Cross Site Request Forgery (CSRF) in PublishPress Series <= 3.1.... |
medium | 5.4 | — | — | 2026-09-17 | 2026-09-17 |
| CVE-2026-74017 Unauthenticated Broken Access Control in User Registration <= 5.2.7 versions. |
medium | 5.3 | — | — | 2026-09-17 | 2026-09-17 |
| CVE-2026-92879 A security flaw has been discovered in vgmstream up to r2117. |
medium | 4.3 | — | — | 2026-09-17 | 2026-09-17 |
| CVE-2026-92992 A security vulnerability has been detected in Dromara mayfly-go up to 1.11.5. |
medium | 6.3 | — | — | 2026-09-17 | 2026-09-17 |
| CVE-2026-91944 crawl4ai versions before 0.9.3 contain a DOM-based cross-site scripting vulnerab... |
medium | 6.1 | — | — | 2026-09-15 | 2026-09-17 |
| CVE-2026-91969 vikunja versions before 2.6.0 contain a resource exhaustion vulnerability in the... |
medium | 6.5 | — | — | 2026-09-15 | 2026-09-17 |
| CVE-2026-91979 Vikunja before 2.6.0 fails to limit archive expansion during data import, allowi... |
medium | 6.5 | — | — | 2026-09-15 | 2026-09-17 |
| CVE-2026-91984 Vikunja before 2.6.0 fails to validate that user-supplied project_view_id in tas... |
medium | 4.3 | — | — | 2026-09-15 | 2026-09-17 |
| CVE-2026-86465 Apache Airflow Akeyless provider: the Akeyless secrets backend's team-scope guar... |
medium | 6.5 | — | Apache / apache-airflow-providers-akeyless | 2026-09-16 | 2026-09-17 |
| CVE-2026-85875 Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to... |
medium | 5.5 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-17 |
| CVE-2026-81958 Use of uninitialized resource in Microsoft Office Excel allows an unauthorized a... |
medium | 5.5 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-17 |
| CVE-2026-81395 Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to... |
medium | 5.5 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-17 |
| CVE-2026-81399 Buffer over-read in Microsoft Office Excel allows an unauthorized attacker to di... |
medium | 5.5 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-17 |
| CVE-2026-81400 Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to... |
medium | 5.5 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-17 |
| CVE-2026-81401 Access of resource using incompatible type ('type confusion') in Microsoft Offic... |
medium | 5.5 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-17 |
| CVE-2026-81390 Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to... |
medium | 5.5 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-17 |
| CVE-2026-81391 Use of uninitialized resource in Microsoft Office Excel allows an unauthorized a... |
medium | 5.5 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-17 |
| CVE-2026-81392 Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to... |
medium | 5.5 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-17 |
| CVE-2026-81393 Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to... |
medium | 5.5 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-17 |
| CVE-2026-81394 Exposure of sensitive system information to an unauthorized control sphere in Mi... |
medium | 5.5 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-17 |
| CVE-2026-81387 Exposure of sensitive system information to an unauthorized control sphere in Mi... |
medium | 5.5 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-17 |
| CVE-2026-80091 Use of uninitialized resource in Microsoft Office allows an unauthorized attacke... |
medium | 6.5 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-17 |
| CVE-2026-80086 Out-of-bounds read in Microsoft Office PowerPoint allows an unauthorized attacke... |
medium | 6.5 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-17 |
| CVE-2026-80087 Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker t... |
medium | 6.5 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-17 |
| CVE-2026-80088 Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to d... |
medium | 6.5 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-17 |
| CVE-2026-80089 Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclo... |
medium | 6.5 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-17 |
| CVE-2026-80090 Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to d... |
medium | 6.5 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-17 |
| CVE-2026-80076 Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclo... |
medium | 6.5 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-17 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.