September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,290
Critical
1,223
High
4,344
Medium
4,103
Low
460
Severity not reported
1,160
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-73450 On affected platforms running Arista EOS with MLAG Dual Primary Detection config... |
medium | 6.9 | — | — | 2026-09-16 | 2026-09-17 |
| CVE-2026-65383 This issue was addressed with improved checks. |
medium | 4.4 | — | Apple / macos | 2026-09-14 | 2026-09-17 |
| CVE-2026-43785 A permissions issue was addressed with additional restrictions. |
medium | 5.5 | — | Apple / ipados | 2026-09-14 | 2026-09-17 |
| CVE-2026-16588 The WP Directory Kit plugin for WordPress is vulnerable to blind SQL Injection v... |
medium | 6.5 | — | — | 2026-09-16 | 2026-09-17 |
| CVE-2026-69316 Buffer over-read in Windows Overlay Filter allows an authorized attacker to disc... |
medium | 4.7 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-17 |
| CVE-2026-69344 Out-of-bounds read in Windows Print Spooler Components allows an authorized atta... |
medium | 5.5 | — | Microsoft / windows 10 21h2 | 2026-09-08 | 2026-09-17 |
| CVE-2026-91726 Out of bounds read in WebGL in Google Chrome on on Android prior to 153.0.8010.4... |
medium | 4.7 | — | Google / chrome | 2026-09-15 | 2026-09-17 |
| CVE-2026-91725 Observable discrepancy in CSS in Google Chrome prior to 153.0.8010.47 allowed a... |
medium | 5.3 | — | Google / chrome | 2026-09-15 | 2026-09-17 |
| CVE-2026-91720 Uninitialized resource in ANGLE in Google Chrome prior to 153.0.8010.47 allowed... |
medium | 4.7 | — | Google / chrome | 2026-09-15 | 2026-09-17 |
| CVE-2026-92416 A vulnerability has been found in Open5GS up to 2.8.0. |
medium | 4.3 | — | — | 2026-09-16 | 2026-09-17 |
| CVE-2026-92184 A security flaw has been discovered in ag-ui-protocol ag-ui 0.3.0. |
medium | 6.3 | — | — | 2026-09-16 | 2026-09-17 |
| CVE-2026-84551 A logic issue was addressed with improved validation. |
medium | 4.4 | — | Apple / ipados | 2026-09-14 | 2026-09-17 |
| CVE-2026-84558 A double free issue was addressed with improved memory management. |
medium | 5.5 | — | Apple / macos | 2026-09-14 | 2026-09-17 |
| CVE-2026-76857 Netcore NR255-V firmware version 1.5.130703 contains a sensitive information dis... |
medium | 6.5 | — | — | 2026-09-15 | 2026-09-17 |
| CVE-2026-76867 Netcore NR255-V firmware version 1.5.130703 contains a stored cross-site scripti... |
medium | 5.4 | — | — | 2026-09-15 | 2026-09-17 |
| CVE-2026-76872 Netcore NR255-V version 1.5.130703 contains a stored cross-site scripting vulner... |
medium | 5.4 | — | — | 2026-09-15 | 2026-09-17 |
| CVE-2026-43787 A logic issue was addressed with improved checks. |
medium | 5.9 | — | Apple / macos | 2026-09-14 | 2026-09-17 |
| CVE-2026-84509 An out-of-bounds read was addressed with improved bounds checking. |
medium | 6.5 | — | Apple / macos | 2026-09-14 | 2026-09-17 |
| CVE-2026-84570 A logic issue was addressed with improved checks. |
medium | 4.4 | — | Apple / macos | 2026-09-14 | 2026-09-17 |
| CVE-2026-84573 This issue was addressed with improved checks. |
medium | 5.5 | — | Apple / macos | 2026-09-14 | 2026-09-17 |
| CVE-2026-84587 A permissions issue was addressed with additional restrictions. |
medium | 5.5 | — | Apple / macos | 2026-09-14 | 2026-09-17 |
| CVE-2026-92936 vm2 versions 3.11.0 through 3.11.6 leak absolute host filesystem paths to sandbo... |
medium | 5.8 | — | — | 2026-09-17 | 2026-09-17 |
| CVE-2026-92952 vm2 versions 3.11.4 through 3.11.6 incompletely filter Node.js registered intern... |
medium | 6.8 | — | — | 2026-09-17 | 2026-09-17 |
| CVE-2026-91982 Vikunja before 2.6.0 continues to expose the raw TOTP shared secret after enroll... |
medium | 4.3 | — | — | 2026-09-15 | 2026-09-17 |
| CVE-2026-91992 Tornado before 6.5.7 contains a credential leak vulnerability in CurlAsyncHTTPCl... |
medium | 5.9 | — | — | 2026-09-15 | 2026-09-17 |
| CVE-2026-92358 A flaw was found in the first broker login flow of Keycloak. |
medium | 6.4 | — | — | 2026-09-16 | 2026-09-17 |
| CVE-2026-92615 A flaw was found in flightctl. |
medium | 6.6 | — | — | 2026-09-16 | 2026-09-17 |
| CVE-2026-91967 AVideo through 29.0 contains a blind server-side request forgery vulnerability i... |
medium | 5.0 | — | — | 2026-09-15 | 2026-09-17 |
| CVE-2026-91849 A security flaw has been discovered in WuzhiCMS up to 4.1.0. |
medium | 6.3 | — | — | 2026-09-15 | 2026-09-17 |
| CVE-2026-83200 Vulnerability in the Oracle Process Manufacturing Intelligence product of Oracle... |
medium | 6.5 | — | — | 2026-09-15 | 2026-09-17 |
| CVE-2026-83140 Vulnerability in the Oracle Field Service product of Oracle E-Business Suite (co... |
medium | 6.5 | — | — | 2026-09-15 | 2026-09-17 |
| CVE-2026-43695 An authorization issue was addressed with improved state management. |
medium | 5.5 | — | Apple / ipados | 2026-09-14 | 2026-09-17 |
| CVE-2026-43762 The issue was addressed with improved checks. |
medium | 5.5 | — | Apple / ipados | 2026-09-14 | 2026-09-17 |
| CVE-2026-43808 A use-after-free issue was addressed with improved memory management. |
medium | 5.5 | — | Apple / ipados | 2026-09-14 | 2026-09-17 |
| CVE-2026-65345 A permissions issue was addressed with additional restrictions. |
medium | 5.5 | — | Apple / ipados | 2026-09-14 | 2026-09-17 |
| CVE-2026-65348 A permissions issue was addressed with additional restrictions. |
medium | 5.5 | — | Apple / ipados | 2026-09-14 | 2026-09-17 |
| CVE-2026-65369 A logic issue was addressed with improved state management. |
medium | 5.5 | — | Apple / macos | 2026-09-14 | 2026-09-17 |
| CVE-2026-84562 A race condition was addressed with additional validation. |
medium | 4.7 | — | Apple / macos | 2026-09-14 | 2026-09-17 |
| CVE-2026-84586 An information disclosure issue was addressed with improved state management. |
medium | 5.5 | — | Apple / macos | 2026-09-14 | 2026-09-17 |
| CVE-2026-84593 A use after free issue was addressed with improved memory management. |
medium | 5.5 | — | Apple / ipados | 2026-09-14 | 2026-09-17 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.