September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,364
Critical
1,230
High
4,374
Medium
4,126
Low
462
Severity not reported
1,172
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (964), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-84971 Improper handling of an unexpected value size in the decryption path of a client... |
medium | 6.5 | — | Mongodb / libmongocrypt | 2026-09-03 | 2026-09-17 |
| CVE-2026-82052 The $regexFindAll expression can be used by an authenticated user who can run ag... |
medium | 6.5 | — | Mongodb / mongodb | 2026-09-08 | 2026-09-16 |
| CVE-2026-82054 A security issue exists in MongoDB server's JSON Pointer parser used during $jso... |
medium | 6.5 | — | Mongodb / mongodb | 2026-09-08 | 2026-09-16 |
| CVE-2026-82074 MongoDB Server contains an incorrect authorization vulnerability in the aggregat... |
medium | 6.5 | — | Mongodb / mongodb | 2026-09-08 | 2026-09-16 |
| CVE-2026-82073 A security issue in the MongoDB Server aggregation framework allows an authentic... |
medium | 6.5 | — | Mongodb / mongodb | 2026-09-08 | 2026-09-16 |
| CVE-2026-82070 A security issue in MongoDB Server's diagnostic reporting interface allows an au... |
medium | 6.5 | — | Mongodb / mongodb | 2026-09-08 | 2026-09-16 |
| CVE-2026-82069 A security issue in MongoDB Server's query statistics serialization on the route... |
medium | 6.5 | — | Mongodb / mongodb | 2026-09-08 | 2026-09-16 |
| CVE-2026-82068 A security issue in MongoDB Server allows an authenticated user with write privi... |
medium | 6.5 | — | Mongodb / mongodb | 2026-09-08 | 2026-09-16 |
| CVE-2026-82065 A security issue in the MongoDB Server's storage engine integration layer allows... |
medium | 6.5 | — | Mongodb / mongodb | 2026-09-08 | 2026-09-16 |
| CVE-2026-82063 A use-after-free security issue in the cursor management component of MongoDB Se... |
medium | 5.3 | — | Mongodb / mongodb | 2026-09-08 | 2026-09-16 |
| CVE-2026-82062 A security issue in MongoDB Server allows an authenticated user with elevated in... |
medium | 5.5 | — | Mongodb / mongodb | 2026-09-08 | 2026-09-16 |
| CVE-2026-82060 In MongoDB, insufficient validation of shard key values during document insertio... |
medium | 5.4 | — | Mongodb / mongodb | 2026-09-08 | 2026-09-16 |
| CVE-2026-82059 An internal aggregation expression in MongoDB Server was incorrectly registered... |
medium | 6.5 | — | Mongodb / mongodb | 2026-09-08 | 2026-09-16 |
| CVE-2026-82058 A flaw in MongoDB's JSON Schema validation error generation code allows an authe... |
medium | 6.5 | — | Mongodb / mongodb | 2026-09-08 | 2026-09-16 |
| CVE-2026-82055 A security issue exists in MongoDB's 2dsphere index key generation that can caus... |
medium | 6.5 | — | Mongodb / mongodb | 2026-09-08 | 2026-09-16 |
| CVE-2026-82056 A race condition in MongoDB server's text index query parsing can cause a heap u... |
medium | 5.3 | — | Mongodb / mongodb | 2026-09-08 | 2026-09-16 |
| CVE-2026-82057 A security issue was discovered in MongoDB where an authenticated user with read... |
medium | 6.5 | — | Mongodb / mongodb | 2026-09-08 | 2026-09-16 |
| CVE-2026-88035 A size check in the client-side authentication path of the MongoDB C Driver can... |
medium | 5.5 | — | Mongodb / c driver | 2026-09-10 | 2026-09-16 |
| CVE-2026-82076 An integer overflow in the query planning component of MongoDB Server can allow... |
medium | 6.5 | — | Mongodb / mongodb | 2026-09-08 | 2026-09-14 |
| CVE-2026-84968 An out-of-bounds read in the BSON decoding component of the MongoDB PHP driver m... |
medium | 5.3 | — | Mongodb / php driver | 2026-09-03 | 2026-09-10 |
| CVE-2026-84970 A numeric truncation weakness exists in the JSON parsing component of the MongoD... |
medium | 5.8 | — | Mongodb / c\+\+ driver | 2026-09-03 | 2026-09-10 |
| CVE-2026-84967 A component of the MongoDB extension for Visual Studio Code does not neutralize... |
medium | 4.3 | — | Mongodb / mongodb | 2026-09-03 | 2026-09-09 |
| CVE-2026-93394 A flaw in libmongoc's SCRAM authentication implementation caused the client to c... |
low | 3.7 | — | Mongodb / c driver | 2026-09-17 | 2026-09-25 |
| CVE-2026-84969 A memory-handling error in the BSON-to-JSON conversion helpers of the MongoDB C... |
low | 3.7 | — | Mongodb / c driver | 2026-09-03 | 2026-09-10 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.