September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,290
Critical
1,223
High
4,344
Medium
4,103
Low
460
Severity not reported
1,160
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-82773 Cross-site scripting vulnerability exists in CONPROSYS M2M Gateway Series and CO... |
medium | 6.1 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-82775 An exposure of information through directory listing issue exists in CONPROSYS M... |
medium | 4.3 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-82776 Cross-site scripting vulnerability exists in CONPROSYS PAC Series. |
medium | 6.1 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-82778 An exposure of information through directory listing issue exists in CONPROSYS P... |
medium | 4.3 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-82781 Cross-site scripting vulnerability exists in CONPROSYS nano Series. |
medium | 5.4 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-82782 Out-of-bounds write vulnerability exists in CONPROSYS nano Series. |
medium | 4.3 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-82783 Plaintext storage of a password issue exists in CONPROSYS nano Series . |
medium | 4.2 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-82784 Missing authentication for critical function vulnerability exists in Remote I/O... |
medium | 6.5 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-82785 Stack-based buffer overflow vulnerability exists in Remote I/O Coupler Unit (Ser... |
medium | 4.3 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-82786 Insufficiently protected credentials issue exists in Remote I/O Coupler Unit (Se... |
medium | 6.3 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-82788 Cross-site scripting vulnerability exists in CPSL-08P1EN. |
medium | 6.1 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-82790 Cross-site scripting vulnerability exists in PC-HELPER Wireless I/O DIO-0404RY-L... |
medium | 5.4 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-82792 Cross-site scripting vulnerability exists in Contec CAN 2.0B Communication Wirel... |
medium | 5.2 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-82795 SolarView Compact contains a cross-site scripting vulnerability in Schedule Sett... |
medium | 5.4 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-82796 SolarView Compact contains a cross-site scripting vulnerability in Image Managem... |
medium | 5.4 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-85125 The Android application "YAMAP -Social Trekking GPS App" contains an improper ac... |
medium | 5.4 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-81326 QND uses a hard-coded cryptographic key, which may allow a local attacker who is... |
medium | 5.5 | — | — | 2026-09-16 | 2026-09-16 |
| CVE-2026-89156 PCRE2 before 10.48 has a pcre2_match out-of-bounds read after a JIT fallback whe... |
medium | 5.9 | — | Pcre / pcre2 | 2026-09-11 | 2026-09-16 |
| CVE-2026-69642 Improper neutralization of input during web page generation ('cross-site scripti... |
medium | 6.1 | — | Microsoft / skype for business server | 2026-09-08 | 2026-09-16 |
| CVE-2026-66308 Out-of-bounds read in Skype for Business allows an authorized attacker to deny s... |
medium | 6.5 | — | Microsoft / skype for business server | 2026-09-08 | 2026-09-16 |
| CVE-2026-15887 IBM WebSphere Application Server 9.0, and 8.5 is affected by blind server-side r... |
medium | 5.4 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-16189 IBM WebSphere Application Server 9.0, and 8.5 could allow a remote attacker to i... |
medium | 4.8 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-16435 IBM WebSphere Application Server 9.0, and 8.5 is affected by an authentication b... |
medium | 5.9 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-18065 IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote unauthenticated attacker to ga... |
medium | 5.3 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-12763 IBM Langflow OSS 1.0.0 through 1.11.5 could allow an authenticated attacker to a... |
medium | 4.2 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-12765 IBM Langflow OSS 1.0.0 through 1.10.2 is vulnerable to server-side request forge... |
medium | 6.5 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-12766 IBM Langflow OSS 1.0.0 through 1.11.2 is vulnerable to server-side request forge... |
medium | 5.4 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-12767 IBM Langflow OSS 1.0.0 through 1.11.5 is vulnerable to server-side request forge... |
medium | 6.5 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-13277 IBM Verify Identity Access could allow a remote attacker to conduct phishing att... |
medium | 4.7 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-19280 IBM i 7.6, 7.5, 7.4, and 7.3 could allow a denial of service as a result of a bu... |
medium | 5.2 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-78415 IBM Sterling Secure Proxy 6.2.0.0 through 6.2.1.2 could allow a remote authentic... |
medium | 5.4 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-12758 IBM Cloud Pak for Business Automation could allow a remote attacker to bypass au... |
medium | 5.4 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-12759 IBM Cloud Pak for Business Automation could allow an authenticated user to cause... |
medium | 6.5 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-13265 IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 throu... |
medium | 6.8 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-11864 IBM Cloud Pak for Business Automation 26.0.0 through 26.0.0 Interim Fix 001, 25.... |
medium | 6.5 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-18069 IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local attacker to obtain ownership of... |
medium | 6.0 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-19273 IBM Sterling B2B Integrator 6.2.0.0 through 6.2.0.6_2, 6.2.1.0 - 6.2.1.2, 6.2.2.... |
medium | 5.4 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-75792 IBM Sterling Secure Proxy 6.2.0.0 through 6.2.1.2 could allow a remote authentic... |
medium | 4.3 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-7884 IBM Cognos Analytics 12.1.0 through 12.1.3 FP1, and 12.0.4 through 12.0.4 FP2 al... |
medium | 5.4 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-66306 Generation of error message containing sensitive information in Skype for Busine... |
medium | 6.5 | — | Microsoft / skype for business server | 2026-09-08 | 2026-09-16 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.