September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,290
Critical
1,223
High
4,344
Medium
4,103
Low
460
Severity not reported
1,160
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-89158 PCRE2 before 10.48, on 32-bit platforms, has a pcre2_compile_32 integer overflow... |
medium | 6.5 | — | Pcre / pcre2 | 2026-09-11 | 2026-09-16 |
| CVE-2026-66303 Null pointer dereference in Skype for Business allows an authorized attacker to... |
medium | 6.5 | — | Microsoft / skype for business server | 2026-09-08 | 2026-09-16 |
| CVE-2026-18151 IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obta... |
medium | 4.2 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-18515 IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to plac... |
medium | 4.3 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-19543 IBM Common Licensing Agent 9.0, Agent 9.0.0.1, Agent 9.0.0.2, ART 9.0, ART 9.0.0... |
medium | 6.2 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-16185 IBM WebSphere Application Server 9.0, and 8.5 could allow a remote attacker to b... |
medium | 6.4 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-16186 IBM WebSphere Application Server 9.0, and 8.5 is affected by a reflected cross-s... |
medium | 5.4 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-16187 IBM WebSphere Application Server 9.0, and 8.5 could allow a remote attacker to b... |
medium | 6.5 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-16188 IBM WebSphere Application Server 9.0, and 8.5 could allow a remote attacker to i... |
medium | 5.3 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-16702 IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 for Linux, UNIX and Win... |
medium | 6.5 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-17047 IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to obtain s... |
medium | 5.4 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-17463 IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 for Linux, UNIX and Win... |
medium | 6.5 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-17628 IBM Langflow OSS 1.0.0 through 1.10.2 could allow a remote authenticated attacke... |
medium | 5.4 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-18251 IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to obtain sensitive i... |
medium | 4.3 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-12742 IBM Business Automation Workflow containers and traditional could allow an authe... |
medium | 5.4 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-63523 Improper neutralization of input during web page generation ('cross-site scripti... |
medium | 6.1 | — | Microsoft / skype for business server | 2026-09-08 | 2026-09-16 |
| CVE-2026-13276 IBM Verify Identity Access 11.0.0 through 11.0.3 Interim Fix 001 and IBM Securit... |
medium | 6.1 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-92216 A vulnerability was found in a2ui-project a2ui up to 0.10.7. |
medium | 4.3 | — | — | 2026-09-16 | 2026-09-16 |
| CVE-2026-92114 A vulnerability was identified in a2ui-project a2ui up to 0.10.6. |
medium | 5.3 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-73444 On affected platforms running Arista EOS with VRRPv2 IP Authentication Header (I... |
medium | 4.7 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-73438 On affected platforms running Arista EOS with Open Shortest Path First version 3... |
medium | 5.3 | — | — | 2026-09-16 | 2026-09-16 |
| CVE-2026-5920 The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Sc... |
medium | 6.4 | — | — | 2026-09-16 | 2026-09-16 |
| CVE-2026-19729 A flaw was found in the key provider component of the keycloak-services library,... |
medium | 4.9 | — | — | 2026-09-09 | 2026-09-16 |
| CVE-2026-19655 On affected platforms running Arista EOS with Dynamic Host Configuration Protoco... |
medium | 6.5 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-15402 The Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered)... |
medium | 6.4 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-15609 The Bridge - Creative Multipurpose WordPress Theme theme for WordPress is vulner... |
medium | 6.4 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-11996 The Advanced Popups plugin for WordPress is vulnerable to Stored Cross-Site Scri... |
medium | 6.4 | — | — | 2026-09-16 | 2026-09-16 |
| CVE-2026-11984 The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to... |
medium | 5.3 | — | — | 2026-09-16 | 2026-09-16 |
| CVE-2026-89160 PCRE2 before 10.48 has a pcre2_match out-of-bounds read during the PCRE2_MATCH_I... |
medium | 6.5 | — | Pcre / pcre2 | 2026-09-11 | 2026-09-16 |
| CVE-2026-70019 Windows hard link in Windows Compressed Folder allows an unauthorized attacker t... |
medium | 6.5 | — | Microsoft / windows 11 23h2 | 2026-09-08 | 2026-09-16 |
| CVE-2026-86107 The VeloCloud Edge and Gateway exhibit an out-of-bounds write vulnerability when... |
medium | 5.9 | — | — | 2026-09-16 | 2026-09-16 |
| CVE-2026-73467 On affected platforms running Arista EOS, under certain circumstances plaintext... |
medium | 6.3 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-73445 On affected platforms running Arista EOS, an issue with the gRPC Network Securit... |
medium | 4.9 | — | — | 2026-09-16 | 2026-09-16 |
| CVE-2026-73449 On affected platforms running Arista EOS with both 802.1X port authentication an... |
medium | 5.9 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-19641 On affected platforms running Arista EOS with password authentication configured... |
medium | 5.3 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-73451 On affected platforms running Arista EOS with dual switch cards and with ingress... |
medium | 4.8 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-73463 On affected platforms running Arista EOS, when multiple gRPC Network Security In... |
medium | 5.3 | — | — | 2026-09-16 | 2026-09-16 |
| CVE-2026-19640 On affected platforms running Arista EOS, an authenticated user with access to t... |
medium | 4.2 | — | — | 2026-09-16 | 2026-09-16 |
| CVE-2026-73436 On affected platforms running Arista EOS with OSPFv2 and OSPFv2 segment routing... |
medium | 6.5 | — | — | 2026-09-16 | 2026-09-16 |
| CVE-2026-73440 On affected platforms running Arista EOS with Simple Network Management Protocol... |
medium | 4.2 | — | — | 2026-09-16 | 2026-09-16 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.