September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,290
Critical
1,223
High
4,344
Medium
4,103
Low
460
Severity not reported
1,160
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-73468 A specially crafted packet can cause the premature expiry of multicast forwardin... |
medium | 6.5 | — | — | 2026-09-16 | 2026-09-16 |
| CVE-2026-73469 When specific platforms are using Arista EOS with a loose Unicast Reverse Path F... |
medium | 5.8 | — | — | 2026-09-16 | 2026-09-16 |
| CVE-2026-77190 On affected platforms running Arista EOS, an unauthenticated attacker who is net... |
medium | 6.5 | — | — | 2026-09-16 | 2026-09-16 |
| CVE-2026-84397 Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vuln... |
medium | 5.4 | — | — | 2026-09-16 | 2026-09-16 |
| CVE-2026-65402 A use after free issue was addressed with improved memory management. |
medium | 5.5 | — | Apple / ipados | 2026-09-14 | 2026-09-16 |
| CVE-2026-65405 A memory initialization issue was addressed with improved memory handling. |
medium | 5.5 | — | Apple / ipados | 2026-09-14 | 2026-09-16 |
| CVE-2026-65409 A type confusion issue was addressed with improved memory handling. |
medium | 5.5 | — | Apple / ipados | 2026-09-14 | 2026-09-16 |
| CVE-2026-84487 An integer overflow was addressed with improved input validation. |
medium | 6.5 | — | Apple / ipados | 2026-09-14 | 2026-09-16 |
| CVE-2026-84492 A race condition was addressed with improved state handling. |
medium | 4.7 | — | Apple / ipados | 2026-09-14 | 2026-09-16 |
| CVE-2026-84523 An out-of-bounds write issue was addressed with improved bounds checking. |
medium | 5.5 | — | Apple / ipados | 2026-09-14 | 2026-09-16 |
| CVE-2026-65406 A logic issue was addressed with improved validation. |
medium | 5.5 | — | Apple / ipados | 2026-09-14 | 2026-09-16 |
| CVE-2026-65395 An out-of-bounds write issue was addressed with improved bounds checking. |
medium | 6.5 | — | Apple / ipados | 2026-09-14 | 2026-09-16 |
| CVE-2026-84612 An authorization issue was addressed with improved access control. |
medium | 5.5 | — | Apple / ipados | 2026-09-14 | 2026-09-16 |
| CVE-2026-84630 A race condition was addressed with improved state handling. |
medium | 4.7 | — | Apple / ipados | 2026-09-14 | 2026-09-16 |
| CVE-2026-86882 An out-of-bounds write issue was addressed with improved bounds checking. |
medium | 6.5 | — | Apple / ipados | 2026-09-14 | 2026-09-16 |
| CVE-2026-84583 A permissions issue was addressed with additional restrictions. |
medium | 5.5 | — | Apple / ipados | 2026-09-14 | 2026-09-16 |
| CVE-2026-85732 oras-go is a Go library for managing OCI artifacts. |
medium | 4.7 | — | — | 2026-09-16 | 2026-09-16 |
| CVE-2026-9338 IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to a denial of servi... |
medium | 5.3 | — | Ibm / websphere application server | 2026-09-10 | 2026-09-16 |
| CVE-2026-88035 A size check in the client-side authentication path of the MongoDB C Driver can... |
medium | 5.5 | — | Mongodb / c driver | 2026-09-10 | 2026-09-16 |
| CVE-2026-84536 An integer underflow was addressed with improved input validation. |
medium | 6.5 | — | Apple / macos | 2026-09-14 | 2026-09-16 |
| CVE-2026-84517 An integer overflow was addressed with improved input validation. |
medium | 5.5 | — | Apple / macos | 2026-09-14 | 2026-09-16 |
| CVE-2026-84555 An authorization issue was addressed with improved access control. |
medium | 5.5 | — | Apple / macos | 2026-09-14 | 2026-09-16 |
| CVE-2026-91842 A vulnerability has been found in OpenBankProject OBP-API up to 1.10.1. |
medium | 4.1 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-92364 A vulnerability has been found in itsourcecode Leave Management System 1.0. |
medium | 6.3 | — | — | 2026-09-16 | 2026-09-16 |
| CVE-2026-92383 A security vulnerability has been detected in PbootCMS up to 3.2.24. |
medium | 4.3 | — | — | 2026-09-16 | 2026-09-16 |
| CVE-2026-64717 A race condition was addressed with improved state handling. |
medium | 6.3 | — | Apple / ipados | 2026-09-14 | 2026-09-16 |
| CVE-2026-69874 Untrusted pointer dereference in Windows ALPC allows an authorized attacker to e... |
medium | 6.4 | — | Microsoft / windows 10 1809 | 2026-09-08 | 2026-09-16 |
| CVE-2026-64714 A memory corruption issue was addressed with improved bounds checking. |
medium | 5.5 | — | Apple / ipados | 2026-09-14 | 2026-09-16 |
| CVE-2026-81910 Concrete CMS 9 through 9.5.2 is vulnerable to Server-Side Template Injection (SS... |
medium | 6.5 | — | Concretecms / concrete cms | 2026-09-11 | 2026-09-16 |
| CVE-2026-69862 Out-of-bounds read in Windows Wireless Wide Area Network Service allows an autho... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-16 |
| CVE-2026-90555 vLLM versions before 0.28.0 fail to validate audio sample rate headers in the tr... |
medium | 6.5 | — | Vllm / vllm | 2026-09-12 | 2026-09-16 |
| CVE-2026-64756 A path handling issue was addressed with improved validation. |
medium | 5.5 | — | Apple / ipados | 2026-09-14 | 2026-09-16 |
| CVE-2026-65380 An issue existed in the handling of snapshots. |
medium | 5.5 | — | Apple / macos | 2026-09-14 | 2026-09-16 |
| CVE-2026-90831 A vulnerability was detected in GNU Binutils 2.47. |
medium | 5.3 | — | Gnu / binutils | 2026-09-14 | 2026-09-16 |
| CVE-2026-90807 A vulnerability was found in nanocoai NanoClaw up to 2.1.17. |
medium | 6.3 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-90812 A security vulnerability has been detected in cosmicstack-labs mercury-agent up... |
medium | 4.3 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-90818 A security flaw has been discovered in netease-youdao LobsterAI 2026.6.15/2026.8... |
medium | 4.3 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-54247 Skipper is an HTTP router and reverse proxy for service composition. |
medium | 4.3 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-48737 pyLoad is a free and open-source download manager written in Python. |
medium | 4.9 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-84537 The issue was addressed with improved memory handling. |
medium | 6.6 | — | Apple / macos | 2026-09-14 | 2026-09-16 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.