September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,290
Critical
1,223
High
4,344
Medium
4,103
Low
460
Severity not reported
1,160
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-84554 An integer overflow was addressed with improved input validation. |
medium | 5.9 | — | Apple / macos | 2026-09-14 | 2026-09-16 |
| CVE-2026-86890 A logic issue was addressed with improved checks. |
medium | 4.6 | — | Apple / ipados | 2026-09-14 | 2026-09-16 |
| CVE-2026-84576 This issue was addressed with improved checks. |
medium | 5.5 | — | Apple / macos | 2026-09-14 | 2026-09-16 |
| CVE-2026-73478 Incorrect Authorization vulnerability in Drupal Diff allows Forceful Browsing. |
medium | 5.3 | — | Diff Project / diff | 2026-09-02 | 2026-09-16 |
| CVE-2026-92616 FileRise before version 3.28.0 contains a privilege escalation vulnerability tha... |
medium | 6.8 | — | — | 2026-09-16 | 2026-09-16 |
| CVE-2026-90788 A security flaw has been discovered in magicblack MacCMS10 2026.1000.4055. |
medium | 4.7 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-90793 A vulnerability has been found in GPAC up to f1219cde. |
medium | 5.4 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-88976 Plate is a rich-text editor with AI and shadcn/ui. |
medium | 6.1 | — | — | 2026-09-16 | 2026-09-16 |
| CVE-2026-84550 A race condition was addressed with additional validation. |
medium | 4.7 | — | Apple / macos | 2026-09-14 | 2026-09-16 |
| CVE-2026-79970 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application... |
medium | 5.6 | — | Dell / secure connect gateway | 2026-09-09 | 2026-09-16 |
| CVE-2026-57120 PraisonAI is a multi-agent teams system. |
medium | 6.5 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-88054 Tesseract is an open source OCR engine. |
medium | 5.5 | — | Tesseract-ocr / tesseract ocr | 2026-09-10 | 2026-09-16 |
| CVE-2026-81205 Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injecti... |
medium | 5.3 | — | Miniorange / ldap \/ active directory integration | 2026-09-02 | 2026-09-16 |
| CVE-2026-69469 Integer overflow or wraparound in Windows USB Audio Class driver (usbaudio.sys)... |
medium | 6.6 | — | Microsoft / windows 10 1809 | 2026-09-08 | 2026-09-16 |
| CVE-2026-73477 Incorrect Authorization vulnerability in Drupal Quick Tabs allows Forceful Brows... |
medium | 5.3 | — | Quick Tabs Project / quick tabs | 2026-09-02 | 2026-09-16 |
| CVE-2026-81201 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripti... |
medium | 6.1 | — | Monster Menus Project / monster menus | 2026-09-02 | 2026-09-16 |
| CVE-2026-40635 Dell PowerScale OneFS versions 9.12.0.0 through 9.13.1.0 contain an Insecure Tem... |
medium | 5.4 | — | Dell / powerscale onefs | 2026-09-09 | 2026-09-16 |
| CVE-2026-70425 Dell PowerScale OneFS, Versions 9.5.0.0 through 9.7.1.0, Versions 9.8.0.0 throug... |
medium | 6.7 | — | Dell / powerscale onefs | 2026-09-09 | 2026-09-16 |
| CVE-2026-86878 A permissions issue was addressed with additional restrictions. |
medium | 5.5 | — | Apple / ipados | 2026-09-14 | 2026-09-16 |
| CVE-2026-65404 An authorization issue was addressed with improved state management. |
medium | 5.5 | — | Apple / ipados | 2026-09-14 | 2026-09-16 |
| CVE-2026-90829 A weakness has been identified in GNU Binutils 2.47. |
medium | 5.3 | — | Gnu / binutils | 2026-09-14 | 2026-09-16 |
| CVE-2026-90830 A security vulnerability has been detected in GNU Binutils 2.47. |
medium | 5.3 | — | Gnu / binutils | 2026-09-14 | 2026-09-16 |
| CVE-2026-84588 A memory corruption issue was addressed by removing the vulnerable code. |
medium | 6.5 | — | Apple / macos | 2026-09-14 | 2026-09-16 |
| CVE-2026-84585 A permissions issue was addressed with improved state management. |
medium | 5.5 | — | Apple / macos | 2026-09-14 | 2026-09-16 |
| CVE-2026-65411 A path handling issue was addressed with improved validation. |
medium | 5.5 | — | Apple / ipados | 2026-09-14 | 2026-09-16 |
| CVE-2026-87073 Tanium addressed an improper access controls vulnerability in Comply. |
medium | 6.5 | — | Tanium / comply | 2026-09-09 | 2026-09-16 |
| CVE-2026-87048 Tanium addressed an improper access controls vulnerability in Comply. |
medium | 5.4 | — | Tanium / comply | 2026-09-09 | 2026-09-16 |
| CVE-2026-87033 Tanium addressed an improper access controls vulnerability in Comply. |
medium | 5.4 | — | Tanium / comply | 2026-09-09 | 2026-09-16 |
| CVE-2026-87025 Tanium addressed an improper access controls vulnerability in Comply. |
medium | 5.4 | — | Tanium / comply | 2026-09-09 | 2026-09-16 |
| CVE-2026-61908 An issue was discovered in Cyrus IMAP before 3.12.4. |
medium | 6.5 | — | Cyrus / imap | 2026-09-09 | 2026-09-16 |
| CVE-2026-87019 Tanium addressed an improper access controls vulnerability in Comply. |
medium | 4.3 | — | Tanium / comply | 2026-09-09 | 2026-09-16 |
| CVE-2026-87047 Tanium addressed an improper access controls vulnerability in Comply. |
medium | 6.3 | — | Tanium / comply | 2026-09-09 | 2026-09-16 |
| CVE-2026-61909 An issue was discovered in Cyrus IMAP before 3.12.4. |
medium | 4.3 | — | Cyrus / imap | 2026-09-09 | 2026-09-16 |
| CVE-2026-87046 Tanium addressed an improper access controls vulnerability in Comply. |
medium | 4.3 | — | Tanium / comply | 2026-09-09 | 2026-09-16 |
| CVE-2026-87037 Tanium addressed an improper access controls vulnerability in Comply. |
medium | 5.4 | — | Tanium / comply | 2026-09-09 | 2026-09-16 |
| CVE-2026-87035 Tanium addressed an information disclosure vulnerability in Comply. |
medium | 4.3 | — | Tanium / comply | 2026-09-09 | 2026-09-16 |
| CVE-2026-61910 An issue was discovered in Cyrus IMAP before 3.12.4. |
medium | 5.0 | — | Cyrus / imap | 2026-09-09 | 2026-09-16 |
| CVE-2026-61911 An issue was discovered in Cyrus IMAP before 3.12.4. |
medium | 4.3 | — | Cyrus / imap | 2026-09-09 | 2026-09-16 |
| CVE-2026-87017 Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI plat... |
medium | 4.3 | — | Openwebui / open webui | 2026-09-09 | 2026-09-16 |
| CVE-2026-90716 A vulnerability was detected in marcobambini Gravity up to 0.9.7. |
medium | 5.5 | — | — | 2026-09-14 | 2026-09-16 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.