September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,290
Critical
1,223
High
4,344
Medium
4,103
Low
460
Severity not reported
1,160
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-68779 Out-of-bounds read in SQL Server allows an authorized attacker to disclose infor... |
medium | 6.5 | — | Microsoft / sql server 2017 | 2026-09-08 | 2026-09-15 |
| CVE-2026-68778 Out-of-bounds read in SQL Server allows an authorized attacker to disclose infor... |
medium | 6.5 | — | Microsoft / sql server 2017 | 2026-09-08 | 2026-09-15 |
| CVE-2026-68777 Out-of-bounds read in SQL Server allows an authorized attacker to disclose infor... |
medium | 6.5 | — | Microsoft / sql server 2017 | 2026-09-08 | 2026-09-15 |
| CVE-2026-68776 Use of uninitialized resource in SQL Server allows an authorized attacker to dis... |
medium | 6.5 | — | Microsoft / sql server 2017 | 2026-09-08 | 2026-09-15 |
| CVE-2026-67648 Use of uninitialized resource in SQL Server allows an authorized attacker to dis... |
medium | 6.5 | — | Microsoft / sql server 2017 | 2026-09-08 | 2026-09-15 |
| CVE-2026-86137 In libxml2 before 2.15.4, xmlFAParsePosCharGroup has an out-of-bounds read, aka... |
medium | 6.1 | — | Xmlsoft / libxml2 | 2026-09-05 | 2026-09-15 |
| CVE-2026-67645 Out-of-bounds read in SQL Server allows an authorized attacker to disclose infor... |
medium | 6.5 | — | Microsoft / sql server 2017 | 2026-09-08 | 2026-09-15 |
| CVE-2026-67641 Integer overflow or wraparound in SQL Server allows an authorized attacker to de... |
medium | 6.5 | — | Microsoft / sql server 2022 | 2026-09-08 | 2026-09-15 |
| CVE-2026-43788 An integer overflow was addressed with improved input validation. |
medium | 6.6 | — | Apple / macos | 2026-09-14 | 2026-09-15 |
| CVE-2026-64753 A permissions issue was addressed by removing the vulnerable code. |
medium | 6.5 | — | Apple / safari | 2026-09-14 | 2026-09-15 |
| CVE-2026-65352 An information disclosure issue was addressed with improved state management. |
medium | 4.3 | — | Apple / ipados | 2026-09-14 | 2026-09-15 |
| CVE-2026-65355 An information disclosure issue was addressed with improved state management. |
medium | 4.3 | — | Apple / ipados | 2026-09-14 | 2026-09-15 |
| CVE-2026-28933 A use-after-free issue was addressed with improved memory management. |
medium | 5.5 | — | Apple / macos | 2026-09-14 | 2026-09-15 |
| CVE-2026-28934 A buffer overflow was addressed with improved bounds checking. |
medium | 6.5 | — | Apple / macos | 2026-09-14 | 2026-09-15 |
| CVE-2026-43677 An out-of-bounds write issue was addressed by removing the vulnerable code. |
medium | 6.5 | — | Apple / macos | 2026-09-14 | 2026-09-15 |
| CVE-2026-43687 The issue was addressed with improved memory handling. |
medium | 6.5 | — | Apple / ipados | 2026-09-14 | 2026-09-15 |
| CVE-2026-43761 An out-of-bounds write issue was addressed with improved bounds checking. |
medium | 6.5 | — | Apple / macos | 2026-09-14 | 2026-09-15 |
| CVE-2026-90578 A flaw has been found in GPAC up to f1219cde. |
medium | 5.3 | — | — | 2026-09-13 | 2026-09-15 |
| CVE-2026-85205 A vulnerability was determined in itsourcecode Online Medicine Delivery System 1... |
medium | 6.3 | — | — | 2026-09-03 | 2026-09-15 |
| CVE-2026-85657 The Co-Authors, Multiple Authors and Guest Authors in an Author Box with Publish... |
medium | 5.4 | — | — | 2026-09-15 | 2026-09-15 |
| CVE-2026-90534 Flowise is a low-code platform for building LLM applications. |
medium | 6.5 | — | Flowiseai / flowise | 2026-09-12 | 2026-09-15 |
| CVE-2026-67393 Buffer over-read in SQL Server allows an authorized attacker to disclose informa... |
medium | 6.5 | — | Microsoft / sql server 2017 | 2026-09-08 | 2026-09-15 |
| CVE-2026-67390 Buffer over-read in SQL Server allows an authorized attacker to disclose informa... |
medium | 6.5 | — | Microsoft / sql server 2017 | 2026-09-08 | 2026-09-15 |
| CVE-2026-67389 Out-of-bounds read in SQL Server allows an authorized attacker to disclose infor... |
medium | 6.5 | — | Microsoft / sql server 2022 | 2026-09-08 | 2026-09-15 |
| CVE-2026-90533 Flowise before 3.1.4 contains a broken access control vulnerability in GET /api/... |
medium | 6.5 | — | Flowiseai / flowise | 2026-09-12 | 2026-09-15 |
| CVE-2026-90714 A weakness has been identified in marcobambini Gravity up to 0.9.7. |
medium | 6.3 | — | — | 2026-09-14 | 2026-09-15 |
| CVE-2026-91089 A vulnerability was found in GPAC up to f1219cde. |
medium | 6.3 | — | — | 2026-09-15 | 2026-09-15 |
| CVE-2026-90583 A security flaw has been discovered in kagisearch smallweb up to 0ecb9c48edbf98d... |
medium | 4.3 | — | — | 2026-09-13 | 2026-09-15 |
| CVE-2026-90596 A weakness has been identified in embedded-graphics up to 0.8.2 on 32-bit. |
medium | 6.5 | — | — | 2026-09-13 | 2026-09-15 |
| CVE-2026-90542 WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to val... |
medium | 5.4 | — | — | 2026-09-12 | 2026-09-15 |
| CVE-2026-90547 WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to val... |
medium | 5.3 | — | — | 2026-09-12 | 2026-09-15 |
| CVE-2026-90552 WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to val... |
medium | 4.3 | — | — | 2026-09-12 | 2026-09-15 |
| CVE-2026-90486 A vulnerability has been found in openstatusHQ openstatus up to f04c827112f30a11... |
medium | 6.3 | — | — | 2026-09-12 | 2026-09-15 |
| CVE-2026-90491 A weakness has been identified in sanjevirau gsubs up to 1.0.3. |
medium | 6.3 | — | — | 2026-09-13 | 2026-09-15 |
| CVE-2026-84655 Jenkins 2.579 and earlier, LTS 2.568.2 and earlier does not escape map keys when... |
medium | 4.3 | — | Jenkins / jenkins | 2026-09-02 | 2026-09-15 |
| CVE-2026-84656 A missing permission check in Jenkins 2.579 and earlier, LTS 2.568.2 and earlier... |
medium | 4.3 | — | Jenkins / jenkins | 2026-09-02 | 2026-09-15 |
| CVE-2026-84657 In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, the build CLI command doe... |
medium | 4.2 | — | Jenkins / jenkins | 2026-09-02 | 2026-09-15 |
| CVE-2026-84538 A denial-of-service issue was addressed with improved input validation. |
medium | 6.5 | — | Apple / macos | 2026-09-14 | 2026-09-15 |
| CVE-2026-86876 An out-of-bounds write issue was addressed with improved bounds checking. |
medium | 5.2 | — | Apple / ipados | 2026-09-14 | 2026-09-15 |
| CVE-2026-86879 A denial-of-service issue was addressed with improved input validation. |
medium | 6.5 | — | Apple / ipados | 2026-09-14 | 2026-09-15 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.