September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,291
Critical
1,223
High
4,345
Medium
4,103
Low
460
Severity not reported
1,160
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-79379 A buffer overflow in the SBC_DecodeFrames() function of Bestechnic Co., Ltd BES2... |
medium | 6.5 | — | — | 2026-09-08 | 2026-09-14 |
| CVE-2026-79573 L-ONE v1.0.0 was discovered to contain multiple SQL injection vulnerabilities in... |
medium | 6.5 | — | — | 2026-09-08 | 2026-09-14 |
| CVE-2026-75167 A broken access control vulnerability in the ugw-usr-edit method of /cgi-bin/www... |
medium | 4.3 | — | — | 2026-09-04 | 2026-09-14 |
| CVE-2026-78849 Cross Site Scripting vulnerability in Netgate pfSense Plus software versions <=... |
medium | 5.4 | — | — | 2026-09-04 | 2026-09-14 |
| CVE-2026-62653 A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). |
medium | 6.8 | — | — | 2026-09-08 | 2026-09-14 |
| CVE-2026-73324 Certain VLC media player builds in versions 3.0.0 through 3.0.23 contain a memor... |
medium | 4.3 | — | — | 2026-09-09 | 2026-09-14 |
| CVE-2026-52307 An authenticated stored cross-site scripting (XSS) vulnerability in the Column M... |
medium | 5.4 | — | — | 2026-09-08 | 2026-09-14 |
| CVE-2022-35497 In Trimble TM4WEB 21.4.0.4 due to security misconfiguration with session identif... |
medium | 5.4 | — | — | 2026-09-04 | 2026-09-14 |
| CVE-2026-87810 Siyuan before v3.8.2 contains an information disclosure vulnerability in the POS... |
medium | 5.3 | — | — | 2026-09-09 | 2026-09-14 |
| CVE-2026-87575 Incorrect authorization in Loader in Google Chrome prior to 153.0.8010.36 allowe... |
medium | 5.4 | — | Google / chrome | 2026-09-09 | 2026-09-14 |
| CVE-2026-87656 Improper state validation in Safebrowsing in Google Chrome prior to 153.0.8010.3... |
medium | 5.4 | — | Google / chrome | 2026-09-09 | 2026-09-14 |
| CVE-2026-87546 Incorrect type conversion or cast in Safebrowsing in Google Chrome on on Mac pri... |
medium | 4.3 | — | Google / chrome | 2026-09-09 | 2026-09-14 |
| CVE-2026-87551 Improper certificate validation in CORS in Google Chrome prior to 153.0.8010.36... |
medium | 4.3 | — | Google / chrome | 2026-09-09 | 2026-09-14 |
| CVE-2026-87571 Improper certificate validation in Loader in Google Chrome prior to 153.0.8010.3... |
medium | 5.4 | — | Google / chrome | 2026-09-09 | 2026-09-14 |
| CVE-2026-86077 n8n is an open source workflow automation platform. |
medium | 6.5 | — | N8n / n8n | 2026-09-08 | 2026-09-14 |
| CVE-2026-86082 n8n is an open source workflow automation platform. |
medium | 6.5 | — | N8n / n8n | 2026-09-08 | 2026-09-14 |
| CVE-2026-86085 n8n is an open source workflow automation platform. |
medium | 4.9 | — | N8n / n8n | 2026-09-08 | 2026-09-14 |
| CVE-2026-80124 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application... |
medium | 5.5 | — | Dell / secure connect gateway | 2026-09-09 | 2026-09-14 |
| CVE-2026-80174 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application... |
medium | 5.3 | — | Dell / secure connect gateway | 2026-09-09 | 2026-09-14 |
| CVE-2026-79516 An out-of-bounds read in the stbsp_vsnprintf function (stb_sprintf.h) of nothing... |
medium | 4.0 | — | — | 2026-09-09 | 2026-09-14 |
| CVE-2026-75308 yshopmall <=3.3 is vulnerable to Cross Site Scripting (XSS). |
medium | 6.1 | — | — | 2026-09-09 | 2026-09-14 |
| CVE-2026-71616 An issue in GPAC c2dee3aff638cd96f9617ac5b17dc2868cd90ef3 allows an attacker to... |
medium | 6.2 | — | — | 2026-09-09 | 2026-09-14 |
| CVE-2026-53937 MCP Kotlin SDK is the Kotlin Multiplatform software development kit for the Mode... |
medium | 6.2 | — | — | 2026-09-09 | 2026-09-14 |
| CVE-2026-53638 Sylius is an Open Source eCommerce Framework on Symfony. |
medium | 4.3 | — | — | 2026-09-08 | 2026-09-14 |
| CVE-2026-38998 A use-after-free in the SocketDescriptor::tcpReadHandler1 function (liveMedia/RT... |
medium | 6.5 | — | — | 2026-09-09 | 2026-09-14 |
| CVE-2026-18090 A flaw was found in gdk-pixbuf. |
medium | 6.1 | — | — | 2026-09-08 | 2026-09-14 |
| CVE-2026-53683 reset_password.html parses query string parameters and uses the 'url' parameter... |
medium | 4.3 | — | — | 2026-09-02 | 2026-09-14 |
| CVE-2026-86418 Affected versions of MISP expose organisation metadata through the dashboard org... |
medium | 4.3 | — | Misp-project / misp | 2026-09-07 | 2026-09-14 |
| CVE-2026-82001 Acrobat Reader is affected by an Uncontrolled Resource Consumption vulnerability... |
medium | 5.5 | — | Adobe / acrobat | 2026-09-08 | 2026-09-11 |
| CVE-2026-81977 Acrobat Reader is affected by an Integer Underflow (Wrap or Wraparound) vulnerab... |
medium | 5.5 | — | Adobe / acrobat | 2026-09-08 | 2026-09-11 |
| CVE-2026-81982 Acrobat Reader is affected by an out-of-bounds read vulnerability that could lea... |
medium | 5.5 | — | Adobe / acrobat | 2026-09-08 | 2026-09-11 |
| CVE-2026-75735 Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vuln... |
medium | 5.4 | — | Adobe / experience manager | 2026-09-08 | 2026-09-11 |
| CVE-2026-75740 Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vuln... |
medium | 5.4 | — | Adobe / experience manager | 2026-09-08 | 2026-09-11 |
| CVE-2026-75722 Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) v... |
medium | 5.4 | — | Adobe / experience manager | 2026-09-08 | 2026-09-11 |
| CVE-2026-75729 Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vuln... |
medium | 5.4 | — | Adobe / experience manager | 2026-09-08 | 2026-09-11 |
| CVE-2026-75706 Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) v... |
medium | 5.4 | — | Adobe / experience manager | 2026-09-08 | 2026-09-11 |
| CVE-2026-75716 Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) v... |
medium | 5.4 | — | Adobe / experience manager | 2026-09-08 | 2026-09-11 |
| CVE-2026-75677 Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) v... |
medium | 5.4 | — | Adobe / experience manager | 2026-09-08 | 2026-09-11 |
| CVE-2026-75683 Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) v... |
medium | 5.4 | — | Adobe / experience manager | 2026-09-08 | 2026-09-11 |
| CVE-2026-75642 Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vuln... |
medium | 5.4 | — | Adobe / experience manager | 2026-09-08 | 2026-09-11 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.