September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,291
Critical
1,223
High
4,345
Medium
4,103
Low
460
Severity not reported
1,160
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-71356 Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) v... |
medium | 5.4 | — | Adobe / experience manager | 2026-09-08 | 2026-09-11 |
| CVE-2026-21092 Path traversal in ImsService prior to SMR Sep-2026 Release 1 allows remote attac... |
medium | 5.3 | — | Samsung / android | 2026-09-09 | 2026-09-11 |
| CVE-2026-21093 Stack-based buffer overflow in PROCA trustlet prior to SMR Sep-2026 Release 1 al... |
medium | 6.7 | — | Samsung / android | 2026-09-09 | 2026-09-11 |
| CVE-2026-27227 Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vuln... |
medium | 5.4 | — | Adobe / experience manager | 2026-09-08 | 2026-09-11 |
| CVE-2026-75666 Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) v... |
medium | 5.4 | — | Adobe / experience manager | 2026-09-08 | 2026-09-11 |
| CVE-2026-75652 Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) v... |
medium | 5.4 | — | Adobe / experience manager | 2026-09-08 | 2026-09-11 |
| CVE-2026-75643 Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vuln... |
medium | 5.4 | — | Adobe / experience manager | 2026-09-08 | 2026-09-11 |
| CVE-2026-75636 Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) v... |
medium | 5.4 | — | Adobe / experience manager | 2026-09-08 | 2026-09-11 |
| CVE-2026-71565 Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) v... |
medium | 5.4 | — | Adobe / experience manager | 2026-09-08 | 2026-09-11 |
| CVE-2026-75660 Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) v... |
medium | 5.4 | — | Adobe / experience manager | 2026-09-08 | 2026-09-11 |
| CVE-2026-75647 Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) v... |
medium | 5.4 | — | Adobe / experience manager | 2026-09-08 | 2026-09-11 |
| CVE-2026-75640 Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) v... |
medium | 5.4 | — | Adobe / experience manager | 2026-09-08 | 2026-09-11 |
| CVE-2026-75629 Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) v... |
medium | 5.4 | — | Adobe / experience manager | 2026-09-08 | 2026-09-11 |
| CVE-2026-71388 Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) v... |
medium | 5.4 | — | Adobe / experience manager | 2026-09-08 | 2026-09-11 |
| CVE-2026-19644 Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) v... |
medium | 5.4 | — | Adobe / experience manager | 2026-09-08 | 2026-09-11 |
| CVE-2026-79974 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application... |
medium | 6.4 | — | Dell / secure connect gateway | 2026-09-09 | 2026-09-11 |
| CVE-2026-21104 Heap-based buffer overflow in KnoxVault trustlet prior to SMR Sep-2026 Release 1... |
medium | 6.7 | — | Samsung / android | 2026-09-09 | 2026-09-11 |
| CVE-2026-21102 Use after free in DualDAR prior to SMR Sep-2026 Release 1 allows local privilege... |
medium | 6.7 | — | Samsung / android | 2026-09-09 | 2026-09-11 |
| CVE-2026-21085 Out-of-bounds write in Keymaster trustlet prior to SMR Sep-2026 Release 1 allows... |
medium | 6.7 | — | Samsung / android | 2026-09-09 | 2026-09-11 |
| CVE-2026-9036 IBM Netezza Software 11.3.0.3 through Interim Fix 002 does not validate or impro... |
medium | 5.9 | — | Ibm / netezza performance server | 2026-09-03 | 2026-09-10 |
| CVE-2026-9138 IBM Langflow OSS 1.0.0 through 1.11.2 Langflow could allow an authenticated atta... |
medium | 6.5 | — | Langflow / langflow | 2026-09-04 | 2026-09-10 |
| CVE-2026-85310 import_contacts Path Traversal in Groundhogg <= 4.7.1 versions. |
medium | 6.5 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-79905 Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vuln... |
medium | 5.4 | — | Adobe / experience manager | 2026-09-08 | 2026-09-10 |
| CVE-2026-80159 Acrobat Reader is affected by an Untrusted Search Path vulnerability that could... |
medium | 4.0 | — | Adobe / acrobat | 2026-09-08 | 2026-09-10 |
| CVE-2026-78658 IBM UCD - IBM UrbanCode Deploy 7.2 through 7.2.3.25, and 7.3 through 7.3.2.20 an... |
medium | 6.5 | — | — | 2026-09-04 | 2026-09-10 |
| CVE-2026-75719 Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) v... |
medium | 5.4 | — | Adobe / experience manager | 2026-09-08 | 2026-09-10 |
| CVE-2026-75704 Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) v... |
medium | 5.4 | — | Adobe / experience manager | 2026-09-08 | 2026-09-10 |
| CVE-2026-75714 Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) v... |
medium | 5.4 | — | Adobe / experience manager | 2026-09-08 | 2026-09-10 |
| CVE-2026-75690 Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) v... |
medium | 5.4 | — | Adobe / experience manager | 2026-09-08 | 2026-09-10 |
| CVE-2026-75695 Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) v... |
medium | 5.4 | — | Adobe / experience manager | 2026-09-08 | 2026-09-10 |
| CVE-2026-75680 Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) v... |
medium | 5.4 | — | Adobe / experience manager | 2026-09-08 | 2026-09-10 |
| CVE-2026-69615 Improper neutralization of input during web page generation ('cross-site scripti... |
medium | 4.8 | — | Microsoft / sharepoint server | 2026-09-08 | 2026-09-10 |
| CVE-2026-66674 Unauthenticated Bypass Vulnerability in Simple Cloudflare Turnstile <= 1.42.1 ve... |
medium | 5.6 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-19645 IBM MQ Agent CD: v1.0.0, v1.0.1, v2.0.0, v2.0.1 An authenticated user with a val... |
medium | 6.5 | — | — | 2026-09-04 | 2026-09-10 |
| CVE-2026-18386 The WP BackItUp Community Edition plugin for WordPress is vulnerable to Director... |
medium | 4.9 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-17621 IBM Langflow OSS 1.0.0 through 1.10.2 could allow a remote attacker to traverse... |
medium | 5.4 | — | Langflow / langflow | 2026-09-04 | 2026-09-10 |
| CVE-2026-17273 IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to caus... |
medium | 6.5 | — | Ibm / i | 2026-09-04 | 2026-09-10 |
| CVE-2026-17444 IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, and 12.0.1.0 through 12.0.... |
medium | 6.5 | — | Ibm / app connect enterprise | 2026-09-04 | 2026-09-10 |
| CVE-2026-16941 IBM i 7.6, 7.5, and 7.4 could allow a remote authenticated attacker to modify ce... |
medium | 4.3 | — | Ibm / i | 2026-09-04 | 2026-09-10 |
| CVE-2026-17270 IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local attacker to cause a denial of s... |
medium | 5.5 | — | Ibm / i | 2026-09-04 | 2026-09-10 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.