September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,291
Critical
1,223
High
4,345
Medium
4,103
Low
460
Severity not reported
1,160
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-16660 IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to cause a... |
medium | 5.3 | — | Ibm / db2 mirror for i | 2026-09-04 | 2026-09-10 |
| CVE-2026-15889 The Aruba HiSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site... |
medium | 6.4 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-86084 n8n is an open source workflow automation platform. |
medium | 5.5 | — | N8n / n8n | 2026-09-08 | 2026-09-10 |
| CVE-2026-86993 n8n is an open source workflow automation platform. |
medium | 4.9 | — | N8n / n8n | 2026-09-08 | 2026-09-10 |
| CVE-2026-86994 n8n is an open source workflow automation platform. |
medium | 4.3 | — | N8n / n8n | 2026-09-08 | 2026-09-10 |
| CVE-2026-86995 n8n is an open source workflow automation platform. |
medium | 4.3 | — | N8n / n8n | 2026-09-08 | 2026-09-10 |
| CVE-2026-86996 n8n is an open source workflow automation platform. |
medium | 5.4 | — | N8n / n8n | 2026-09-08 | 2026-09-10 |
| CVE-2026-87475 Missing authorization in Omnibox in Google Chrome prior to 153.0.8010.36 allowed... |
medium | 6.5 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87513 Missing authorization in ControlledFrame in Google Chrome prior to 153.0.8010.36... |
medium | 6.5 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-21097 Improper authentication in ActivityTaskManagerService prior to SMR Sep-2026 Rele... |
medium | 6.7 | — | Samsung / android | 2026-09-09 | 2026-09-10 |
| CVE-2026-21099 Improper access control in SettingsProvider prior to SMR Sep-2026 Release 1 allo... |
medium | 5.5 | — | Samsung / android | 2026-09-09 | 2026-09-10 |
| CVE-2026-21103 Path traversal in GalaxyDiagnostics prior to SMR Sep-2026 Release 1 allows physi... |
medium | 6.1 | — | Samsung / android | 2026-09-09 | 2026-09-10 |
| CVE-2026-84968 An out-of-bounds read in the BSON decoding component of the MongoDB PHP driver m... |
medium | 5.3 | — | Mongodb / php driver | 2026-09-03 | 2026-09-10 |
| CVE-2026-54048 Specifying tblproperties('avro.schema.url'=' http://...' ) or with a 'file:///'... |
medium | 5.3 | — | Apache / impala | 2026-09-09 | 2026-09-10 |
| CVE-2026-9736 IBM Netezza Software 11.3.0.3 through Interim Fix 002 could allow an unauthorize... |
medium | 4.3 | — | Ibm / netezza performance server | 2026-09-03 | 2026-09-10 |
| CVE-2026-9744 IBM Netezza Software 11.3.0.3 through Interim Fix 002 does not validate or impro... |
medium | 5.9 | — | Ibm / netezza performance server | 2026-09-03 | 2026-09-10 |
| CVE-2026-87543 Missing authorization in Core in Google Chrome prior to 153.0.8010.36 allowed a... |
medium | 4.3 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87561 Incorrect authorization in Web Authentication in Google Chrome prior to 153.0.80... |
medium | 4.3 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87429 Missing authorization in ServiceWorker in Google Chrome prior to 153.0.8010.36 a... |
medium | 6.5 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87107 Consul and Consul Enterprise are vulnerable to an authorization bypass in the ca... |
medium | 5.4 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-9745 IBM Netezza Software 11.3.0.3 through Interim Fix 002 has operations that are pe... |
medium | 6.5 | — | Ibm / netezza performance server | 2026-09-03 | 2026-09-10 |
| CVE-2026-86547 mrubyc through 4.0.0 contains a null pointer dereference vulnerability in the op... |
medium | 6.2 | — | — | 2026-09-09 | 2026-09-10 |
| CVE-2026-88940 knowns through 0.33.0 fails to validate the path query parameter in the workspac... |
medium | 5.3 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-52097 An issue in AppFlowy 0.11.8 allows a remote attacker to execute arbitrary code v... |
medium | 6.8 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-88038 cookies is a Node.js library for reading and writing HTTP cookies, used by Koa v... |
medium | 4.8 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-87912 A missing S3 bucket ownership verification in the AWS Security Agent plugin in A... |
medium | 5.9 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-87913 A missing S3 bucket ownership verification in the AWS Security Agent MCP server... |
medium | 5.9 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-88055 AnythingLLM is an application that turns pieces of content into context that any... |
medium | 5.5 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-84970 A numeric truncation weakness exists in the JSON parsing component of the MongoD... |
medium | 5.8 | — | Mongodb / c\+\+ driver | 2026-09-03 | 2026-09-10 |
| CVE-2026-87106 Consul and Consul Enterprise are vulnerable to a denial of service in the native... |
medium | 6.5 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-85226 MISP contains an authorization flaw in the OnDemand correlation engine where cor... |
medium | 4.3 | — | Misp-project / misp | 2026-09-03 | 2026-09-10 |
| CVE-2026-85227 MISP contains a reflected Cross-Site Scripting (XSS) vulnerability in the event... |
medium | 6.1 | — | Misp-project / misp | 2026-09-03 | 2026-09-10 |
| CVE-2026-85230 A persistent unsafe URL injection vulnerability exists in the MISP dashboard But... |
medium | 5.4 | — | Misp-project / misp | 2026-09-03 | 2026-09-10 |
| CVE-2026-87436 Incomplete cleanup in Browser in Google Chrome prior to 153.0.8010.36 allowed a... |
medium | 6.5 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87515 Incorrect authorization in FileAPI in Google Chrome prior to 153.0.8010.36 allow... |
medium | 6.5 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87503 Inappropriate implementation in Downloads in Google Chrome on on Android prior t... |
medium | 6.5 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87507 UI misrepresentation in Downloads in Google Chrome prior to 153.0.8010.36 allowe... |
medium | 5.4 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87501 UI misrepresentation in Passwords in Google Chrome prior to 153.0.8010.36 allowe... |
medium | 5.4 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87497 Uninitialized resource in Codecs in Google Chrome prior to 153.0.8010.36 allowed... |
medium | 4.3 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87496 UI misrepresentation in Browser in Google Chrome prior to 153.0.8010.36 allowed... |
medium | 5.4 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.