September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,291
Critical
1,223
High
4,345
Medium
4,103
Low
460
Severity not reported
1,160
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-12387 Use After Free vulnerability in Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valha... |
medium | 5.1 | — | — | 2026-09-08 | 2026-09-10 |
| CVE-2026-69781 Missing release of memory after effective lifetime in Windows DHCP Client allows... |
medium | 6.5 | — | Microsoft / windows 11 24h2 | 2026-09-08 | 2026-09-10 |
| CVE-2026-15461 The Sierra Wireless HL78xx modem GNSS driver (drivers/modem/hl78xx/, later drive... |
medium | 5.3 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-81997 Acrobat Reader is affected by an Incorrect Authorization vulnerability that coul... |
medium | 6.3 | — | Adobe / acrobat | 2026-09-08 | 2026-09-10 |
| CVE-2026-88898 AppFlowy-Cloud versions 0.7.2 through 0.9.64 fail to authorize callers against t... |
medium | 6.5 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-88283 GeoVision GV-LPC2211 V1.13 fails to limit repeated User elements in ONVIF Create... |
medium | 4.9 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-88284 GeoVision GV-LPC2211 V1.13 fails to limit repeated User elements in ONVIF SetUse... |
medium | 4.9 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-88288 GeoVision GV-LPC2211 V1.13 fails to restrict the filename supplied to BKDownload... |
medium | 6.5 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-88859 A flaw was found in Evolution. |
medium | 6.3 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-88279 GeoVision GV-LPC2211 V1.13 copies oversized ONVIF CreateUsers username or passwo... |
medium | 4.9 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-88280 GeoVision GV-LPC2211 V1.13 copies an oversized ONVIF SetUser password into a fix... |
medium | 4.9 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-88281 GeoVision GV-LPC2211 V1.13 fails to limit repeated Username elements in ONVIF De... |
medium | 4.9 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-87557 Missing authorization in LocalNetworkAccess in Google Chrome prior to 153.0.8010... |
medium | 4.3 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87640 Out of bounds read in WebView in Google Chrome on on Android prior to 153.0.8010... |
medium | 6.1 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87649 UI misrepresentation in Downloads in Google Chrome prior to 153.0.8010.36 allowe... |
medium | 5.4 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87548 Improper state validation in Installer in Google Chrome prior to 153.0.8010.36 a... |
medium | 4.3 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87549 Incomplete cleanup in Downloads in Google Chrome prior to 153.0.8010.36 allowed... |
medium | 6.5 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87552 Missing authorization in TrustedWebActivities in Google Chrome on on Android pri... |
medium | 5.5 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-86734 Snipe-IT before 8.7.1 fails to validate the length of the note field in the POST... |
medium | 6.5 | — | Snipeitapp / snipe-it | 2026-09-08 | 2026-09-10 |
| CVE-2026-86597 Insertion of sensitive information into log files in the Snowflake Python, Go, J... |
medium | 6.5 | — | — | 2026-09-08 | 2026-09-10 |
| CVE-2026-86719 WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 (master) con... |
medium | 5.4 | — | — | 2026-09-08 | 2026-09-10 |
| CVE-2026-86724 AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a cross-... |
medium | 6.5 | — | — | 2026-09-08 | 2026-09-10 |
| CVE-2026-86192 SiYuan versions before v3.8.2 fail to properly filter private attribute-view cel... |
medium | 6.5 | — | — | 2026-09-05 | 2026-09-10 |
| CVE-2026-86253 h3 (npm package) versions <= 2.0.1-rc.14 contain a path traversal vulnerability... |
medium | 5.9 | — | — | 2026-09-06 | 2026-09-10 |
| CVE-2026-86258 nbviewer through 1.0.1 contains a path traversal vulnerability in LocalFileHandl... |
medium | 5.9 | — | — | 2026-09-06 | 2026-09-10 |
| CVE-2026-86096 PX4 Autopilot through 1.17.0 contains a use-after-free vulnerability in Temperat... |
medium | 5.9 | — | — | 2026-09-04 | 2026-09-10 |
| CVE-2026-86112 BookWyrm through 0.9.1 fails to validate user visibility permissions in the Favo... |
medium | 5.4 | — | — | 2026-09-05 | 2026-09-10 |
| CVE-2026-86187 WWBN AVideo generates passwords for external-login accounts using rand() instead... |
medium | 5.9 | — | — | 2026-09-05 | 2026-09-10 |
| CVE-2026-85618 ConvertX 0.17.0 contains an arbitrary file read vulnerability in the xelatex con... |
medium | 6.5 | — | — | 2026-09-04 | 2026-09-10 |
| CVE-2026-85669 potpie through 2.0.0 fails to verify user ownership on the POST /conversations/{... |
medium | 6.5 | — | — | 2026-09-04 | 2026-09-10 |
| CVE-2026-85601 Grav Admin before 2.0.20 fails to sanitize output from marked.parse() before inj... |
medium | 5.4 | — | — | 2026-09-04 | 2026-09-10 |
| CVE-2026-85615 Openpanel before 2.3.0 contains an insecure direct object reference vulnerabilit... |
medium | 6.4 | — | — | 2026-09-04 | 2026-09-10 |
| CVE-2026-85528 Improper input validation of the auto-configuration account identifier in Snowfl... |
medium | 5.3 | — | — | 2026-09-04 | 2026-09-10 |
| CVE-2026-81785 Unauthenticated Broken Access Control in BuddyForms <= 2.9.0 versions. |
medium | 6.5 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-81791 Subscriber Cross Site Scripting (XSS) in EventON <= 2.5.7 versions. |
medium | 6.5 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-75737 Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vuln... |
medium | 5.4 | — | Adobe / experience manager | 2026-09-08 | 2026-09-10 |
| CVE-2026-75742 Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vuln... |
medium | 5.4 | — | Adobe / experience manager | 2026-09-08 | 2026-09-10 |
| CVE-2026-78536 Unauthenticated Broken Access Control in Robokassa payment gateway for Woocommer... |
medium | 6.5 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-75694 Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) v... |
medium | 5.4 | — | Adobe / experience manager | 2026-09-08 | 2026-09-10 |
| CVE-2026-75702 Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) v... |
medium | 5.4 | — | Adobe / experience manager | 2026-09-08 | 2026-09-10 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.