September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,291
Critical
1,223
High
4,345
Medium
4,103
Low
460
Severity not reported
1,160
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-75708 Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) v... |
medium | 5.4 | — | Adobe / experience manager | 2026-09-08 | 2026-09-10 |
| CVE-2026-75713 Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) v... |
medium | 5.4 | — | Adobe / experience manager | 2026-09-08 | 2026-09-10 |
| CVE-2026-75718 Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) v... |
medium | 5.4 | — | Adobe / experience manager | 2026-09-08 | 2026-09-10 |
| CVE-2026-75725 Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) v... |
medium | 5.4 | — | Adobe / experience manager | 2026-09-08 | 2026-09-10 |
| CVE-2026-75731 Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vuln... |
medium | 5.4 | — | Adobe / experience manager | 2026-09-08 | 2026-09-10 |
| CVE-2026-74237 GFI Exinda AI and ClearView before 7.6.5 contains an argument injection vulnerab... |
medium | 6.5 | — | — | 2026-09-04 | 2026-09-10 |
| CVE-2026-75672 Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) v... |
medium | 5.4 | — | Adobe / experience manager | 2026-09-08 | 2026-09-10 |
| CVE-2026-75679 Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) v... |
medium | 5.4 | — | Adobe / experience manager | 2026-09-08 | 2026-09-10 |
| CVE-2026-75687 Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) v... |
medium | 5.4 | — | Adobe / experience manager | 2026-09-08 | 2026-09-10 |
| CVE-2026-56101 OpenBSD before commit 1ee99df contains an inverted comparison vulnerability in t... |
medium | 5.3 | — | — | 2026-09-08 | 2026-09-10 |
| CVE-2026-42806 An out-of-bounds read vulnerability was discovered in the Bosch BME690 SensorAPI... |
medium | 4.3 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-19625 When a Quarkus application has multiple endpoints secured by individual OIDC pro... |
medium | 5.3 | — | — | 2026-09-08 | 2026-09-10 |
| CVE-2026-17442 IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, and 12.0.1.0 through 12.0.... |
medium | 5.5 | — | Ibm / app connect enterprise | 2026-09-04 | 2026-09-10 |
| CVE-2026-18076 IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to caus... |
medium | 6.5 | — | Ibm / i | 2026-09-04 | 2026-09-10 |
| CVE-2026-14470 IBM Langflow OSS 1.0.0 through 1.10.2 could allow an authenticated attacker to t... |
medium | 6.5 | — | Langflow / langflow | 2026-09-04 | 2026-09-10 |
| CVE-2026-79910 Acrobat Reader is affected by an out-of-bounds read vulnerability that could lea... |
medium | 5.5 | — | Adobe / acrobat | 2026-09-08 | 2026-09-10 |
| CVE-2026-84697 Mailpit's IsInternalIP deny list function fails to block the Azure WireServer ad... |
medium | 5.3 | — | — | 2026-09-02 | 2026-09-10 |
| CVE-2026-85092 LiME through 1.12.0 fails to validate the disk acquisition output path and does... |
medium | 6.6 | — | — | 2026-09-03 | 2026-09-10 |
| CVE-2026-85093 Cheshire Cat AI's GET /memory/collections/{collection_id}/points endpoint fails... |
medium | 6.5 | — | — | 2026-09-03 | 2026-09-10 |
| CVE-2026-85622 AppFlowy-Cloud through 0.9.64 fails to validate workspace membership when establ... |
medium | 5.3 | — | — | 2026-09-04 | 2026-09-10 |
| CVE-2026-85624 Blinko 1.8.7 contains a cross-user private note disclosure vulnerability in the... |
medium | 6.5 | — | — | 2026-09-04 | 2026-09-10 |
| CVE-2026-85692 Nightingale (n9e), as of commit 8362cbe (main branch, confirmed 2026-08-27), con... |
medium | 6.5 | — | — | 2026-09-04 | 2026-09-10 |
| CVE-2026-86777 AlchemyCMS versions before 7.4.16 and 8.x before 8.3.6 fail to authorize access... |
medium | 5.3 | — | — | 2026-09-09 | 2026-09-10 |
| CVE-2026-81330 The C6 ear camera transmits live video to the EarVision Android application over... |
medium | 6.5 | — | — | 2026-09-09 | 2026-09-10 |
| CVE-2026-53956 Rattler is a library that provides common functionality used within the conda ec... |
medium | 5.4 | — | — | 2026-09-09 | 2026-09-10 |
| CVE-2026-73788 A vulnerability in the ClearPass OnGuard agent could allow an authenticated remo... |
medium | 6.5 | — | — | 2026-09-09 | 2026-09-10 |
| CVE-2026-73789 A vulnerability in the web-based management interface of CPPM guest account mana... |
medium | 5.3 | — | — | 2026-09-09 | 2026-09-10 |
| CVE-2026-66632 Unauthenticated Content Injection in Simple Cloudflare Turnstile <= 1.42.1 versi... |
medium | 6.5 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-81788 Subscriber Broken Access Control in IMPress for IDX Broker <= 3.3.0 versions. |
medium | 6.3 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-84698 PX4 Autopilot contains a heap buffer overflow vulnerability in the sd_bench comm... |
medium | 6.5 | — | — | 2026-09-02 | 2026-09-10 |
| CVE-2026-86097 PX4 Autopilot through 1.17.0 contains a null pointer dereference vulnerability i... |
medium | 6.5 | — | — | 2026-09-04 | 2026-09-10 |
| CVE-2026-42808 An issue was discovered in Bosch Sensortec COINES_SDK versions 2.0 through 2.11. |
medium | 6.8 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-80160 Acrobat Reader is affected by an out-of-bounds read vulnerability that could lea... |
medium | 5.5 | — | Adobe / acrobat | 2026-09-08 | 2026-09-10 |
| CVE-2026-87641 Race condition in Browser in Google Chrome prior to 153.0.8010.36 allowed a remo... |
medium | 4.2 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87812 SiYuan before v3.8.2 contains a stored cross-site scripting vulnerability in Baz... |
medium | 6.8 | — | — | 2026-09-09 | 2026-09-10 |
| CVE-2026-80162 Acrobat Reader is affected by a Use After Free vulnerability that could lead to... |
medium | 5.5 | — | Adobe / acrobat | 2026-09-08 | 2026-09-10 |
| CVE-2026-86198 PocketMine-MP versions before 5.44.2 fail to properly validate multiple Resource... |
medium | 4.2 | — | — | 2026-09-09 | 2026-09-10 |
| CVE-2026-85981 The administrative panel of the Auth0 AD/LDAP Connector (versions 6.5.0 and earl... |
medium | 6.7 | — | — | 2026-09-08 | 2026-09-10 |
| CVE-2026-85543 Some Wi-Fi series camera products have insufficient permission validation on cer... |
medium | 4.3 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-84685 The react-native-auth0 SDK's web platform implementation does not scope its in-m... |
medium | 6.5 | — | — | 2026-09-08 | 2026-09-10 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.