September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,291
Critical
1,223
High
4,345
Medium
4,103
Low
460
Severity not reported
1,160
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-81984 Acrobat Reader is affected by a Use After Free vulnerability that could lead to... |
medium | 5.5 | — | Adobe / acrobat | 2026-09-08 | 2026-09-10 |
| CVE-2026-81994 Acrobat Reader is affected by an Improperly Controlled Modification of Object Pr... |
medium | 6.3 | — | Adobe / acrobat | 2026-09-08 | 2026-09-10 |
| CVE-2026-78635 The Okta Privileged Access client URL handler does not insert an option terminat... |
medium | 5.0 | — | — | 2026-09-08 | 2026-09-10 |
| CVE-2026-78622 The Okta Verify for Windows uninstaller does not verify whether the user data di... |
medium | 6.0 | — | — | 2026-09-08 | 2026-09-10 |
| CVE-2026-61608 SolidInvoice is an open-source invoicing platform. |
medium | 6.8 | — | — | 2026-09-04 | 2026-09-10 |
| CVE-2026-61614 SolidInvoice is an open-source invoicing platform. |
medium | 5.9 | — | — | 2026-09-04 | 2026-09-10 |
| CVE-2026-61688 SolidInvoice is an open-source invoicing platform. |
medium | 6.5 | — | — | 2026-09-04 | 2026-09-10 |
| CVE-2026-19840 The Notiqoo WordPress plugin before 1.4.14 does not have capability checks on se... |
medium | 6.5 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-81635 A cross-site scripting vulnerability exists in SHIRASAGI, which may allow an att... |
medium | 5.4 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-82582 An authorization bypass vulnerability exists in SHIRASAGI through a user-control... |
medium | 4.3 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-88268 GeoVision GV-LPC2211
V1.13 contains an authenticated stack buffer overflow in SS... |
medium | 6.5 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-88269 GeoVision GV-LPC2211 V1.13 allows a Guest user to retrieve persistent device con... |
medium | 6.5 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-9161 Observable response discrepancy vulnerability in DernekPlus Website Template all... |
medium | 5.3 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-81978 Acrobat Reader is affected by an out-of-bounds read vulnerability that could lea... |
medium | 5.5 | — | Adobe / acrobat | 2026-09-08 | 2026-09-10 |
| CVE-2026-72956 Untrusted pointer dereference in Microsoft Office PowerPoint allows an unauthori... |
medium | 6.5 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-10 |
| CVE-2026-83501 Out-of-bounds read in Windows Virtualization-Based Security (VBS) Enclave allows... |
medium | 5.5 | — | Microsoft / windows 11 23h2 | 2026-09-08 | 2026-09-10 |
| CVE-2026-88770 A flaw was found in the Device Authorization Grant flow of Keycloak, an identity... |
medium | 6.5 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-80084 Out-of-bounds read in Microsoft Office Outlook allows an unauthorized attacker t... |
medium | 6.5 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-10 |
| CVE-2026-15820 The Builderall for WordPress plugin for WordPress is vulnerable to Stored Cross-... |
medium | 6.4 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-18594 The Advanced Contact form 7 DB plugin for WordPress is vulnerable to authorizati... |
medium | 4.3 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-5399 The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scri... |
medium | 6.4 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-86737 snipe-it versions before 8.7.0 fail to enforce asset view authorization in the G... |
medium | 4.3 | — | Snipeitapp / snipe-it | 2026-09-08 | 2026-09-10 |
| CVE-2026-75669 Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) v... |
medium | 5.4 | — | Adobe / experience manager | 2026-09-08 | 2026-09-10 |
| CVE-2026-75675 Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) v... |
medium | 5.4 | — | Adobe / experience manager | 2026-09-08 | 2026-09-10 |
| CVE-2026-75681 Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) v... |
medium | 5.4 | — | Adobe / experience manager | 2026-09-08 | 2026-09-10 |
| CVE-2026-75720 Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) v... |
medium | 5.4 | — | Adobe / experience manager | 2026-09-08 | 2026-09-10 |
| CVE-2026-75710 Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) v... |
medium | 5.4 | — | Adobe / experience manager | 2026-09-08 | 2026-09-10 |
| CVE-2026-75715 Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) v... |
medium | 5.4 | — | Adobe / experience manager | 2026-09-08 | 2026-09-10 |
| CVE-2026-75685 Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) v... |
medium | 5.4 | — | Adobe / experience manager | 2026-09-08 | 2026-09-10 |
| CVE-2026-75691 Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) v... |
medium | 5.4 | — | Adobe / experience manager | 2026-09-08 | 2026-09-10 |
| CVE-2026-75696 Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) v... |
medium | 5.4 | — | Adobe / experience manager | 2026-09-08 | 2026-09-10 |
| CVE-2026-75705 Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) v... |
medium | 5.4 | — | Adobe / experience manager | 2026-09-08 | 2026-09-10 |
| CVE-2026-75730 Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vuln... |
medium | 5.4 | — | Adobe / experience manager | 2026-09-08 | 2026-09-10 |
| CVE-2026-75741 Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vuln... |
medium | 5.4 | — | Adobe / experience manager | 2026-09-08 | 2026-09-10 |
| CVE-2026-75693 Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) v... |
medium | 5.4 | — | Adobe / experience manager | 2026-09-08 | 2026-09-10 |
| CVE-2026-75701 Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) v... |
medium | 5.4 | — | Adobe / experience manager | 2026-09-08 | 2026-09-10 |
| CVE-2026-75717 Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) v... |
medium | 5.4 | — | Adobe / experience manager | 2026-09-08 | 2026-09-10 |
| CVE-2026-75727 Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vuln... |
medium | 5.4 | — | Adobe / experience manager | 2026-09-08 | 2026-09-10 |
| CVE-2026-75734 Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vuln... |
medium | 5.4 | — | Adobe / experience manager | 2026-09-08 | 2026-09-10 |
| CVE-2026-75739 Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vuln... |
medium | 5.4 | — | Adobe / experience manager | 2026-09-08 | 2026-09-10 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.