September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,290
Critical
1,223
High
4,344
Medium
4,103
Low
460
Severity not reported
1,160
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-75671 Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) v... |
medium | 5.4 | — | Adobe / experience manager | 2026-09-08 | 2026-09-10 |
| CVE-2026-75724 Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) v... |
medium | 5.4 | — | Adobe / experience manager | 2026-09-08 | 2026-09-10 |
| CVE-2026-75736 Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vuln... |
medium | 5.4 | — | Adobe / experience manager | 2026-09-08 | 2026-09-10 |
| CVE-2026-75712 Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) v... |
medium | 5.4 | — | Adobe / experience manager | 2026-09-08 | 2026-09-10 |
| CVE-2026-75707 Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) v... |
medium | 5.4 | — | Adobe / experience manager | 2026-09-08 | 2026-09-10 |
| CVE-2026-87577 Incorrect authorization in Isolated in Google Chrome prior to 153.0.8010.36 allo... |
medium | 4.3 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87583 UI misrepresentation in Passwords in Google Chrome on on Android prior to 153.0.... |
medium | 5.4 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87586 Out of bounds read in ANGLE in Google Chrome prior to 153.0.8010.36 allowed a re... |
medium | 4.3 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87592 Out of bounds read in Tint in Google Chrome prior to 153.0.8010.36 allowed a rem... |
medium | 4.3 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87596 Out of bounds read in ANGLE in Google Chrome prior to 153.0.8010.36 allowed a re... |
medium | 4.3 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87597 UI misrepresentation in CustomTabs in Google Chrome on on Android prior to 153.0... |
medium | 4.8 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87599 Improper input validation in Interstitials in Google Chrome prior to 153.0.8010.... |
medium | 5.4 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87615 Race condition in Payments in Google Chrome prior to 153.0.8010.36 allowed a rem... |
medium | 5.4 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-81991 Acrobat Reader is affected by an out-of-bounds read vulnerability that could lea... |
medium | 5.5 | — | Adobe / acrobat | 2026-09-08 | 2026-09-10 |
| CVE-2026-87624 UI misrepresentation in Passwords in Google Chrome on on Android prior to 153.0.... |
medium | 4.2 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87630 Integer overflow in WebRTC in Google Chrome prior to 153.0.8010.36 allowed a rem... |
medium | 4.3 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-81993 Acrobat Reader is affected by a Heap-based Buffer Overflow vulnerability that co... |
medium | 5.5 | — | Adobe / acrobat | 2026-09-08 | 2026-09-10 |
| CVE-2026-84385 A improper access control vulnerability in Fortinet FortiSOAR PaaS 7.6.0 through... |
medium | 5.4 | — | — | 2026-09-08 | 2026-09-10 |
| CVE-2026-87747 The Enterprise Cloud Database developed by Ragic has an Arbitrary File Read vuln... |
medium | 4.9 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-81646 Out-of-bounds read vulnerability in the graphics module. |
medium | 5.9 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-81647 Out-of-bounds read vulnerability in the graphics module. |
medium | 5.3 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-81644 DoS vulnerability in the preview service module. |
medium | 4.3 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-41987 Permission control vulnerability in the app management module. |
medium | 6.2 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-49309 Permission control vulnerability in the Settings module. |
medium | 4.8 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-49311 Permission control vulnerability in the event notification module.Impact: Succes... |
medium | 6.2 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-49312 Permission control vulnerability in the window module. |
medium | 4.0 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-49313 Permission control vulnerability in the app lock module. |
medium | 5.5 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-84306 Filament is a collection of full-stack components for accelerated Laravel develo... |
medium | 6.5 | — | — | 2026-09-01 | 2026-09-09 |
| CVE-2026-84308 phpseclib is a PHP secure communications library. |
medium | 6.3 | — | — | 2026-09-01 | 2026-09-09 |
| CVE-2026-63435 Mail is an internet library for Ruby designed to handle email generation, parsin... |
medium | 5.3 | — | — | 2026-09-01 | 2026-09-09 |
| CVE-2026-84363 Hono is a Web application framework that provides support for any JavaScript run... |
medium | 5.9 | — | — | 2026-09-01 | 2026-09-09 |
| CVE-2026-84364 Hono is a Web application framework that provides support for any JavaScript run... |
medium | 5.3 | — | — | 2026-09-01 | 2026-09-09 |
| CVE-2026-84365 Hono is a Web application framework that provides support for any JavaScript run... |
medium | 6.5 | — | — | 2026-09-01 | 2026-09-09 |
| CVE-2026-84369 SVGO, short for SVG Optimizer, is a Node.js library and command-line application... |
medium | 6.1 | — | — | 2026-09-01 | 2026-09-09 |
| CVE-2026-84371 ApostropheCMS is an open-source Node.js content management system, and sanitize-... |
medium | 5.4 | — | — | 2026-09-01 | 2026-09-09 |
| CVE-2026-84373 Vitest is a testing framework powered by Vite. |
medium | 5.9 | — | — | 2026-09-01 | 2026-09-09 |
| CVE-2026-55221 Boruta is a standalone authorization server that aims to implement OAuth 2.0 and... |
medium | 6.5 | — | — | 2026-09-02 | 2026-09-09 |
| CVE-2026-50554 Note Mark is an open-source note-taking application. |
medium | 5.3 | — | — | 2026-09-03 | 2026-09-09 |
| CVE-2026-75602 OpenList a file list program that supports multiple storage. |
medium | 6.5 | — | — | 2026-09-03 | 2026-09-09 |
| CVE-2026-71429 stream-json is a micro-library of stream components for processing JSON and JSON... |
medium | 6.2 | — | — | 2026-09-03 | 2026-09-09 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.