September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,291
Critical
1,223
High
4,345
Medium
4,103
Low
460
Severity not reported
1,160
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2022-26961 Italtel NetMatch-S 5.0.0-20200703 allows Multiple Stored XSS under NP_IBCF-NATUP... |
medium | 5.4 | — | — | 2026-09-04 | 2026-09-09 |
| CVE-2026-87495 Information leak in Scroll in Google Chrome prior to 153.0.8010.36 allowed a rem... |
medium | 4.3 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-87508 Incorrect authorization in Loader in Google Chrome prior to 153.0.8010.36 allowe... |
medium | 4.3 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-87516 Observable discrepancy in Navigation in Google Chrome prior to 153.0.8010.36 all... |
medium | 4.3 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-87573 Improper input validation in Network in Google Chrome prior to 153.0.8010.36 all... |
medium | 4.3 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-87574 Information leak in ServiceWorker in Google Chrome prior to 153.0.8010.36 allowe... |
medium | 4.3 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-85089 FreeRDP versions 3.0.0 through 3.30.0 (before 3.31.0) transmit uninitialized hea... |
medium | 6.5 | — | Freerdp / freerdp | 2026-09-03 | 2026-09-09 |
| CVE-2026-87642 Uninitialized resource in WebGL in Google Chrome prior to 153.0.8010.36 allowed... |
medium | 4.3 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-87658 Information leak in Extensions in Google Chrome prior to 153.0.8010.36 allowed a... |
medium | 4.3 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-80171 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application... |
medium | 4.7 | — | Dell / secure connect gateway | 2026-09-09 | 2026-09-09 |
| CVE-2026-80073 Out-of-bounds read in Microsoft Office Outlook allows an unauthorized attacker t... |
medium | 6.5 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-09 |
| CVE-2026-81167 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripti... |
medium | 4.8 | — | Address Suggestion Project / address suggestion | 2026-09-02 | 2026-09-09 |
| CVE-2026-81162 Insertion of Sensitive Information Into Sent Data vulnerability in Drupal DXPR B... |
medium | 5.3 | — | Dxpr Builder Project / dxpr builder | 2026-09-02 | 2026-09-09 |
| CVE-2026-80128 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application... |
medium | 6.5 | — | Dell / secure connect gateway | 2026-09-07 | 2026-09-09 |
| CVE-2026-78487 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application... |
medium | 5.5 | — | Dell / secure connect gateway | 2026-09-07 | 2026-09-09 |
| CVE-2026-81269 Missing Authorization vulnerability in Drupal Data field allows Forceful Browsin... |
medium | 5.3 | — | Data Field Project / data field | 2026-09-02 | 2026-09-09 |
| CVE-2026-73474 Server-Side Request Forgery (SSRF) vulnerability in Drupal Entity Share Websub a... |
medium | 5.3 | — | Entity Share Websub Project / entity share websub | 2026-09-02 | 2026-09-09 |
| CVE-2026-54611 InstantCMS is a free and open source content management system. |
medium | 5.5 | — | — | 2026-09-08 | 2026-09-09 |
| CVE-2026-52772 YesWiki is a wiki system written in PHP. |
medium | 5.5 | — | — | 2026-09-05 | 2026-09-09 |
| CVE-2026-87518 Observable discrepancy in Safebrowsing in Google Chrome on on iOS prior to 153.0... |
medium | 5.3 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-87490 Information leak in Transactions Platform in Google Chrome prior to 153.0.8010.3... |
medium | 6.5 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-87502 Confused deputy in Fullscreen in Google Chrome prior to 153.0.8010.36 allowed a... |
medium | 4.2 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-87523 Race condition in DataTransfer in Google Chrome prior to 153.0.8010.36 allowed a... |
medium | 5.3 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-87593 Information leak in Editing in Google Chrome prior to 153.0.8010.36 allowed a re... |
medium | 6.5 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-87594 Incorrect authorization in DataTransfer in Google Chrome prior to 153.0.8010.36... |
medium | 5.3 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-87605 Missing authorization in Contacts in Google Chrome prior to 153.0.8010.36 allowe... |
medium | 5.3 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-87620 Observable discrepancy in SVG in Google Chrome prior to 153.0.8010.36 allowed a... |
medium | 6.5 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-87629 Incorrect authorization in Sources in Google Chrome prior to 153.0.8010.36 allow... |
medium | 6.5 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-87631 Missing authorization in DOM in Google Chrome prior to 153.0.8010.36 allowed a r... |
medium | 6.5 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-87651 Incorrect authorization in Paint in Google Chrome prior to 153.0.8010.36 allowed... |
medium | 4.3 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-87623 Observable discrepancy in DOM in Google Chrome prior to 153.0.8010.36 allowed a... |
medium | 6.5 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-69409 Execution with unnecessary privileges in Microsoft Office SharePoint allows an a... |
medium | 6.5 | — | Microsoft / sharepoint server | 2026-09-08 | 2026-09-09 |
| CVE-2026-69417 Improper neutralization of input during web page generation ('cross-site scripti... |
medium | 5.4 | — | Microsoft / sharepoint server | 2026-09-08 | 2026-09-09 |
| CVE-2026-87476 Incorrect authorization in Loader in Google Chrome prior to 153.0.8010.36 allowe... |
medium | 6.5 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-87032 Tanium addressed an information disclosure vulnerability in Tanium Server. |
medium | 4.3 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-75966 The Podlove Podcast Publisher plugin for WordPress is vulnerable to Stored Cross... |
medium | 6.4 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-14505 Tanium addressed a path traversal vulnerability in Tanium Data Service. |
medium | 6.6 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-14892 Tanium addressed an improper access controls vulnerability in Tanium Server. |
medium | 4.3 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-17149 The Points Management System For Gamification, Ranks, Badges, and Loyalty Reward... |
medium | 6.4 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-12230 The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin... |
medium | 6.4 | — | — | 2026-09-08 | 2026-09-09 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.