September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,319
Critical
1,226
High
4,360
Medium
4,108
Low
460
Severity not reported
1,165
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (964), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-90684 A flaw has been found in GPAC up to f1219cde. |
low | 2.8 | — | — | 2026-09-14 | 2026-09-14 |
| CVE-2026-90694 A vulnerability has been found in SourceCodester Inventory Management System 1.0... |
low | 3.5 | — | — | 2026-09-14 | 2026-09-14 |
| CVE-2026-90696 A vulnerability was determined in SourceCodester Inventory Management System 1.0... |
low | 3.5 | — | — | 2026-09-14 | 2026-09-14 |
| CVE-2026-90811 A weakness has been identified in cosmicstack-labs mercury-agent up to 1.2.0. |
low | 3.3 | — | — | 2026-09-14 | 2026-09-14 |
| CVE-2026-86740 Snipe-IT before 8.7.0 fails to check the return value of Storage::delete() in Up... |
low | 3.8 | — | Snipeitapp / snipe-it | 2026-09-09 | 2026-09-14 |
| CVE-2026-73318 XenForo before 2.3.13 contains a missing authorization vulnerability in the forc... |
low | 3.8 | — | Xenforo / xenforo | 2026-09-08 | 2026-09-14 |
| CVE-2026-78124 strongSwan 5.0.2 through 6.0.7 allows PKCS#7 certificate enumeration in the open... |
low | 3.7 | — | Strongswan / strongswan | 2026-09-11 | 2026-09-14 |
| CVE-2026-78127 libcharon in strongSwan 4.1.2 through 6.0.7 has a missing release of memory afte... |
low | 3.7 | — | Strongswan / strongswan | 2026-09-11 | 2026-09-14 |
| CVE-2026-78131 strongSwan 4.2.0 through 6.0.7 has a missing release of memory after its effecti... |
low | 3.7 | — | Strongswan / strongswan | 2026-09-11 | 2026-09-14 |
| CVE-2026-79729 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application... |
low | 3.7 | — | Dell / secure connect gateway | 2026-09-09 | 2026-09-14 |
| CVE-2026-80175 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application... |
low | 3.3 | — | Dell / secure connect gateway | 2026-09-09 | 2026-09-14 |
| CVE-2026-86231 A security flaw has been discovered in mwiede jsch up to 2.28.5. |
low | 3.7 | — | — | 2026-09-06 | 2026-09-11 |
| CVE-2026-79693 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application... |
low | 3.4 | — | Dell / secure connect gateway | 2026-09-09 | 2026-09-11 |
| CVE-2026-48707 InstantCMS is a free and open source content management system. |
low | 3.1 | — | — | 2026-09-08 | 2026-09-11 |
| CVE-2026-73317 XenForo before 2.3.13 contains a missing authorization vulnerability in the ACP... |
low | 2.7 | — | Xenforo / xenforo | 2026-09-08 | 2026-09-11 |
| CVE-2026-86779 The Visualizer WordPress plugin before 4.0.6 does not properly authorise chart-d... |
low | 2.7 | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-11765 Improper neutralization of argument delimiters in a command ('argument injection... |
low | 3.3 | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-75726 Adobe Experience Manager is affected by an Improper Input Validation vulnerabili... |
low | 3.5 | — | Adobe / experience manager | 2026-09-08 | 2026-09-10 |
| CVE-2026-86776 KeePass versions 2.35 through 2.61.1 fail to validate KDBX header field sizes be... |
low | 3.3 | — | — | 2026-09-09 | 2026-09-10 |
| CVE-2026-84969 A memory-handling error in the BSON-to-JSON conversion helpers of the MongoDB C... |
low | 3.7 | — | Mongodb / c driver | 2026-09-03 | 2026-09-10 |
| CVE-2026-87525 Out of bounds read in Chromoting in Google Chrome on on Windows prior to 153.0.8... |
low | 2.7 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87442 Confused deputy in Prerender in Google Chrome prior to 153.0.8010.36 allowed a r... |
low | 3.1 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-85704 A security flaw has been discovered in ramon-victor freegpt-webui up to 098db3df... |
low | 3.7 | — | — | 2026-09-04 | 2026-09-10 |
| CVE-2026-87539 Observable discrepancy in Network in Google Chrome prior to 153.0.8010.36 allowe... |
low | 3.1 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-17483 IBM Db2 Mirror for i 7.4, 7.5, and 7.6 IBM i could allow a local attacker to del... |
low | 3.3 | — | Ibm / db2 mirror for i | 2026-09-04 | 2026-09-10 |
| CVE-2026-84389 A url redirection to untrusted site ('open redirect') vulnerability in Fortinet... |
low | 3.1 | — | — | 2026-09-08 | 2026-09-10 |
| CVE-2026-84307 Filament is a collection of full-stack components for accelerated Laravel develo... |
low | 3.7 | — | — | 2026-09-01 | 2026-09-09 |
| CVE-2026-84367 joi is a schema description language and data validator for JavaScript. |
low | 3.7 | — | — | 2026-09-01 | 2026-09-09 |
| CVE-2026-84368 joi is a schema description language and data validator for JavaScript. |
low | 3.7 | — | — | 2026-09-01 | 2026-09-09 |
| CVE-2026-87456 Uninitialized resource in Media in Google Chrome prior to 153.0.8010.36 allowed... |
low | 3.4 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-87434 Missing authorization in CORS in Google Chrome prior to 153.0.8010.36 allowed a... |
low | 3.1 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-87647 Uninitialized resource in GPU in Google Chrome prior to 153.0.8010.36 allowed a... |
low | 3.4 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-87576 Uninitialized resource in GPU in Google Chrome on on Android prior to 153.0.8010... |
low | 3.4 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-87657 Use after free in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote at... |
low | 3.1 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-87614 Incorrect authorization in ServiceWorker in Google Chrome prior to 153.0.8010.36... |
low | 3.1 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-49456 Waku is the minimal React framework. |
low | 3.1 | — | — | 2026-09-03 | 2026-09-09 |
| CVE-2026-79966 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application... |
low | 3.3 | — | Dell / secure connect gateway | 2026-09-09 | 2026-09-09 |
| CVE-2026-80169 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application... |
low | 3.3 | — | Dell / secure connect gateway | 2026-09-09 | 2026-09-09 |
| CVE-2026-79690 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application... |
low | 3.7 | — | Dell / secure connect gateway | 2026-09-09 | 2026-09-09 |
| CVE-2026-79732 Dell Secure Connect Gateway (SCG) 5.0 Appliance, versions prior to 5.36.00.xx, c... |
low | 3.7 | — | Dell / secure connect gateway | 2026-09-09 | 2026-09-09 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.