September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,326
Critical
1,227
High
4,361
Medium
4,108
Low
460
Severity not reported
1,170
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (964), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-43692 A validation issue was addressed with improved input sanitization. |
high | 8.8 | — | Apple / macos | 2026-09-14 | 2026-09-15 |
| CVE-2026-84553 A resource exhaustion issue was addressed with improved input validation. |
high | 7.5 | — | Apple / macos | 2026-09-14 | 2026-09-15 |
| CVE-2026-84568 A path traversal issue was addressed with improved path validation. |
high | 7.8 | — | Apple / macos | 2026-09-14 | 2026-09-15 |
| CVE-2026-84631 This issue was addressed with additional entitlement checks. |
high | 7.8 | — | Apple / macos | 2026-09-14 | 2026-09-15 |
| CVE-2026-86917 A permissions issue was addressed with additional restrictions. |
high | 7.8 | — | Apple / macos | 2026-09-14 | 2026-09-15 |
| CVE-2026-84540 An authorization issue was addressed with improved state management. |
medium | 5.5 | — | Apple / macos | 2026-09-14 | 2026-09-29 |
| CVE-2026-84618 A permissions issue was addressed with improved validation. |
medium | 5.5 | — | Apple / macos | 2026-09-14 | 2026-09-23 |
| CVE-2026-84619 An out-of-bounds write issue was addressed with improved bounds checking. |
medium | 6.1 | — | Apple / macos | 2026-09-14 | 2026-09-23 |
| CVE-2026-84621 An authorization issue was addressed with improved access control. |
medium | 5.5 | — | Apple / ipados | 2026-09-14 | 2026-09-23 |
| CVE-2026-84624 A permissions issue was addressed with improved path validation. |
medium | 5.5 | — | Apple / ipados | 2026-09-14 | 2026-09-23 |
| CVE-2026-84628 An authorization issue was addressed with improved state management. |
medium | 5.5 | — | Apple / ipados | 2026-09-14 | 2026-09-23 |
| CVE-2026-65393 A permissions issue was addressed with improved validation. |
medium | 5.5 | — | Apple / xcode | 2026-09-14 | 2026-09-22 |
| CVE-2026-65382 A parsing issue in the handling of directory paths was addressed with improved p... |
medium | 5.5 | — | Apple / macos | 2026-09-14 | 2026-09-20 |
| CVE-2026-84524 An out-of-bounds read was addressed with improved bounds checking. |
medium | 4.3 | — | Apple / ipados | 2026-09-14 | 2026-09-18 |
| CVE-2026-84526 An out-of-bounds write issue was addressed with improved bounds checking. |
medium | 4.3 | — | Apple / ipados | 2026-09-14 | 2026-09-18 |
| CVE-2026-84532 An out-of-bounds read issue was addressed with improved input validation. |
medium | 5.4 | — | Apple / ipados | 2026-09-14 | 2026-09-18 |
| CVE-2026-28966 An out-of-bounds write issue was addressed with improved bounds checking. |
medium | 4.3 | — | Apple / ipados | 2026-09-14 | 2026-09-18 |
| CVE-2026-28968 An out-of-bounds write issue was addressed with improved bounds checking. |
medium | 5.5 | — | Apple / ipados | 2026-09-14 | 2026-09-18 |
| CVE-2026-65360 A race condition was addressed with improved state handling. |
medium | 4.7 | — | Apple / ipados | 2026-09-14 | 2026-09-18 |
| CVE-2026-84525 A logging issue was addressed with improved data redaction. |
medium | 5.5 | — | Apple / macos | 2026-09-14 | 2026-09-18 |
| CVE-2026-65403 This issue was addressed with improved checks. |
medium | 5.5 | — | Apple / ipados | 2026-09-14 | 2026-09-18 |
| CVE-2026-65399 A file quarantine bypass was addressed with additional checks. |
medium | 4.4 | — | Apple / ipados | 2026-09-14 | 2026-09-18 |
| CVE-2026-86869 An out-of-bounds write issue was addressed with improved bounds checking. |
medium | 6.5 | — | Apple / ipados | 2026-09-14 | 2026-09-18 |
| CVE-2026-84636 An authorization issue was addressed with improved state management. |
medium | 5.5 | — | Apple / ipados | 2026-09-14 | 2026-09-18 |
| CVE-2026-84567 The issue was addressed with improved memory handling. |
medium | 5.5 | — | Apple / macos | 2026-09-14 | 2026-09-18 |
| CVE-2026-84564 An uninitialized memory issue was addressed with improved memory initialization. |
medium | 4.3 | — | Apple / ipados | 2026-09-14 | 2026-09-18 |
| CVE-2026-84531 An out-of-bounds write issue was addressed with improved bounds checking. |
medium | 6.2 | — | Apple / ipados | 2026-09-14 | 2026-09-18 |
| CVE-2026-84527 A logging issue was addressed with improved data redaction. |
medium | 5.5 | — | Apple / ipados | 2026-09-14 | 2026-09-18 |
| CVE-2026-84514 This issue was addressed with additional entitlement checks. |
medium | 5.5 | — | Apple / macos | 2026-09-14 | 2026-09-18 |
| CVE-2026-84513 A privacy issue was addressed with improved private data redaction for log entri... |
medium | 5.5 | — | Apple / ipados | 2026-09-14 | 2026-09-18 |
| CVE-2026-84510 A heap buffer overflow was addressed with improved bounds checking. |
medium | 6.5 | — | Apple / ipados | 2026-09-14 | 2026-09-18 |
| CVE-2026-86870 A heap buffer overflow was addressed with improved bounds checking. |
medium | 6.5 | — | Apple / ipados | 2026-09-14 | 2026-09-18 |
| CVE-2026-84574 A permissions issue was addressed with improved state management. |
medium | 4.4 | — | Apple / macos | 2026-09-14 | 2026-09-18 |
| CVE-2026-86902 A parsing issue in the handling of directory paths was addressed with improved p... |
medium | 5.5 | — | Apple / macos | 2026-09-14 | 2026-09-18 |
| CVE-2026-86900 An out-of-bounds read issue was addressed with improved input validation. |
medium | 6.5 | — | Apple / macos | 2026-09-14 | 2026-09-18 |
| CVE-2026-86898 A logic issue was addressed with improved state management. |
medium | 5.4 | — | Apple / safari | 2026-09-14 | 2026-09-18 |
| CVE-2026-86886 A path traversal issue was addressed with improved input validation. |
medium | 5.5 | — | Apple / ipados | 2026-09-14 | 2026-09-18 |
| CVE-2026-84622 A memory initialization issue was addressed with improved memory handling. |
medium | 6.2 | — | Apple / ipados | 2026-09-14 | 2026-09-18 |
| CVE-2026-84616 A type confusion issue was addressed with improved memory handling. |
medium | 5.5 | — | Apple / ipados | 2026-09-14 | 2026-09-18 |
| CVE-2026-84571 A buffer overflow was addressed with improved bounds checking. |
medium | 4.3 | — | Apple / ipados | 2026-09-14 | 2026-09-18 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.