September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,326
Critical
1,227
High
4,361
Medium
4,108
Low
460
Severity not reported
1,170
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (964), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-84585 A permissions issue was addressed with improved state management. |
medium | 5.5 | — | Apple / macos | 2026-09-14 | 2026-09-16 |
| CVE-2026-65411 A path handling issue was addressed with improved validation. |
medium | 5.5 | — | Apple / ipados | 2026-09-14 | 2026-09-16 |
| CVE-2026-65407 A use after free issue was addressed with improved memory management. |
medium | 5.5 | — | Apple / ipados | 2026-09-14 | 2026-09-16 |
| CVE-2026-65412 A null pointer dereference was addressed with improved input validation. |
medium | 6.5 | — | Apple / ipados | 2026-09-14 | 2026-09-16 |
| CVE-2026-65413 An integer overflow was addressed with improved input validation. |
medium | 5.5 | — | Apple / macos | 2026-09-14 | 2026-09-16 |
| CVE-2026-84541 An input validation issue was addressed with improved input validation. |
medium | 5.5 | — | Apple / macos | 2026-09-14 | 2026-09-16 |
| CVE-2026-84534 A path handling issue was addressed with improved validation. |
medium | 5.5 | — | Apple / ipados | 2026-09-14 | 2026-09-16 |
| CVE-2026-65401 A race condition was addressed with improved state handling. |
medium | 5.5 | — | Apple / macos | 2026-09-14 | 2026-09-16 |
| CVE-2026-84489 A buffer overflow was addressed with improved bounds checking. |
medium | 5.5 | — | Apple / ipados | 2026-09-14 | 2026-09-16 |
| CVE-2026-84491 A permissions issue was addressed with additional restrictions. |
medium | 5.5 | — | Apple / ipados | 2026-09-14 | 2026-09-16 |
| CVE-2026-84518 This issue was addressed through improved state management. |
medium | 4.3 | — | Apple / safari | 2026-09-14 | 2026-09-16 |
| CVE-2026-84519 An out-of-bounds write issue was addressed with improved bounds checking. |
medium | 6.5 | — | Apple / ipados | 2026-09-14 | 2026-09-16 |
| CVE-2026-84521 A use after free issue was addressed with improved memory management. |
medium | 5.5 | — | Apple / ipados | 2026-09-14 | 2026-09-16 |
| CVE-2026-84560 An authorization issue was addressed with improved state management. |
medium | 6.1 | — | Apple / ipados | 2026-09-14 | 2026-09-16 |
| CVE-2026-84596 An out-of-bounds read was addressed with improved bounds checking. |
medium | 6.5 | — | Apple / ipados | 2026-09-14 | 2026-09-16 |
| CVE-2026-84597 An out-of-bounds read issue was addressed with improved input validation. |
medium | 6.5 | — | Apple / ipados | 2026-09-14 | 2026-09-16 |
| CVE-2026-84617 An authorization issue was addressed with improved state management. |
medium | 5.5 | — | Apple / ipados | 2026-09-14 | 2026-09-16 |
| CVE-2026-86883 A privacy issue was addressed with improved handling of files. |
medium | 5.5 | — | Apple / ipados | 2026-09-14 | 2026-09-16 |
| CVE-2026-86885 An input validation issue was addressed with improved input validation. |
medium | 6.5 | — | Apple / ipados | 2026-09-14 | 2026-09-16 |
| CVE-2026-86889 A certificate validation issue was addressed with improved certificate validatio... |
medium | 4.8 | — | Apple / macos | 2026-09-14 | 2026-09-16 |
| CVE-2026-86905 This issue was addressed by removing the vulnerable code. |
medium | 5.5 | — | Apple / ipados | 2026-09-14 | 2026-09-16 |
| CVE-2026-86903 An out-of-bounds read was addressed with improved input validation. |
medium | 5.5 | — | Apple / ipados | 2026-09-14 | 2026-09-16 |
| CVE-2026-43664 This issue was addressed with improved data protection. |
medium | 5.5 | — | Apple / ipados | 2026-09-14 | 2026-09-15 |
| CVE-2026-65353 An authorization issue was addressed with improved state management. |
medium | 5.5 | — | Apple / ipados | 2026-09-14 | 2026-09-15 |
| CVE-2026-65365 An out-of-bounds read was addressed with improved bounds checking. |
medium | 6.5 | — | Apple / macos | 2026-09-14 | 2026-09-15 |
| CVE-2026-43788 An integer overflow was addressed with improved input validation. |
medium | 6.6 | — | Apple / macos | 2026-09-14 | 2026-09-15 |
| CVE-2026-64753 A permissions issue was addressed by removing the vulnerable code. |
medium | 6.5 | — | Apple / safari | 2026-09-14 | 2026-09-15 |
| CVE-2026-65352 An information disclosure issue was addressed with improved state management. |
medium | 4.3 | — | Apple / ipados | 2026-09-14 | 2026-09-15 |
| CVE-2026-65355 An information disclosure issue was addressed with improved state management. |
medium | 4.3 | — | Apple / ipados | 2026-09-14 | 2026-09-15 |
| CVE-2026-28933 A use-after-free issue was addressed with improved memory management. |
medium | 5.5 | — | Apple / macos | 2026-09-14 | 2026-09-15 |
| CVE-2026-28934 A buffer overflow was addressed with improved bounds checking. |
medium | 6.5 | — | Apple / macos | 2026-09-14 | 2026-09-15 |
| CVE-2026-43677 An out-of-bounds write issue was addressed by removing the vulnerable code. |
medium | 6.5 | — | Apple / macos | 2026-09-14 | 2026-09-15 |
| CVE-2026-43687 The issue was addressed with improved memory handling. |
medium | 6.5 | — | Apple / ipados | 2026-09-14 | 2026-09-15 |
| CVE-2026-43761 An out-of-bounds write issue was addressed with improved bounds checking. |
medium | 6.5 | — | Apple / macos | 2026-09-14 | 2026-09-15 |
| CVE-2026-84538 A denial-of-service issue was addressed with improved input validation. |
medium | 6.5 | — | Apple / macos | 2026-09-14 | 2026-09-15 |
| CVE-2026-86876 An out-of-bounds write issue was addressed with improved bounds checking. |
medium | 5.2 | — | Apple / ipados | 2026-09-14 | 2026-09-15 |
| CVE-2026-86879 A denial-of-service issue was addressed with improved input validation. |
medium | 6.5 | — | Apple / ipados | 2026-09-14 | 2026-09-15 |
| CVE-2026-86887 A privacy issue was addressed by removing sensitive data. |
low | 3.3 | — | Apple / ipados | 2026-09-14 | 2026-09-21 |
| CVE-2026-86888 A permissions issue was addressed with additional restrictions. |
low | 3.3 | — | Apple / ipados | 2026-09-14 | 2026-09-21 |
| CVE-2026-84626 An information disclosure issue was addressed with improved state management. |
low | 3.3 | — | Apple / ipados | 2026-09-14 | 2026-09-18 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.