September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,326
Critical
1,227
High
4,361
Medium
4,108
Low
460
Severity not reported
1,170
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (964), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-84530 An information disclosure issue was addressed with improved memory management. |
low | 3.3 | — | Apple / ipados | 2026-09-14 | 2026-09-18 |
| CVE-2026-86893 A permissions issue was addressed with additional restrictions. |
low | 3.3 | — | Apple / ipados | 2026-09-14 | 2026-09-18 |
| CVE-2026-65371 This issue was addressed with improved redaction of sensitive information. |
low | 3.3 | — | Apple / ipados | 2026-09-14 | 2026-09-18 |
| CVE-2026-86891 An authorization issue was addressed with improved state management. |
low | 3.5 | — | Apple / macos | 2026-09-14 | 2026-09-18 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.