September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,291
Critical
1,223
High
4,345
Medium
4,103
Low
460
Severity not reported
1,160
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-69790 Heap-based buffer overflow in Windows Credential Providers allows an authorized... |
high | 7.8 | — | Microsoft / windows 10 1809 | 2026-09-08 | 2026-09-22 |
| CVE-2026-69791 Use after free in Windows Device Association Service allows an authorized attack... |
high | 7.0 | — | Microsoft / windows 10 1809 | 2026-09-08 | 2026-09-22 |
| CVE-2026-87141 Vulnerability in the Oracle Hyperion Data Relationship Management product of Ora... |
high | 7.7 | — | Oracle / hyperion data relationship management | 2026-09-15 | 2026-09-22 |
| CVE-2026-88623 NUUO Network Video Recorder 2.0.0 is vulnerable to arbitrary file read. |
high | 7.5 | — | — | 2026-09-18 | 2026-09-22 |
| CVE-2026-88738 Jazzware RT1000 Edge webUI v. |
high | 8.8 | — | — | 2026-09-21 | 2026-09-22 |
| CVE-2026-87137 Vulnerability in the Oracle Hyperion Data Relationship Management product of Ora... |
high | 7.6 | — | Oracle / hyperion data relationship management | 2026-09-15 | 2026-09-22 |
| CVE-2026-87136 Vulnerability in the Oracle Hyperion Data Relationship Management product of Ora... |
high | 7.5 | — | Oracle / hyperion data relationship management | 2026-09-15 | 2026-09-22 |
| CVE-2026-86553 SmartLife app dynamically generates fresh SmartLife application authentication p... |
high | 8.8 | — | — | 2026-09-20 | 2026-09-22 |
| CVE-2026-91827 The Ninja Forms WordPress plugin 3.15.3 does not prevent user-submitted form fie... |
high | 7.5 | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-92438 The Ninja Forms WordPress plugin 3.15.3 does not escape submitted form field val... |
high | 8.8 | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-87144 Vulnerability in the Oracle Hyperion Data Relationship Management product of Ora... |
high | 7.6 | — | Oracle / hyperion data relationship management | 2026-09-15 | 2026-09-22 |
| CVE-2026-17052 The Time-aware GPIO syscall verification handler z_vrfy_tgpio_pin_read_ts_ec() i... |
high | 7.8 | — | — | 2026-09-21 | 2026-09-22 |
| CVE-2026-87142 Vulnerability in the Oracle Hyperion Data Relationship Management product of Ora... |
high | 7.1 | — | Oracle / hyperion data relationship management | 2026-09-15 | 2026-09-22 |
| CVE-2026-87146 Vulnerability in the Oracle Hyperion Data Relationship Management product of Ora... |
high | 7.1 | — | Oracle / hyperion data relationship management | 2026-09-15 | 2026-09-22 |
| CVE-2026-87135 Vulnerability in the Oracle Hyperion Data Relationship Management product of Ora... |
high | 7.1 | — | Oracle / hyperion data relationship management | 2026-09-15 | 2026-09-22 |
| CVE-2026-87134 Vulnerability in the Oracle Hyperion Data Relationship Management product of Ora... |
high | 7.7 | — | Oracle / hyperion data relationship management | 2026-09-15 | 2026-09-22 |
| CVE-2026-87133 Vulnerability in the Oracle Hyperion Data Relationship Management product of Ora... |
high | 7.6 | — | Oracle / hyperion data relationship management | 2026-09-15 | 2026-09-22 |
| CVE-2026-88806 A malicious X server could exploit a buffer overflow in libX11 before 1.8.14 dur... |
high | 7.5 | — | — | 2026-09-21 | 2026-09-22 |
| CVE-2026-87132 Vulnerability in the Oracle Hyperion Data Relationship Management product of Ora... |
high | 7.6 | — | Oracle / hyperion data relationship management | 2026-09-15 | 2026-09-22 |
| CVE-2026-87131 Vulnerability in the Oracle Hyperion Data Relationship Management product of Ora... |
high | 7.6 | — | Oracle / hyperion data relationship management | 2026-09-15 | 2026-09-22 |
| CVE-2026-87145 Vulnerability in the Oracle Hyperion Data Relationship Management product of Ora... |
high | 7.3 | — | Oracle / hyperion data relationship management | 2026-09-15 | 2026-09-22 |
| CVE-2026-87147 Vulnerability in the Oracle Hyperion Data Relationship Management product of Ora... |
high | 7.7 | — | Oracle / hyperion data relationship management | 2026-09-15 | 2026-09-22 |
| CVE-2026-94368 A flaw was found in the signature verification logic of noobaa-core, the core co... |
high | 7.1 | — | — | 2026-09-21 | 2026-09-22 |
| CVE-2026-95508 A heap-based buffer overflow was found in the DHCPv6 and TFTP response builders... |
high | 7.4 | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-94455 An HTTP endpoint intended for provisioning enterprise and reseller organisations... |
high | 7.1 | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-87143 Vulnerability in the Oracle Hyperion Data Relationship Management product of Ora... |
high | 7.4 | — | Oracle / hyperion data relationship management | 2026-09-15 | 2026-09-22 |
| CVE-2026-25275 Transient DOS when processing authentication frames with invalid FILS informatio... |
high | 7.5 | — | Qualcomm / q-7790 firmware | 2026-09-17 | 2026-09-22 |
| CVE-2026-24075 Memory Corruption when multiple threads issue concurrent IOCTL requests to the d... |
high | 7.0 | — | Qualcomm / wsa8845h firmware | 2026-09-17 | 2026-09-22 |
| CVE-2026-24073 Memory corruption when processing decode statistics due to insufficient validati... |
high | 7.8 | — | Qualcomm / cologne firmware | 2026-09-17 | 2026-09-22 |
| CVE-2026-24074 Memory Corruption when processing data with large offset and length values excee... |
high | 7.8 | — | Qualcomm / iqx5121 firmware | 2026-09-17 | 2026-09-22 |
| CVE-2026-11716 IBM MQ for HPE NonStop 8.1.0 through 8.1.0.40 could allow an authenticated attac... |
high | 7.5 | — | — | 2026-09-18 | 2026-09-22 |
| CVE-2026-11725 IBM MQ could allow an authenticated attacker to cause a denial of service or pot... |
high | 8.8 | — | — | 2026-09-18 | 2026-09-22 |
| CVE-2026-11726 IBM MQ for HPE NonStop 8.1.0 through 8.1.0.40 could allow an authenticated attac... |
high | 8.1 | — | — | 2026-09-18 | 2026-09-22 |
| CVE-2026-11727 IBM MQ for HPE NonStop 8.1.0 through 8.1.0.40 IBM MQ C client could allow a remo... |
high | 8.1 | — | — | 2026-09-18 | 2026-09-22 |
| CVE-2026-17619 IBM Platform RTM is vulnerable to SQL injection. |
high | 8.6 | — | — | 2026-09-18 | 2026-09-22 |
| CVE-2026-75791 Zohocorp ManageEngine ADSelfService Plus versions before build 7001 are vulnerab... |
high | 8.6 | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-24081 Transient DOS when processing a channel map with insufficient used channels and... |
high | 7.4 | — | Qualcomm / ar8035 firmware | 2026-09-17 | 2026-09-22 |
| CVE-2026-25261 Memory corruption while processing rear sensor IOCTL calls. |
high | 7.8 | — | Qualcomm / cologne firmware | 2026-09-17 | 2026-09-22 |
| CVE-2026-25278 Memory Corruption when processing I2C transfer requests due to a race condition... |
high | 7.0 | — | Qualcomm / lemans au lgit firmware | 2026-09-17 | 2026-09-22 |
| CVE-2026-87148 Vulnerability in the Oracle Hyperion Data Relationship Management product of Ora... |
high | 7.5 | — | Oracle / hyperion data relationship management | 2026-09-15 | 2026-09-22 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.