September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,290
Critical
1,223
High
4,344
Medium
4,103
Low
460
Severity not reported
1,160
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-72946 Heap-based buffer overflow in Storage Port Driver allows an authorized attacker... |
high | 7.8 | — | Microsoft / windows 11 24h2 | 2026-09-08 | 2026-09-22 |
| CVE-2026-78463 Improper control of generation of code ('code injection') in Remote Desktop Clie... |
high | 8.8 | — | Microsoft / remote desktop client | 2026-09-08 | 2026-09-22 |
| CVE-2026-80074 Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attac... |
high | 8.8 | — | Microsoft / remote desktop client | 2026-09-08 | 2026-09-22 |
| CVE-2026-80077 Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attac... |
high | 8.8 | — | Microsoft / remote desktop client | 2026-09-08 | 2026-09-22 |
| CVE-2026-72936 Use after free in Windows SMB Client allows an unauthorized attacker to execute... |
high | 8.1 | — | Microsoft / windows 11 23h2 | 2026-09-08 | 2026-09-22 |
| CVE-2026-72940 Heap-based buffer overflow in Windows Schannel allows an unauthorized attacker t... |
high | 8.8 | — | Microsoft / windows 11 23h2 | 2026-09-08 | 2026-09-22 |
| CVE-2026-86482 In JetBrains YouTrack before 2026.2.18634, insufficient validation of role assig... |
high | 8.8 | — | — | 2026-09-07 | 2026-09-22 |
| CVE-2026-87288 Vulnerability in the Oracle GraalVM product of Oracle Java SE (component: Compil... |
high | 8.1 | — | — | 2026-09-15 | 2026-09-22 |
| CVE-2026-87286 Vulnerability in the Oracle GraalVM product of Oracle Java SE (component: Compil... |
high | 8.1 | — | — | 2026-09-15 | 2026-09-22 |
| CVE-2026-87287 Vulnerability in the Oracle GraalVM product of Oracle Java SE (component: Compil... |
high | 8.1 | — | — | 2026-09-15 | 2026-09-22 |
| CVE-2026-83357 Vulnerability in the Oracle GraalVM for JDK, Oracle GraalVM product of Oracle Ja... |
high | 8.1 | — | — | 2026-09-15 | 2026-09-22 |
| CVE-2026-83408 Vulnerability in the Oracle GraalVM for JDK, Oracle GraalVM product of Oracle Ja... |
high | 8.1 | — | — | 2026-09-15 | 2026-09-22 |
| CVE-2026-94143 A vulnerability was detected in drogonframework drogon up to 1.9.13. |
high | 7.3 | — | — | 2026-09-21 | 2026-09-21 |
| CVE-2026-93980 A weakness has been identified in code-projects Internship Management System 1.0... |
high | 7.3 | — | — | 2026-09-20 | 2026-09-21 |
| CVE-2026-92961 vm2 before 3.11.6 fails to enforce bufferAllocLimit on ArrayBuffer, SharedArrayB... |
high | 7.5 | — | — | 2026-09-17 | 2026-09-21 |
| CVE-2026-92959 vm2 before 3.11.8 does not fully enforce the allowAsync: false option in VM and... |
high | 7.1 | — | — | 2026-09-17 | 2026-09-21 |
| CVE-2026-84446 libheif is a HEIF and AVIF file format decoder and encoder. |
high | 7.5 | — | — | 2026-09-18 | 2026-09-21 |
| CVE-2026-63459 Vendure is an open-source headless commerce platform. |
high | 8.7 | — | — | 2026-09-17 | 2026-09-21 |
| CVE-2026-94128 A security vulnerability has been detected in BioStar VIVID LED DJ 4.0.2411.1500... |
high | 8.8 | — | — | 2026-09-21 | 2026-09-21 |
| CVE-2026-94142 A security vulnerability has been detected in BioStar Temperature Monitor Utilit... |
high | 8.8 | — | — | 2026-09-21 | 2026-09-21 |
| CVE-2026-87205 Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hype... |
high | 7.5 | — | Oracle / hyperion financial management | 2026-09-15 | 2026-09-21 |
| CVE-2026-94038 A security vulnerability has been detected in NonceGeek dim-sum-app. |
high | 7.3 | — | — | 2026-09-20 | 2026-09-21 |
| CVE-2026-90860 The Canva Mobile App for HarmonyOS before v1.15.1 did not restrict the headers r... |
high | 7.1 | — | — | 2026-09-21 | 2026-09-21 |
| CVE-2026-87149 Vulnerability in the Oracle Contract Lifecycle Management for Public Sector prod... |
high | 7.1 | — | — | 2026-09-15 | 2026-09-21 |
| CVE-2026-87160 Vulnerability in the Oracle HRMS (India) product of Oracle E-Business Suite (com... |
high | 7.1 | — | — | 2026-09-15 | 2026-09-21 |
| CVE-2026-87161 Vulnerability in the Oracle HRMS (India) product of Oracle E-Business Suite (com... |
high | 8.5 | — | — | 2026-09-15 | 2026-09-21 |
| CVE-2026-87196 Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hype... |
high | 8.2 | — | Oracle / hyperion financial management | 2026-09-15 | 2026-09-21 |
| CVE-2026-87197 Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hype... |
high | 8.2 | — | Oracle / hyperion financial management | 2026-09-15 | 2026-09-21 |
| CVE-2026-87200 Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hype... |
high | 8.2 | — | Oracle / hyperion financial management | 2026-09-15 | 2026-09-21 |
| CVE-2026-87126 Vulnerability in the Oracle Report Manager product of Oracle E-Business Suite (c... |
high | 7.1 | — | — | 2026-09-15 | 2026-09-21 |
| CVE-2026-83484 Vulnerability in the Oracle US Federal Human Resources product of Oracle E-Busin... |
high | 7.1 | — | — | 2026-09-15 | 2026-09-21 |
| CVE-2026-84285 An OS Command Injection vulnerability affecting Tuleap Enterprise Edition from 1... |
high | 8.8 | — | — | 2026-09-21 | 2026-09-21 |
| CVE-2026-83436 Vulnerability in the Oracle Depot Repair product of Oracle E-Business Suite (com... |
high | 7.1 | — | — | 2026-09-15 | 2026-09-21 |
| CVE-2026-83324 Vulnerability in the Oracle Business Intelligence Enterprise Edition product of... |
high | 7.1 | — | — | 2026-09-15 | 2026-09-21 |
| CVE-2026-83326 Vulnerability in the Siebel CRM Integration product of Oracle Siebel CRM (compon... |
high | 7.5 | — | — | 2026-09-15 | 2026-09-21 |
| CVE-2026-83332 Vulnerability in the Oracle Applications Framework product of Oracle E-Business... |
high | 7.1 | — | — | 2026-09-15 | 2026-09-21 |
| CVE-2026-83334 Vulnerability in the Oracle Web Services Manager product of Oracle Fusion Middle... |
high | 7.4 | — | — | 2026-09-15 | 2026-09-21 |
| CVE-2026-83341 Vulnerability in the Oracle Applications Manager product of Oracle E-Business Su... |
high | 7.5 | — | — | 2026-09-15 | 2026-09-21 |
| CVE-2026-83343 Vulnerability in the Oracle Utilities Network Management System product of Oracl... |
high | 8.2 | — | — | 2026-09-15 | 2026-09-21 |
| CVE-2026-83345 Vulnerability in the Oracle XML Gateway product of Oracle E-Business Suite (comp... |
high | 7.1 | — | — | 2026-09-15 | 2026-09-21 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.