September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,290
Critical
1,223
High
4,344
Medium
4,103
Low
460
Severity not reported
1,160
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-83266 Vulnerability in the Oracle JDeveloper product of Oracle Fusion Middleware (comp... |
high | 8.2 | — | — | 2026-09-15 | 2026-09-21 |
| CVE-2026-83267 Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component:... |
high | 8.5 | — | — | 2026-09-15 | 2026-09-21 |
| CVE-2026-83270 Vulnerability in the Oracle Business Intelligence Enterprise Edition product of... |
high | 7.5 | — | — | 2026-09-15 | 2026-09-21 |
| CVE-2026-83309 Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component:... |
high | 8.5 | — | — | 2026-09-15 | 2026-09-21 |
| CVE-2026-83321 Vulnerability in the Oracle Business Intelligence Enterprise Edition product of... |
high | 8.5 | — | — | 2026-09-15 | 2026-09-21 |
| CVE-2026-69648 Use after free in Windows Notification allows an authorized attacker to elevate... |
high | 7.0 | — | Microsoft / windows 10 21h2 | 2026-09-08 | 2026-09-21 |
| CVE-2026-72962 Heap-based buffer overflow in Windows USB Video Driver allows an authorized atta... |
high | 8.2 | — | Microsoft / windows 10 1809 | 2026-09-08 | 2026-09-21 |
| CVE-2026-72953 Heap-based buffer overflow in Windows USB Driver allows an authorized attacker t... |
high | 7.8 | — | Microsoft / windows 10 21h2 | 2026-09-08 | 2026-09-21 |
| CVE-2026-72947 Integer underflow (wrap or wraparound) in Windows File History Service allows an... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-21 |
| CVE-2026-72952 Out-of-bounds read in Windows Spaceport.sys allows an authorized attacker to exe... |
high | 7.0 | — | Microsoft / windows 10 1809 | 2026-09-08 | 2026-09-21 |
| CVE-2026-72949 Null pointer dereference in Windows SMB Server Network Transport Driver (srvnet.... |
high | 7.5 | — | Microsoft / windows 11 23h2 | 2026-09-08 | 2026-09-21 |
| CVE-2026-72960 Heap-based buffer overflow in Windows Media Player allows an unauthorized attack... |
high | 8.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-21 |
| CVE-2026-69575 Use after free in Windows Storage Spaces Controller allows an authorized attacke... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-21 |
| CVE-2026-93973 A vulnerability was detected in SourceCodester Online Reviewer Management System... |
high | 7.3 | — | — | 2026-09-20 | 2026-09-21 |
| CVE-2026-93978 A vulnerability was identified in code-projects Internship Management System 1.0... |
high | 7.3 | — | — | 2026-09-20 | 2026-09-21 |
| CVE-2026-92729 SigNoz versions 0.88.0 through 0.141.0 fail to apply authorization wrappers to t... |
high | 8.2 | — | — | 2026-09-16 | 2026-09-21 |
| CVE-2026-88259 CareCam CM2507 IP cameras do not require authentication for access to its networ... |
high | 7.5 | — | — | 2026-09-18 | 2026-09-21 |
| CVE-2026-76856 Netcore NR255-V firmware version 1.5.130703 contains a cross-site request forger... |
high | 8.1 | — | — | 2026-09-15 | 2026-09-21 |
| CVE-2026-76861 Netcore NR255-V version 1.5.130703 contains a stack-based buffer overflow in nto... |
high | 8.8 | — | — | 2026-09-15 | 2026-09-21 |
| CVE-2026-75894 In osmo-iuh from 0.1.0 through 1.8.0 a reachable assertion was found in the rana... |
high | 7.5 | — | — | 2026-09-18 | 2026-09-21 |
| CVE-2026-75893 In osmo-bsc from 1.0.1 through 1.14.1 a heap based buffer overflow issue was fou... |
high | 7.5 | — | — | 2026-09-18 | 2026-09-21 |
| CVE-2026-47321 The CompressionFilter class uses ZLib to deflate and inflate data sent and recei... |
high | 7.5 | — | — | 2026-09-21 | 2026-09-21 |
| CVE-2026-69597 Use after free in Windows HTTP.sys allows an authorized attacker to elevate priv... |
high | 7.5 | — | Microsoft / windows 11 23h2 | 2026-09-08 | 2026-09-21 |
| CVE-2026-92467 zlt2000 microservices-platform through 6.0.0 contains an unverified password cha... |
high | 8.3 | — | — | 2026-09-16 | 2026-09-21 |
| CVE-2026-92954 vm2 is a sandbox library for running untrusted JavaScript in Node.js. |
high | 8.6 | — | — | 2026-09-17 | 2026-09-21 |
| CVE-2026-85150 A NULL pointer dereference flaw was found in GStreamer's RTSP support library. |
high | 7.5 | — | — | 2026-09-03 | 2026-09-21 |
| CVE-2026-83252 Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience... |
high | 7.0 | — | — | 2026-09-15 | 2026-09-21 |
| CVE-2026-83259 Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience... |
high | 7.1 | — | — | 2026-09-15 | 2026-09-21 |
| CVE-2026-83265 Vulnerability in the Oracle Web Services Manager product of Oracle Fusion Middle... |
high | 8.2 | — | — | 2026-09-15 | 2026-09-21 |
| CVE-2026-76866 Netcore NR255-V firmware version 1.5.130703 builds root-run command lines from u... |
high | 7.2 | — | — | 2026-09-15 | 2026-09-21 |
| CVE-2026-69625 Heap-based buffer overflow in Windows Connected User Experiences and Telemetry a... |
high | 8.8 | — | Microsoft / windows 10 1809 | 2026-09-08 | 2026-09-21 |
| CVE-2026-73958 Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (... |
high | 8.1 | — | Oracle / access manager | 2026-09-15 | 2026-09-21 |
| CVE-2026-73959 Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware... |
high | 8.8 | — | Oracle / webcenter portal | 2026-09-15 | 2026-09-21 |
| CVE-2026-83002 Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (... |
high | 8.5 | — | Oracle / access manager | 2026-09-15 | 2026-09-21 |
| CVE-2026-83045 Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware... |
high | 8.5 | — | Oracle / webcenter portal | 2026-09-15 | 2026-09-21 |
| CVE-2026-83046 Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware... |
high | 7.1 | — | Oracle / webcenter portal | 2026-09-15 | 2026-09-21 |
| CVE-2026-83047 Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware... |
high | 8.2 | — | Oracle / webcenter portal | 2026-09-15 | 2026-09-21 |
| CVE-2026-83048 Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware... |
high | 7.7 | — | Oracle / webcenter portal | 2026-09-15 | 2026-09-21 |
| CVE-2026-83049 Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware... |
high | 8.5 | — | Oracle / webcenter portal | 2026-09-15 | 2026-09-21 |
| CVE-2026-83050 Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware... |
high | 7.1 | — | Oracle / webcenter portal | 2026-09-15 | 2026-09-21 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.