September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,290
Critical
1,223
High
4,344
Medium
4,103
Low
460
Severity not reported
1,160
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-83051 Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware... |
high | 7.5 | — | Oracle / webcenter portal | 2026-09-15 | 2026-09-21 |
| CVE-2026-83410 Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (compo... |
high | 8.8 | — | Oracle / coherence | 2026-09-15 | 2026-09-21 |
| CVE-2026-83415 Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (compo... |
high | 7.5 | — | Oracle / coherence | 2026-09-15 | 2026-09-21 |
| CVE-2026-83422 Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware... |
high | 8.1 | — | Oracle / identity manager | 2026-09-15 | 2026-09-21 |
| CVE-2026-73926 Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (... |
high | 8.7 | — | Oracle / access manager | 2026-09-15 | 2026-09-21 |
| CVE-2026-73941 Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (... |
high | 8.6 | — | Oracle / access manager | 2026-09-15 | 2026-09-21 |
| CVE-2026-86358 Dell Update Package Framework, versions prior to 26.07.03, contains a Stack-base... |
high | 8.8 | — | Dell / update package framework | 2026-09-16 | 2026-09-21 |
| CVE-2026-85387 Concrete CMS before 9.5.4 re-authorized OAuth REST API requests from the bearer... |
high | 7.1 | — | Concretecms / concrete cms | 2026-09-16 | 2026-09-21 |
| CVE-2026-18424 Concrete CMS 9.0.0 to 9.5.2 is vulnerable to Server-Side Request Forgery iremote... |
high | 7.1 | — | Concretecms / concrete cms | 2026-09-15 | 2026-09-21 |
| CVE-2026-18423 Concrete CMS 9.0.0 through 9.5.2 is vulnerable to Insecure direct object referen... |
high | 7.1 | — | Concretecms / concrete cms | 2026-09-15 | 2026-09-21 |
| CVE-2026-92122 Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier does not check... |
high | 8.8 | — | Jenkins / script security | 2026-09-16 | 2026-09-21 |
| CVE-2026-92123 Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier does not interc... |
high | 8.8 | — | Jenkins / script security | 2026-09-16 | 2026-09-21 |
| CVE-2026-71179 Dell Update Package Framework, versions prior to 26.07.03, contains an Improper... |
high | 7.8 | — | Dell / update package framework | 2026-09-16 | 2026-09-21 |
| CVE-2026-71180 Dell Update Package Framework, versions prior to 26.07.03, contains an Unchecked... |
high | 7.8 | — | Dell / update package framework | 2026-09-16 | 2026-09-21 |
| CVE-2026-92124 Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier checks the oper... |
high | 8.8 | — | Jenkins / script security | 2026-09-16 | 2026-09-21 |
| CVE-2026-92125 Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier does not reject... |
high | 8.8 | — | Jenkins / script security | 2026-09-16 | 2026-09-21 |
| CVE-2026-86864 pgAdmin 4's Backup tool appended the client-supplied 'database' field from the /... |
high | 8.8 | — | Pgadmin / pgadmin 4 | 2026-09-17 | 2026-09-21 |
| CVE-2026-0159 In Cellular Modem, there is a possible out-of-bounds write due to a missing boun... |
high | 8.8 | — | Google / android | 2026-09-15 | 2026-09-21 |
| CVE-2026-0170 In Vp9DecodeFrameTag of vp9hwd_headers.cc, there is a possible out-of-bounds wri... |
high | 8.8 | — | Google / android | 2026-09-15 | 2026-09-21 |
| CVE-2026-0171 In multiple locations, there is a possible out-of-bounds write due to a logic er... |
high | 8.8 | — | Google / android | 2026-09-15 | 2026-09-21 |
| CVE-2026-0189 In ac_init_policy of init.c, there is a possible permission bypass due to a logi... |
high | 8.4 | — | Google / android | 2026-09-15 | 2026-09-21 |
| CVE-2026-0194 In multiple locations, there is a possible permission bypass due to an integer o... |
high | 8.4 | — | Google / android | 2026-09-15 | 2026-09-21 |
| CVE-2026-0199 In gf_ta_test_set_config of gf_ta_test.c, there is a possible out-of-bounds writ... |
high | 7.8 | — | Google / android | 2026-09-15 | 2026-09-21 |
| CVE-2026-0200 In Cellular Modem, there is a possible out-of-bounds write due to a heap buffer... |
high | 8.8 | — | Google / android | 2026-09-15 | 2026-09-21 |
| CVE-2026-55301 In Wave6VpuDecFlush of wave6.c, there is a possible out-of-bounds write due to a... |
high | 8.4 | — | Google / android | 2026-09-15 | 2026-09-21 |
| CVE-2026-55306 In Cellular Modem, there is a possible denial of service due to improper input v... |
high | 7.5 | — | Google / android | 2026-09-15 | 2026-09-21 |
| CVE-2026-55318 In multiple locations, there is a possible use-after-free due to a race conditio... |
high | 8.8 | — | Google / android | 2026-09-15 | 2026-09-21 |
| CVE-2026-55323 In gf_base_update_finger_base of gf_base.c, there is a possible out-of-bounds wr... |
high | 7.8 | — | Google / android | 2026-09-15 | 2026-09-21 |
| CVE-2026-55331 In IP Multimedia Subsystem, there is a possible out-of-bounds write due to an in... |
high | 8.8 | — | Google / android | 2026-09-15 | 2026-09-21 |
| CVE-2026-55343 In decodeAmr of ImsMediaAudioPlayer.cpp, there is a possible out-of-bounds write... |
high | 8.0 | — | Google / android | 2026-09-15 | 2026-09-21 |
| CVE-2026-55351 In VPU, there is a possible out-of-bounds write due to an integer overflow. |
high | 7.8 | — | Google / android | 2026-09-15 | 2026-09-21 |
| CVE-2026-55359 In multiple locations, there is a possible permission bypass due to a logic erro... |
high | 7.8 | — | Google / android | 2026-09-15 | 2026-09-21 |
| CVE-2026-56881 In enable_segment of remap.c, there is a possible permission bypass due to a log... |
high | 8.4 | — | Google / android | 2026-09-15 | 2026-09-21 |
| CVE-2026-56882 In Cellular Modem, there is a possible information disclosure due to a logic err... |
high | 8.8 | — | Google / android | 2026-09-15 | 2026-09-21 |
| CVE-2026-94004 A vulnerability was found in DedeCMS up to 5.7.118. |
high | 7.3 | — | — | 2026-09-20 | 2026-09-21 |
| CVE-2026-94036 A security flaw has been discovered in D-Link DIR-X1860 and DIR-X1860Z up to 1.0... |
high | 8.8 | — | — | 2026-09-20 | 2026-09-21 |
| CVE-2026-90504 A vulnerability has been found in vvbbnn00 WARP-Clash-API up to c7bf236007395986... |
high | 7.3 | — | — | 2026-09-13 | 2026-09-21 |
| CVE-2026-83234 Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience... |
high | 8.2 | — | — | 2026-09-15 | 2026-09-21 |
| CVE-2026-83235 Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience... |
high | 7.5 | — | — | 2026-09-15 | 2026-09-21 |
| CVE-2026-83236 Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience... |
high | 8.2 | — | — | 2026-09-15 | 2026-09-21 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.