September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,290
Critical
1,223
High
4,344
Medium
4,103
Low
460
Severity not reported
1,160
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-1758 Session fixation vulnerability in Secomea GateManager (webserver module) allows... |
high | 8.3 | — | — | 2026-09-15 | 2026-09-18 |
| CVE-2026-16140 OpenBMC's IPMI implementation, phosphor-net-ipmid, is vulnerable to a logic flaw... |
high | 8.8 | — | — | 2026-09-15 | 2026-09-18 |
| CVE-2026-16141 OpenBMC's IPMI implementation, phosphor-net-ipmid, contains a logic flaw in whic... |
high | 8.1 | — | — | 2026-09-15 | 2026-09-18 |
| CVE-2026-87886 Acronis Backup Incorrect Default Permissions Vulnerability |
high | 7.8 | Listed | Acronis / Backup | 2026-09-17 | 2026-09-18 |
| CVE-2026-80469 An attacker may achieve arbitrary code execution on a target system by uploading... |
high | 8.3 | — | — | 2026-09-11 | 2026-09-18 |
| CVE-2026-28197 An authenticated, low-privileged user with access to the NetBackup Flex
OS mana... |
high | 8.8 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-28198 An authenticated, low-privileged user with access to the NetBackup Flex
OS mana... |
high | 8.8 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-89054 A missing authorization vulnerability in OpenNMS Horizon allows configuration ch... |
high | 8.2 | — | — | 2026-09-10 | 2026-09-18 |
| CVE-2026-86865 Tanium addressed a SQL injection vulnerability in Asset. |
high | 7.2 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-87024 Tanium addressed a SQL injection vulnerability in Asset. |
high | 7.2 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-87105 Tanium addressed a SQL injection vulnerability in Threat Response. |
high | 8.8 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-65359 An out-of-bounds read was addressed with improved bounds checking. |
high | 7.1 | — | Apple / ipados | 2026-09-14 | 2026-09-18 |
| CVE-2026-84858 ScadaLTS 2.8.1-release-candidate build 0 is affected by an Authenticated Remote... |
high | 8.8 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-84860 ScadaLTS 2.8.1-release-candidate build 0 is affected by an Authorization Bypass... |
high | 8.8 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-92625 Control iD iDSecure versions prior to 4.8.3.0 are affected by an unauthenticated... |
high | 7.5 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-92626 Control iD iDSecure versions prior to 4.8.3.0 are affected by an unauthenticated... |
high | 7.5 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-81901 In Concrete CMS 9.2.0 through 9.5.2, the REST API page update endpoint (PUT /ccm... |
high | 8.7 | — | Concretecms / concrete cms | 2026-09-14 | 2026-09-18 |
| CVE-2026-92619 The Booking Calendar plugin for WordPress is vulnerable to Privilege Escalation... |
high | 7.2 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-87152 Vulnerability in the Oracle Installed Base product of Oracle E-Business Suite (c... |
high | 8.1 | — | — | 2026-09-15 | 2026-09-18 |
| CVE-2026-87125 Vulnerability in the Oracle Financials for Asia/Pacific product of Oracle E-Busi... |
high | 8.3 | — | — | 2026-09-15 | 2026-09-18 |
| CVE-2026-83477 Vulnerability in the Oracle Work in Process product of Oracle E-Business Suite (... |
high | 8.1 | — | — | 2026-09-15 | 2026-09-18 |
| CVE-2026-83446 Vulnerability in the Oracle Financials Common Modules product of Oracle E-Busine... |
high | 8.1 | — | — | 2026-09-15 | 2026-09-18 |
| CVE-2026-83418 Vulnerability in the Oracle Communications Cloud Native Core Security Edge Prote... |
high | 8.2 | — | — | 2026-09-15 | 2026-09-18 |
| CVE-2026-83310 Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component:... |
high | 8.7 | — | — | 2026-09-15 | 2026-09-18 |
| CVE-2026-83304 Vulnerability in the Oracle Business Intelligence Enterprise Edition product of... |
high | 8.9 | — | — | 2026-09-15 | 2026-09-18 |
| CVE-2026-83307 Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component:... |
high | 8.3 | — | — | 2026-09-15 | 2026-09-18 |
| CVE-2026-83285 Vulnerability in the Oracle Business Intelligence Enterprise Edition product of... |
high | 8.3 | — | — | 2026-09-15 | 2026-09-18 |
| CVE-2026-83297 Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component:... |
high | 8.1 | — | — | 2026-09-15 | 2026-09-18 |
| CVE-2026-83264 Vulnerability in the Oracle Product Lifecycle Analytics product of Oracle Supply... |
high | 8.4 | — | — | 2026-09-15 | 2026-09-18 |
| CVE-2026-83220 Vulnerability in the Siebel CRM Integration product of Oracle Siebel CRM (compon... |
high | 8.1 | — | — | 2026-09-15 | 2026-09-18 |
| CVE-2026-83218 Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (compone... |
high | 7.4 | — | — | 2026-09-15 | 2026-09-18 |
| CVE-2026-83219 Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (compone... |
high | 7.1 | — | — | 2026-09-15 | 2026-09-18 |
| CVE-2026-83174 Vulnerability in the Oracle CRM Technical Foundation product of Oracle E-Busines... |
high | 8.1 | — | — | 2026-09-15 | 2026-09-18 |
| CVE-2026-83177 Vulnerability in the Oracle One-to-One Fulfillment product of Oracle E-Business... |
high | 8.1 | — | — | 2026-09-15 | 2026-09-18 |
| CVE-2026-83146 Vulnerability in the Siebel CRM End User product of Oracle Siebel CRM (component... |
high | 7.7 | — | — | 2026-09-15 | 2026-09-18 |
| CVE-2026-83152 Vulnerability in the Oracle Project Intelligence product of Oracle E-Business Su... |
high | 8.1 | — | — | 2026-09-15 | 2026-09-18 |
| CVE-2026-83144 Vulnerability in the Siebel Apps - Customer Order Management product of Oracle S... |
high | 8.7 | — | — | 2026-09-15 | 2026-09-18 |
| CVE-2026-83145 Vulnerability in the Siebel Apps - Customer Order Management product of Oracle S... |
high | 8.7 | — | — | 2026-09-15 | 2026-09-18 |
| CVE-2026-83143 Vulnerability in the Siebel Apps - Life Sciences product of Oracle Siebel CRM (c... |
high | 8.1 | — | — | 2026-09-15 | 2026-09-18 |
| CVE-2026-89180 EFence developed by Thinking Software Technology has a SQL Injection vulnerabili... |
high | 7.5 | — | — | 2026-09-14 | 2026-09-18 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.