September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,290
Critical
1,223
High
4,344
Medium
4,103
Low
460
Severity not reported
1,160
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-87819 GitPython before 3.1.60 contains a regular expression denial of service vulnerab... |
high | 7.5 | — | Gitpython Project / gitpython | 2026-09-09 | 2026-09-18 |
| CVE-2026-87794 bestzip versions 2.2.6 and 3.0.2 contain an argument injection vulnerability in... |
high | 8.4 | — | — | 2026-09-09 | 2026-09-18 |
| CVE-2026-86250 h3 versions before 2.0.1-rc.18 fail to validate the chunk count parsed from user... |
high | 7.5 | — | — | 2026-09-06 | 2026-09-18 |
| CVE-2026-84447 libheif is a HEIF and AVIF file format decoder and encoder. |
high | 7.5 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-83312 Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component:... |
high | 7.7 | — | — | 2026-09-15 | 2026-09-18 |
| CVE-2026-83313 Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component:... |
high | 7.7 | — | — | 2026-09-15 | 2026-09-18 |
| CVE-2026-83314 Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component:... |
high | 8.1 | — | — | 2026-09-15 | 2026-09-18 |
| CVE-2026-84384 libheif is a HEIF and AVIF file format decoder and encoder. |
high | 7.5 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-75584 ION-DTN before 4.2.1-a.1 contains a denial of service vulnerability that allows... |
high | 7.5 | — | — | 2026-09-10 | 2026-09-18 |
| CVE-2026-74909 Keycloak provides a policy enforcer to protect applications by matching incoming... |
high | 8.1 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-56711 VLC media player versions 3.0.0 through 3.0.23 contain a memory-safety vulnerabi... |
high | 7.0 | — | — | 2026-09-09 | 2026-09-18 |
| CVE-2026-27558 A low-privileged remote attacker can exploit a command injection vulnerability i... |
high | 8.8 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-27563 A high-privileged remote attacker can exploit a command injection vulnerability... |
high | 7.2 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-27548 A low-privileged remote attacker can exploit a command injection vulnerability i... |
high | 8.8 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-12645 A Missing Authorization vulnerability in Ivanti Neurons for ITSM before 2026.2 a... |
high | 8.8 | — | Ivanti / neurons for itsm | 2026-09-08 | 2026-09-18 |
| CVE-2026-12646 A Missing Authorization vulnerability in Ivanti Neurons for ITSM before 2026.2 a... |
high | 8.8 | — | Ivanti / neurons for itsm | 2026-09-08 | 2026-09-18 |
| CVE-2026-12647 A Missing Authorization vulnerability in Ivanti Neurons for ITSM before 2026.2 a... |
high | 8.8 | — | Ivanti / neurons for itsm | 2026-09-08 | 2026-09-18 |
| CVE-2026-12650 A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM bef... |
high | 8.8 | — | Ivanti / neurons for itsm | 2026-09-08 | 2026-09-18 |
| CVE-2026-12648 A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM bef... |
high | 8.8 | — | Ivanti / neurons for itsm | 2026-09-08 | 2026-09-18 |
| CVE-2026-12651 A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM bef... |
high | 8.8 | — | Ivanti / neurons for itsm | 2026-09-08 | 2026-09-18 |
| CVE-2026-81546 The Affinity by Canva application before 3.3.0 (September 2026 release) did not... |
high | 7.7 | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2023-5778 Improper handling of length parameter inconsistency vulnerability in ABB Freelan... |
high | 7.5 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-65388 A remote attacker who controls a container registry may be able to direct a clie... |
high | 7.5 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-92230 Apache Karaf's XmlUtils cached XML parser/transformer factories in static Thread... |
high | 7.5 | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-92943 Improper validation of certificate with host mismatch in the MQTT client TLS con... |
high | 8.1 | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-56997 In Av1DecodeFrameTag of vp9hwd_headers.cc, there is a possible out-of-bounds wri... |
high | 8.8 | — | Google / android | 2026-09-15 | 2026-09-18 |
| CVE-2026-57008 In Modem, there is a possible information disclosure due to improper input valid... |
high | 7.5 | — | Google / android | 2026-09-15 | 2026-09-18 |
| CVE-2026-84566 The issue was addressed with improved memory handling. |
high | 7.8 | — | Apple / ipados | 2026-09-14 | 2026-09-18 |
| CVE-2026-58678 In Bootloader, there is a possible permission bypass due to a logic error in the... |
high | 7.8 | — | Google / android | 2026-09-15 | 2026-09-18 |
| CVE-2026-58679 In gf_ta_test_set_config of gf_ta_test.c, there is a possible heap buffer overfl... |
high | 8.4 | — | Google / android | 2026-09-15 | 2026-09-18 |
| CVE-2026-57014 In phNxpNciHal_ext_process_nfc_init_rsp of phNxpNciHal_ext.cc, there is a possib... |
high | 7.8 | — | Google / android | 2026-09-15 | 2026-09-18 |
| CVE-2026-58683 In IP Multimedia Subsystem, there is a possible out-of-bounds write due to impro... |
high | 8.8 | — | Google / android | 2026-09-15 | 2026-09-18 |
| CVE-2026-58691 In FsmReleaseKey of fsm.c, there is a possible permission bypass due to improper... |
high | 8.4 | — | Google / android | 2026-09-15 | 2026-09-18 |
| CVE-2026-58695 In gmc_phy_lp3_exit_restore_registers of phy_power.c, there is a possible escala... |
high | 7.8 | — | Google / android | 2026-09-15 | 2026-09-18 |
| CVE-2026-83319 Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component:... |
high | 7.7 | — | — | 2026-09-15 | 2026-09-18 |
| CVE-2026-83320 Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component:... |
high | 7.6 | — | — | 2026-09-15 | 2026-09-18 |
| CVE-2026-86901 An out-of-bounds write issue was addressed with improved bounds checking. |
high | 7.1 | — | Apple / macos | 2026-09-14 | 2026-09-18 |
| CVE-2026-69574 Use after free in Windows Device Association Service allows an authorized attack... |
high | 7.0 | — | Microsoft / windows 10 1809 | 2026-09-08 | 2026-09-18 |
| CVE-2026-93594 ArcadeDB (Maven artifact com.arcadedb:arcadedb-engine) through 26.8.1 enforces i... |
high | 8.1 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-89413 The Filter Gallery plugin for WordPress is vulnerable to authorization bypass in... |
high | 8.1 | — | — | 2026-09-18 | 2026-09-18 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.