September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,290
Critical
1,223
High
4,344
Medium
4,103
Low
460
Severity not reported
1,160
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-87915 The Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimat... |
high | 7.2 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-85705 The Location Manager plugin for WordPress is vulnerable to generic SQL Injection... |
high | 7.5 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-20300 A vulnerability in Cisco ISE could allow an authenticated, remote attacker to co... |
high | 7.1 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-20343 A vulnerability in a critical API for Cisco Secure FMC Software could allow an u... |
high | 7.5 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-20154 A vulnerability in the system rate-limiting process for syslog message 419002 of... |
high | 8.6 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-20249 A vulnerability in the certification authentication feature of Internet Key Exch... |
high | 8.6 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-17086 The ShortPixel Image Optimizer – Optimize Images, Convert WebP & AVIF plugin for... |
high | 8.8 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-18912 ManageEngine DataSecurity Plus versions before 6310 are vulnerable to an authent... |
high | 7.7 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-14323 The Printcart Web to Print Product Designer for WooCommerce plugin for WordPress... |
high | 7.5 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-84572 An out-of-bounds read was addressed with improved bounds checking. |
high | 7.1 | — | Apple / macos | 2026-09-14 | 2026-09-18 |
| CVE-2026-71404 A flaw was found in Rancher Manager. |
high | 8.7 | — | Suse / rancher | 2026-09-03 | 2026-09-18 |
| CVE-2026-75033 A flaw was found in Rancher Manager. |
high | 7.7 | — | Suse / rancher | 2026-09-03 | 2026-09-18 |
| CVE-2026-65375 The issue was addressed with improved authentication. |
high | 7.5 | — | Apple / macos | 2026-09-14 | 2026-09-18 |
| CVE-2026-69587 Null pointer dereference in Windows IKE Extension allows an unauthorized attacke... |
high | 7.5 | — | Microsoft / windows 11 23h2 | 2026-09-08 | 2026-09-18 |
| CVE-2026-65357 The issue was addressed with improved memory handling. |
high | 7.8 | — | Apple / ipados | 2026-09-14 | 2026-09-18 |
| CVE-2026-65354 A permissions issue was addressed with additional restrictions. |
high | 8.2 | — | Apple / ipados | 2026-09-14 | 2026-09-18 |
| CVE-2026-43683 An out-of-bounds read was addressed with improved bounds checking. |
high | 7.1 | — | Apple / macos | 2026-09-14 | 2026-09-18 |
| CVE-2026-75034 A flaw was found in Rancher Manager. |
high | 7.4 | — | Suse / rancher | 2026-09-03 | 2026-09-18 |
| CVE-2026-74761 Improper input validation in TopicRegion in Apache ActiveMQ, Apache ActiveMQ Bro... |
high | 7.5 | — | Apache / activemq | 2026-09-09 | 2026-09-18 |
| CVE-2026-79993 The `deleteContainer` opcode (0x14/20) is processed without verifying the caller... |
high | 7.5 | — | Apache / zookeeper | 2026-09-16 | 2026-09-18 |
| CVE-2026-59739 Information disclosure via SetWatches reconnect replay in Apache ZooKeeper due t... |
high | 7.5 | — | Apache / zookeeper | 2026-09-16 | 2026-09-18 |
| CVE-2026-69588 Missing release of memory after effective lifetime in Windows TCP/IP allows an u... |
high | 7.5 | — | Microsoft / windows 11 23h2 | 2026-09-08 | 2026-09-18 |
| CVE-2026-59969 Apache ZooKeeper quorum TLS fails to enforce peer hostname verification in FIPS-... |
high | 7.5 | — | Apache / zookeeper | 2026-09-16 | 2026-09-18 |
| CVE-2026-86792 Apache Airflow Apache Kafka provider versions 1.15.0 before 2.0.0 resolve dotted... |
high | 8.8 | — | Apache / apache-airflow-providers-apache-kafka | 2026-09-16 | 2026-09-18 |
| CVE-2026-86466 Apache Airflow FAB provider: the Authentik OAuth path in the FAB auth manager do... |
high | 8.1 | — | Apache / apache-airflow-providers-fab | 2026-09-16 | 2026-09-18 |
| CVE-2026-82310 Apache Airflow FAB provider: deactivating a user account does not stop tokens is... |
high | 7.2 | — | Apache / apache-airflow-providers-fab | 2026-09-16 | 2026-09-18 |
| CVE-2026-76190 ColdFusion is affected by an Improper Neutralization of Directives in Dynamicall... |
high | 8.6 | — | Adobe / coldfusion | 2026-09-08 | 2026-09-18 |
| CVE-2026-75993 ColdFusion is affected by a reflected Cross-Site Scripting (XSS) vulnerability. |
high | 8.5 | — | Adobe / coldfusion | 2026-09-08 | 2026-09-18 |
| CVE-2026-75998 ColdFusion is affected by an Improper Access Control vulnerability that could le... |
high | 7.5 | — | Adobe / coldfusion | 2026-09-08 | 2026-09-18 |
| CVE-2026-75990 Illustrator is affected by an Incorrect Authorization vulnerability that could r... |
high | 8.6 | — | Adobe / illustrator | 2026-09-08 | 2026-09-18 |
| CVE-2026-75991 Illustrator is affected by an Improper Input Validation vulnerability that could... |
high | 8.6 | — | Adobe / illustrator | 2026-09-08 | 2026-09-18 |
| CVE-2026-93604 vm2 through 3.12.0 exposes Node.js's crypto.setFips() function to untrusted gues... |
high | 7.2 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-91732 Missing authorization in AppManifest in Google Chrome prior to 153.0.8010.47 all... |
high | 8.1 | — | Google / chrome | 2026-09-15 | 2026-09-18 |
| CVE-2026-91719 Code injection in XML in Google Chrome prior to 153.0.8010.47 allowed a remote a... |
high | 8.1 | — | Google / chrome | 2026-09-15 | 2026-09-18 |
| CVE-2026-76409 As part of Cisco's ongoing commitment to proactive security and product quality,... |
high | 8.8 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-75992 Illustrator is affected by an out-of-bounds write vulnerability that could resul... |
high | 7.8 | — | Adobe / illustrator | 2026-09-08 | 2026-09-18 |
| CVE-2026-54510 Speakr is a personal, self-hosted web application designed for transcribing audi... |
high | 7.1 | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-20344 A vulnerability in the web-based management interface of Cisco Secure FMC Softwa... |
high | 8.8 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-75999 ColdFusion is affected by an Improper Input Validation vulnerability that could... |
high | 8.4 | — | Adobe / coldfusion | 2026-09-08 | 2026-09-18 |
| CVE-2026-92134 Jenkins Warnings Plugin 13.10258.va_17d49a_78c3b_ and earlier does not validate... |
high | 8.0 | — | — | 2026-09-16 | 2026-09-18 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.