September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,290
Critical
1,223
High
4,344
Medium
4,103
Low
460
Severity not reported
1,160
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-86108 Insufficient validation of inputs supplied through affected VeloCloud Edge manag... |
high | 8.0 | — | — | 2026-09-16 | 2026-09-17 |
| CVE-2026-84584 This issue was addressed with improved handling of symlinks. |
high | 8.4 | — | Apple / macos | 2026-09-14 | 2026-09-17 |
| CVE-2026-69314 Use after free in Windows Device Association Broker service allows an authorized... |
high | 7.1 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-17 |
| CVE-2026-65342 A permissions issue was addressed with improved validation. |
high | 7.5 | — | Apple / macos | 2026-09-14 | 2026-09-17 |
| CVE-2026-43697 An out-of-bounds read was addressed with improved bounds checking. |
high | 7.1 | — | Apple / macos | 2026-09-14 | 2026-09-17 |
| CVE-2026-69333 Use after free in Windows Win32K allows an authorized attacker to elevate privil... |
high | 7.0 | — | Microsoft / windows 11 24h2 | 2026-09-08 | 2026-09-17 |
| CVE-2026-69348 Heap-based buffer overflow in Windows Win32K allows an authorized attacker to el... |
high | 7.8 | — | Microsoft / windows 11 24h2 | 2026-09-08 | 2026-09-17 |
| CVE-2026-91731 Type confusion in Compositing in Google Chrome prior to 153.0.8010.47 allowed a... |
high | 8.8 | — | Google / chrome | 2026-09-15 | 2026-09-17 |
| CVE-2026-91727 Incorrect reference resolution in Extensions in Google Chrome on on Mac prior to... |
high | 8.1 | — | Google / chrome | 2026-09-15 | 2026-09-17 |
| CVE-2026-91724 Use after free in Input in Google Chrome prior to 153.0.8010.47 allowed a remote... |
high | 8.3 | — | Google / chrome | 2026-09-15 | 2026-09-17 |
| CVE-2026-91722 Use after free in Input in Google Chrome prior to 153.0.8010.47 allowed a remote... |
high | 8.8 | — | Google / chrome | 2026-09-15 | 2026-09-17 |
| CVE-2026-76852 Netcore NR268 firmware version 1.7.121109 has an improper integrity verification... |
high | 8.8 | — | — | 2026-09-15 | 2026-09-17 |
| CVE-2026-76862 Netcore NR255-V version 1.5.130703 contains an os command argument injection vul... |
high | 8.8 | — | — | 2026-09-15 | 2026-09-17 |
| CVE-2026-69208 Http4s is a Scala interface for HTTP services. |
high | 7.5 | — | — | 2026-09-15 | 2026-09-17 |
| CVE-2026-69213 Http4s is a Scala interface for HTTP services. |
high | 7.5 | — | — | 2026-09-15 | 2026-09-17 |
| CVE-2026-69210 Http4s is a Scala interface for HTTP services. |
high | 7.5 | — | — | 2026-09-15 | 2026-09-17 |
| CVE-2026-69218 Http4s is a Scala interface for HTTP services. |
high | 7.5 | — | — | 2026-09-15 | 2026-09-17 |
| CVE-2026-65378 An authorization issue was addressed with improved state management. |
high | 7.5 | — | Apple / macos | 2026-09-14 | 2026-09-17 |
| CVE-2026-12150 IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 throu... |
high | 7.0 | — | — | 2026-09-15 | 2026-09-17 |
| CVE-2026-12666 IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 throu... |
high | 8.1 | — | — | 2026-09-15 | 2026-09-17 |
| CVE-2026-92985 SiYuan versions before 3.8.4 fail to escape bookmark labels imported from notebo... |
high | 8.8 | — | — | 2026-09-17 | 2026-09-17 |
| CVE-2026-91972 Vikunja versions before 2.6.0 fail to apply rate limiting to /api/v2 public auth... |
high | 7.5 | — | — | 2026-09-15 | 2026-09-17 |
| CVE-2026-87261 Vulnerability in the Oracle Agile Engineering Data Management product of Oracle... |
high | 7.3 | — | — | 2026-09-15 | 2026-09-17 |
| CVE-2026-87262 Vulnerability in the Oracle Agile Engineering Data Management product of Oracle... |
high | 7.1 | — | — | 2026-09-15 | 2026-09-17 |
| CVE-2026-87264 Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleS... |
high | 7.7 | — | — | 2026-09-15 | 2026-09-17 |
| CVE-2026-87259 Vulnerability in the Oracle Agile Engineering Data Management product of Oracle... |
high | 8.4 | — | — | 2026-09-15 | 2026-09-17 |
| CVE-2026-87260 Vulnerability in the Oracle Agile Engineering Data Management product of Oracle... |
high | 7.3 | — | — | 2026-09-15 | 2026-09-17 |
| CVE-2026-84548 An integer overflow was addressed with improved input validation. |
high | 7.1 | — | Apple / macos | 2026-09-14 | 2026-09-17 |
| CVE-2026-83233 Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience... |
high | 7.7 | — | — | 2026-09-15 | 2026-09-17 |
| CVE-2026-83223 Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (compone... |
high | 7.5 | — | — | 2026-09-15 | 2026-09-17 |
| CVE-2026-83224 Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (compone... |
high | 7.1 | — | — | 2026-09-15 | 2026-09-17 |
| CVE-2026-83226 Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (compone... |
high | 7.5 | — | — | 2026-09-15 | 2026-09-17 |
| CVE-2026-83227 Vulnerability in the Siebel CRM Integration product of Oracle Siebel CRM (compon... |
high | 7.5 | — | — | 2026-09-15 | 2026-09-17 |
| CVE-2026-83230 Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (compone... |
high | 7.1 | — | — | 2026-09-15 | 2026-09-17 |
| CVE-2026-83231 Vulnerability in the Helidon product of Oracle Fusion Middleware (component: hel... |
high | 7.0 | — | — | 2026-09-15 | 2026-09-17 |
| CVE-2026-83203 Vulnerability in the Siebel CRM End User product of Oracle Siebel CRM (component... |
high | 8.6 | — | — | 2026-09-15 | 2026-09-17 |
| CVE-2026-83204 Vulnerability in the Oracle Sourcing product of Oracle E-Business Suite (compone... |
high | 7.5 | — | — | 2026-09-15 | 2026-09-17 |
| CVE-2026-83205 Vulnerability in the Oracle Applications Framework product of Oracle E-Business... |
high | 8.8 | — | — | 2026-09-15 | 2026-09-17 |
| CVE-2026-83206 Vulnerability in the Oracle Banking Corporate Lending Process Management product... |
high | 7.1 | — | — | 2026-09-15 | 2026-09-17 |
| CVE-2026-83207 Vulnerability in the Siebel CRM Development product of Oracle Siebel CRM (compon... |
high | 7.6 | — | — | 2026-09-15 | 2026-09-17 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.