September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,290
Critical
1,223
High
4,344
Medium
4,103
Low
460
Severity not reported
1,160
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-83090 Vulnerability in the Oracle Spares Management product of Oracle E-Business Suite... |
high | 8.8 | — | — | 2026-09-15 | 2026-09-17 |
| CVE-2026-83092 Vulnerability in the Oracle Field Service product of Oracle E-Business Suite (co... |
high | 7.1 | — | — | 2026-09-15 | 2026-09-17 |
| CVE-2026-83087 Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM... |
high | 8.2 | — | — | 2026-09-15 | 2026-09-17 |
| CVE-2026-83089 Vulnerability in the Oracle Alert product of Oracle E-Business Suite (component:... |
high | 8.1 | — | — | 2026-09-15 | 2026-09-17 |
| CVE-2026-83082 Vulnerability in the Oracle Marketing product of Oracle E-Business Suite (compon... |
high | 7.2 | — | — | 2026-09-15 | 2026-09-17 |
| CVE-2026-83086 Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM... |
high | 8.8 | — | — | 2026-09-15 | 2026-09-17 |
| CVE-2026-83081 Vulnerability in the Oracle Banking Corporate Lending product of Oracle Financia... |
high | 8.0 | — | — | 2026-09-15 | 2026-09-17 |
| CVE-2026-83079 Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM... |
high | 7.9 | — | — | 2026-09-15 | 2026-09-17 |
| CVE-2026-83080 Vulnerability in the Oracle Banking Branch product of Oracle Financial Services... |
high | 7.1 | — | — | 2026-09-15 | 2026-09-17 |
| CVE-2026-83072 Vulnerability in the Oracle Applications Framework product of Oracle E-Business... |
high | 8.1 | — | — | 2026-09-15 | 2026-09-17 |
| CVE-2026-83073 Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM... |
high | 8.1 | — | — | 2026-09-15 | 2026-09-17 |
| CVE-2026-83071 Vulnerability in the Oracle Business Intelligence Enterprise Edition product of... |
high | 7.8 | — | — | 2026-09-15 | 2026-09-17 |
| CVE-2026-83065 Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware... |
high | 7.5 | — | — | 2026-09-15 | 2026-09-17 |
| CVE-2026-83069 Vulnerability in the Oracle Fusion Middleware Control product of Oracle Fusion M... |
high | 8.8 | — | — | 2026-09-15 | 2026-09-17 |
| CVE-2026-83063 Vulnerability in the Oracle Internet Directory product of Oracle Fusion Middlewa... |
high | 7.2 | — | — | 2026-09-15 | 2026-09-17 |
| CVE-2026-83053 Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware... |
high | 8.8 | — | — | 2026-09-15 | 2026-09-17 |
| CVE-2026-43789 An access issue was addressed with additional sandbox restrictions. |
high | 7.5 | — | Apple / macos | 2026-09-14 | 2026-09-17 |
| CVE-2026-91733 Improper state validation in Skia in Google Chrome prior to 153.0.8010.47 allowe... |
high | 8.3 | — | Google / chrome | 2026-09-15 | 2026-09-17 |
| CVE-2026-91734 Incorrect authorization in Core in Google Chrome on on Windows prior to 153.0.80... |
high | 7.4 | — | Google / chrome | 2026-09-15 | 2026-09-17 |
| CVE-2026-91735 Incorrect authorization in WebUI in Google Chrome prior to 153.0.8010.47 allowed... |
high | 8.3 | — | Google / chrome | 2026-09-15 | 2026-09-17 |
| CVE-2026-91736 Use after free in DOM in Google Chrome prior to 153.0.8010.47 allowed a remote a... |
high | 8.8 | — | Google / chrome | 2026-09-15 | 2026-09-17 |
| CVE-2026-91737 Use after free in PDF in Google Chrome prior to 153.0.8010.47 allowed a remote a... |
high | 8.8 | — | Google / chrome | 2026-09-15 | 2026-09-17 |
| CVE-2026-84606 A privacy issue was addressed with improved handling of identifiers. |
high | 7.5 | — | Apple / ipados | 2026-09-14 | 2026-09-17 |
| CVE-2026-92950 vm2 before 3.11.7 contains a sandbox escape vulnerability in the CLI tool that a... |
high | 8.6 | — | — | 2026-09-17 | 2026-09-17 |
| CVE-2026-92772 Leantime before 3.9.6 contains an authorization bypass vulnerability in the HTMX... |
high | 7.1 | — | — | 2026-09-16 | 2026-09-17 |
| CVE-2026-84580 The issue was addressed with improved checks. |
high | 8.4 | — | Apple / macos | 2026-09-14 | 2026-09-17 |
| CVE-2026-14805 The Consulting theme for WordPress is vulnerable to Privilege Escalation in vers... |
high | 8.8 | — | — | 2026-09-15 | 2026-09-17 |
| CVE-2026-12728 IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 throu... |
high | 8.8 | — | — | 2026-09-15 | 2026-09-17 |
| CVE-2023-54397 Tornado before 6.3.3 contains an HTTP request smuggling vulnerability due to imp... |
high | 7.5 | — | — | 2026-09-15 | 2026-09-17 |
| CVE-2026-20683 An authentication issue was addressed with improved state management. |
high | 7.1 | — | Apple / ipados | 2026-09-14 | 2026-09-17 |
| CVE-2026-92576 HKUDS nanobot before 0.3.0 contains a server-side request forgery vulnerability... |
high | 8.6 | — | — | 2026-09-16 | 2026-09-17 |
| CVE-2026-87162 Vulnerability in the Oracle Contract Lifecycle Management for Public Sector prod... |
high | 8.8 | — | — | 2026-09-15 | 2026-09-17 |
| CVE-2026-87164 Vulnerability in the Oracle Banking Branch product of Oracle Financial Services... |
high | 8.0 | — | — | 2026-09-15 | 2026-09-17 |
| CVE-2026-87165 Vulnerability in the Oracle Contract Lifecycle Management for Public Sector prod... |
high | 8.8 | — | — | 2026-09-15 | 2026-09-17 |
| CVE-2026-83483 Vulnerability in the Oracle Advanced Benefits product of Oracle E-Business Suite... |
high | 8.0 | — | — | 2026-09-15 | 2026-09-17 |
| CVE-2026-83489 Vulnerability in the Oracle Banking Origination product of Oracle Financial Serv... |
high | 7.5 | — | — | 2026-09-15 | 2026-09-17 |
| CVE-2026-83423 Vulnerability in the Oracle JDeveloper product of Oracle Fusion Middleware (comp... |
high | 8.8 | — | — | 2026-09-15 | 2026-09-17 |
| CVE-2026-83445 Vulnerability in the Oracle Complex Maintenance, Repair and Overhaul product of... |
high | 8.8 | — | — | 2026-09-15 | 2026-09-17 |
| CVE-2026-83336 Vulnerability in the Oracle Business Intelligence Enterprise Edition product of... |
high | 7.8 | — | — | 2026-09-15 | 2026-09-17 |
| CVE-2026-83337 Vulnerability in the Oracle Middleware Common Libraries and Tools product of Ora... |
high | 7.8 | — | — | 2026-09-15 | 2026-09-17 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.