September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,327
Critical
1,227
High
4,362
Medium
4,108
Low
460
Severity not reported
1,170
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (964), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-84625 A permissions issue was addressed with additional sandbox restrictions. |
critical | 9.1 | — | Apple / ipados | 2026-09-14 | 2026-09-23 |
| CVE-2026-84609 A permissions issue was addressed with improved path validation. |
critical | 9.8 | — | Apple / ipados | 2026-09-14 | 2026-09-18 |
| CVE-2026-65381 A validation issue existed in the entitlement verification. |
critical | 10.0 | — | Apple / macos | 2026-09-14 | 2026-09-17 |
| CVE-2026-43790 The issue was addressed with improved memory handling. |
critical | 9.1 | — | Apple / macos | 2026-09-14 | 2026-09-17 |
| CVE-2026-84561 A double free issue was addressed with improved memory management. |
critical | 9.8 | — | Apple / ipados | 2026-09-14 | 2026-09-16 |
| CVE-2026-86881 A certificate validation issue was addressed with improved certificate validatio... |
critical | 9.1 | — | Apple / ipados | 2026-09-14 | 2026-09-16 |
| CVE-2026-84520 A buffer overflow was addressed with improved size validation. |
critical | 9.8 | — | Apple / macos | 2026-09-14 | 2026-09-16 |
| CVE-2026-65414 An out-of-bounds write issue was addressed with improved bounds checking. |
critical | 9.8 | — | Apple / ipados | 2026-09-14 | 2026-09-16 |
| CVE-2026-84549 An out-of-bounds read was addressed with improved bounds checking. |
high | 7.5 | — | Apple / macos | 2026-09-14 | 2026-09-27 |
| CVE-2026-84623 An authorization issue was addressed with improved state management. |
high | 7.5 | — | Apple / ipados | 2026-09-14 | 2026-09-23 |
| CVE-2026-84507 A race condition was addressed with improved state handling. |
high | 7.8 | — | Apple / ipados | 2026-09-14 | 2026-09-18 |
| CVE-2026-65359 An out-of-bounds read was addressed with improved bounds checking. |
high | 7.1 | — | Apple / ipados | 2026-09-14 | 2026-09-18 |
| CVE-2026-84566 The issue was addressed with improved memory handling. |
high | 7.8 | — | Apple / ipados | 2026-09-14 | 2026-09-18 |
| CVE-2026-86901 An out-of-bounds write issue was addressed with improved bounds checking. |
high | 7.1 | — | Apple / macos | 2026-09-14 | 2026-09-18 |
| CVE-2026-84572 An out-of-bounds read was addressed with improved bounds checking. |
high | 7.1 | — | Apple / macos | 2026-09-14 | 2026-09-18 |
| CVE-2026-65375 The issue was addressed with improved authentication. |
high | 7.5 | — | Apple / macos | 2026-09-14 | 2026-09-18 |
| CVE-2026-65357 The issue was addressed with improved memory handling. |
high | 7.8 | — | Apple / ipados | 2026-09-14 | 2026-09-18 |
| CVE-2026-65354 A permissions issue was addressed with additional restrictions. |
high | 8.2 | — | Apple / ipados | 2026-09-14 | 2026-09-18 |
| CVE-2026-43683 An out-of-bounds read was addressed with improved bounds checking. |
high | 7.1 | — | Apple / macos | 2026-09-14 | 2026-09-18 |
| CVE-2026-84620 An integer overflow was addressed with improved input validation. |
high | 7.3 | — | Apple / ipados | 2026-09-14 | 2026-09-18 |
| CVE-2026-84578 A logic issue was addressed with improved checks. |
high | 8.8 | — | Apple / macos | 2026-09-14 | 2026-09-18 |
| CVE-2026-43815 A buffer overflow was addressed with improved bounds checking. |
high | 8.8 | — | Apple / macos | 2026-09-14 | 2026-09-18 |
| CVE-2026-84565 An out-of-bounds read was addressed with improved bounds checking. |
high | 7.1 | — | Apple / macos | 2026-09-14 | 2026-09-17 |
| CVE-2026-84544 An integer overflow was addressed with improved input validation. |
high | 7.5 | — | Apple / macos | 2026-09-14 | 2026-09-17 |
| CVE-2026-65344 An out-of-bounds write issue was addressed with improved bounds checking. |
high | 7.8 | — | Apple / ipados | 2026-09-14 | 2026-09-17 |
| CVE-2026-43702 The issue was addressed with improved memory handling. |
high | 7.8 | — | Apple / ipados | 2026-09-14 | 2026-09-17 |
| CVE-2026-43688 A memory corruption issue was addressed with improved input validation. |
high | 7.8 | — | Apple / ipados | 2026-09-14 | 2026-09-17 |
| CVE-2026-28938 A privacy issue was addressed by moving sensitive data. |
high | 7.5 | — | Apple / ipados | 2026-09-14 | 2026-09-17 |
| CVE-2026-28935 The issue was addressed with improved memory handling. |
high | 7.5 | — | Apple / ipados | 2026-09-14 | 2026-09-17 |
| CVE-2026-84584 This issue was addressed with improved handling of symlinks. |
high | 8.4 | — | Apple / macos | 2026-09-14 | 2026-09-17 |
| CVE-2026-65342 A permissions issue was addressed with improved validation. |
high | 7.5 | — | Apple / macos | 2026-09-14 | 2026-09-17 |
| CVE-2026-43697 An out-of-bounds read was addressed with improved bounds checking. |
high | 7.1 | — | Apple / macos | 2026-09-14 | 2026-09-17 |
| CVE-2026-65378 An authorization issue was addressed with improved state management. |
high | 7.5 | — | Apple / macos | 2026-09-14 | 2026-09-17 |
| CVE-2026-84548 An integer overflow was addressed with improved input validation. |
high | 7.1 | — | Apple / macos | 2026-09-14 | 2026-09-17 |
| CVE-2026-43789 An access issue was addressed with additional sandbox restrictions. |
high | 7.5 | — | Apple / macos | 2026-09-14 | 2026-09-17 |
| CVE-2026-84606 A privacy issue was addressed with improved handling of identifiers. |
high | 7.5 | — | Apple / ipados | 2026-09-14 | 2026-09-17 |
| CVE-2026-84580 The issue was addressed with improved checks. |
high | 8.4 | — | Apple / macos | 2026-09-14 | 2026-09-17 |
| CVE-2026-20683 An authentication issue was addressed with improved state management. |
high | 7.1 | — | Apple / ipados | 2026-09-14 | 2026-09-17 |
| CVE-2026-84512 A buffer overflow was addressed with improved bounds checking. |
high | 8.8 | — | Apple / macos | 2026-09-14 | 2026-09-17 |
| CVE-2026-65398 An out-of-bounds access issue was addressed with improved bounds checking. |
high | 7.8 | — | Apple / ipados | 2026-09-14 | 2026-09-17 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.