September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,826
Low
527
Severity not reported
2,544
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), apache (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-43684 A use-after-free issue was addressed with improved memory management. |
high | 7.8 | — | Apple / ipados | 2026-09-14 | 2026-09-16 |
| CVE-2026-43686 A use-after-free issue was addressed with improved memory management. |
high | 8.8 | — | Apple / ipados | 2026-09-14 | 2026-09-16 |
| CVE-2026-28935 The issue was addressed with improved memory handling. |
high | 7.5 | — | Apple / ipados | 2026-09-14 | 2026-09-17 |
| CVE-2026-28938 A privacy issue was addressed by moving sensitive data. |
high | 7.5 | — | Apple / ipados | 2026-09-14 | 2026-09-17 |
| CVE-2026-28960 A denial-of-service issue was addressed with improved validation. |
high | 7.5 | — | Apple / ipados | 2026-09-14 | 2026-09-15 |
| CVE-2026-20683 An authentication issue was addressed with improved state management. |
high | 7.1 | — | Apple / ipados | 2026-09-14 | 2026-09-17 |
| CVE-2026-86902 A parsing issue in the handling of directory paths was addressed with improved p... |
medium | 5.5 | — | Apple / macos | 2026-09-14 | 2026-09-18 |
| CVE-2026-86903 An out-of-bounds read was addressed with improved input validation. |
medium | 5.5 | — | Apple / ipados | 2026-09-14 | 2026-09-16 |
| CVE-2026-86905 This issue was addressed by removing the vulnerable code. |
medium | 5.5 | — | Apple / ipados | 2026-09-14 | 2026-09-16 |
| CVE-2026-86909 A logic issue was addressed with improved state management. |
medium | 4.4 | — | Apple / macos | 2026-09-14 | 2026-09-18 |
| CVE-2026-86910 A permissions issue was addressed with improved path validation. |
medium | 5.5 | — | Apple / macos | 2026-09-14 | 2026-09-18 |
| CVE-2026-86911 This issue was addressed with improved state management. |
medium | 5.5 | — | Apple / macos | 2026-09-14 | 2026-09-18 |
| CVE-2026-86924 A memory corruption issue was addressed with improved input validation. |
medium | 5.5 | — | Apple / ipados | 2026-09-14 | 2026-09-18 |
| CVE-2026-86892 This issue was addressed with additional entitlement checks. |
medium | 5.5 | — | Apple / ipados | 2026-09-14 | 2026-09-18 |
| CVE-2026-86897 This issue was addressed with additional entitlement checks. |
medium | 5.5 | — | Apple / safari | 2026-09-14 | 2026-09-18 |
| CVE-2026-86898 A logic issue was addressed with improved state management. |
medium | 5.4 | — | Apple / safari | 2026-09-14 | 2026-09-18 |
| CVE-2026-86900 An out-of-bounds read issue was addressed with improved input validation. |
medium | 6.5 | — | Apple / macos | 2026-09-14 | 2026-09-18 |
| CVE-2026-86882 An out-of-bounds write issue was addressed with improved bounds checking. |
medium | 6.5 | — | Apple / ipados | 2026-09-14 | 2026-09-16 |
| CVE-2026-86883 A privacy issue was addressed with improved handling of files. |
medium | 5.5 | — | Apple / ipados | 2026-09-14 | 2026-09-16 |
| CVE-2026-86884 A permissions issue was addressed with additional restrictions. |
medium | 5.5 | — | Apple / ipados | 2026-09-14 | 2026-09-18 |
| CVE-2026-86885 An input validation issue was addressed with improved input validation. |
medium | 6.5 | — | Apple / ipados | 2026-09-14 | 2026-09-16 |
| CVE-2026-86886 A path traversal issue was addressed with improved input validation. |
medium | 5.5 | — | Apple / ipados | 2026-09-14 | 2026-09-18 |
| CVE-2026-86889 A certificate validation issue was addressed with improved certificate validatio... |
medium | 4.8 | — | Apple / macos | 2026-09-14 | 2026-09-16 |
| CVE-2026-86890 A logic issue was addressed with improved checks. |
medium | 4.6 | — | Apple / ipados | 2026-09-14 | 2026-09-16 |
| CVE-2026-84635 A logic issue was addressed with improved state management. |
medium | 6.5 | — | Apple / safari | 2026-09-14 | 2026-09-18 |
| CVE-2026-84636 An authorization issue was addressed with improved state management. |
medium | 5.5 | — | Apple / ipados | 2026-09-14 | 2026-09-18 |
| CVE-2026-86869 An out-of-bounds write issue was addressed with improved bounds checking. |
medium | 6.5 | — | Apple / ipados | 2026-09-14 | 2026-09-18 |
| CVE-2026-86870 A heap buffer overflow was addressed with improved bounds checking. |
medium | 6.5 | — | Apple / ipados | 2026-09-14 | 2026-09-18 |
| CVE-2026-86876 An out-of-bounds write issue was addressed with improved bounds checking. |
medium | 5.2 | — | Apple / ipados | 2026-09-14 | 2026-09-15 |
| CVE-2026-86878 A permissions issue was addressed with additional restrictions. |
medium | 5.5 | — | Apple / ipados | 2026-09-14 | 2026-09-16 |
| CVE-2026-86879 A denial-of-service issue was addressed with improved input validation. |
medium | 6.5 | — | Apple / ipados | 2026-09-14 | 2026-09-15 |
| CVE-2026-84621 An authorization issue was addressed with improved access control. |
medium | 5.5 | — | Apple / ipados | 2026-09-14 | 2026-09-23 |
| CVE-2026-84622 A memory initialization issue was addressed with improved memory handling. |
medium | 6.2 | — | Apple / ipados | 2026-09-14 | 2026-09-18 |
| CVE-2026-84624 A permissions issue was addressed with improved path validation. |
medium | 5.5 | — | Apple / ipados | 2026-09-14 | 2026-09-23 |
| CVE-2026-84628 An authorization issue was addressed with improved state management. |
medium | 5.5 | — | Apple / ipados | 2026-09-14 | 2026-09-23 |
| CVE-2026-84630 A race condition was addressed with improved state handling. |
medium | 4.7 | — | Apple / ipados | 2026-09-14 | 2026-09-16 |
| CVE-2026-84612 An authorization issue was addressed with improved access control. |
medium | 5.5 | — | Apple / ipados | 2026-09-14 | 2026-09-16 |
| CVE-2026-84615 An authorization issue was addressed with improved state management. |
medium | 5.5 | — | Apple / ipados | 2026-09-14 | 2026-09-18 |
| CVE-2026-84616 A type confusion issue was addressed with improved memory handling. |
medium | 5.5 | — | Apple / ipados | 2026-09-14 | 2026-09-18 |
| CVE-2026-84617 An authorization issue was addressed with improved state management. |
medium | 5.5 | — | Apple / ipados | 2026-09-14 | 2026-09-16 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.