September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,826
Low
527
Severity not reported
2,544
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), apache (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-65360 A race condition was addressed with improved state handling. |
medium | 4.7 | — | Apple / ipados | 2026-09-14 | 2026-09-18 |
| CVE-2026-65361 This issue was addressed with improved checks. |
medium | 5.5 | — | Apple / macos | 2026-09-14 | 2026-09-18 |
| CVE-2026-65365 An out-of-bounds read was addressed with improved bounds checking. |
medium | 6.5 | — | Apple / macos | 2026-09-14 | 2026-09-15 |
| CVE-2026-65369 A logic issue was addressed with improved state management. |
medium | 5.5 | — | Apple / macos | 2026-09-14 | 2026-09-17 |
| CVE-2026-65352 An information disclosure issue was addressed with improved state management. |
medium | 4.3 | — | Apple / ipados | 2026-09-14 | 2026-09-15 |
| CVE-2026-65353 An authorization issue was addressed with improved state management. |
medium | 5.5 | — | Apple / ipados | 2026-09-14 | 2026-09-15 |
| CVE-2026-65355 An information disclosure issue was addressed with improved state management. |
medium | 4.3 | — | Apple / ipados | 2026-09-14 | 2026-09-15 |
| CVE-2026-65358 A race condition was addressed with improved state handling. |
medium | 4.7 | — | Apple / ipados | 2026-09-14 | 2026-09-18 |
| CVE-2026-65345 A permissions issue was addressed with additional restrictions. |
medium | 5.5 | — | Apple / ipados | 2026-09-14 | 2026-09-17 |
| CVE-2026-65348 A permissions issue was addressed with additional restrictions. |
medium | 5.5 | — | Apple / ipados | 2026-09-14 | 2026-09-17 |
| CVE-2026-64714 A memory corruption issue was addressed with improved bounds checking. |
medium | 5.5 | — | Apple / ipados | 2026-09-14 | 2026-09-16 |
| CVE-2026-64717 A race condition was addressed with improved state handling. |
medium | 6.3 | — | Apple / ipados | 2026-09-14 | 2026-09-16 |
| CVE-2026-64753 A permissions issue was addressed by removing the vulnerable code. |
medium | 6.5 | — | Apple / safari | 2026-09-14 | 2026-09-15 |
| CVE-2026-64756 A path handling issue was addressed with improved validation. |
medium | 5.5 | — | Apple / ipados | 2026-09-14 | 2026-09-16 |
| CVE-2026-43808 A use-after-free issue was addressed with improved memory management. |
medium | 5.5 | — | Apple / ipados | 2026-09-14 | 2026-09-17 |
| CVE-2026-43785 A permissions issue was addressed with additional restrictions. |
medium | 5.5 | — | Apple / ipados | 2026-09-14 | 2026-09-17 |
| CVE-2026-43787 A logic issue was addressed with improved checks. |
medium | 5.9 | — | Apple / macos | 2026-09-14 | 2026-09-17 |
| CVE-2026-43788 An integer overflow was addressed with improved input validation. |
medium | 6.6 | — | Apple / macos | 2026-09-14 | 2026-09-15 |
| CVE-2026-43791 A validation issue was addressed with improved input sanitization. |
medium | 6.5 | — | Apple / macos | 2026-09-14 | 2026-09-17 |
| CVE-2026-43761 An out-of-bounds write issue was addressed with improved bounds checking. |
medium | 6.5 | — | Apple / macos | 2026-09-14 | 2026-09-15 |
| CVE-2026-43762 The issue was addressed with improved checks. |
medium | 5.5 | — | Apple / ipados | 2026-09-14 | 2026-09-17 |
| CVE-2026-43719 A use-after-free issue was addressed with improved memory management. |
medium | 6.5 | — | Apple / macos | 2026-09-14 | 2026-09-17 |
| CVE-2026-43737 An authorization issue was addressed with improved validation. |
medium | 5.5 | — | Apple / ipados | 2026-09-14 | 2026-09-17 |
| CVE-2026-43741 A logic issue was addressed with improved state management. |
medium | 5.5 | — | Apple / macos | 2026-09-14 | 2026-09-16 |
| CVE-2026-43687 The issue was addressed with improved memory handling. |
medium | 6.5 | — | Apple / ipados | 2026-09-14 | 2026-09-15 |
| CVE-2026-43690 A race condition was addressed with improved locking. |
medium | 4.7 | — | Apple / macos | 2026-09-14 | 2026-09-17 |
| CVE-2026-43695 An authorization issue was addressed with improved state management. |
medium | 5.5 | — | Apple / ipados | 2026-09-14 | 2026-09-17 |
| CVE-2026-43696 An authorization issue was addressed with improved entitlement checks. |
medium | 5.3 | — | Apple / macos | 2026-09-14 | 2026-09-17 |
| CVE-2026-43677 An out-of-bounds write issue was addressed by removing the vulnerable code. |
medium | 6.5 | — | Apple / macos | 2026-09-14 | 2026-09-15 |
| CVE-2026-28968 An out-of-bounds write issue was addressed with improved bounds checking. |
medium | 5.5 | — | Apple / ipados | 2026-09-14 | 2026-09-18 |
| CVE-2026-43664 This issue was addressed with improved data protection. |
medium | 5.5 | — | Apple / ipados | 2026-09-14 | 2026-09-15 |
| CVE-2026-43674 An authentication issue was addressed with improved state management. |
medium | 4.6 | — | Apple / ipados | 2026-09-14 | 2026-09-18 |
| CVE-2026-28836 A correctness issue was addressed with improved checks. |
medium | 6.1 | — | Apple / macos | 2026-09-14 | 2026-09-18 |
| CVE-2026-28899 A logic issue was addressed with improved checks. |
medium | 5.5 | — | Apple / macos | 2026-09-14 | 2026-09-17 |
| CVE-2026-28933 A use-after-free issue was addressed with improved memory management. |
medium | 5.5 | — | Apple / macos | 2026-09-14 | 2026-09-15 |
| CVE-2026-28934 A buffer overflow was addressed with improved bounds checking. |
medium | 6.5 | — | Apple / macos | 2026-09-14 | 2026-09-15 |
| CVE-2026-28937 This issue was addressed through improved state management. |
medium | 5.5 | — | Apple / macos | 2026-09-14 | 2026-09-17 |
| CVE-2026-28966 An out-of-bounds write issue was addressed with improved bounds checking. |
medium | 4.3 | — | Apple / ipados | 2026-09-14 | 2026-09-18 |
| CVE-2026-86891 An authorization issue was addressed with improved state management. |
low | 3.5 | — | Apple / macos | 2026-09-14 | 2026-09-18 |
| CVE-2026-86893 A permissions issue was addressed with additional restrictions. |
low | 3.3 | — | Apple / ipados | 2026-09-14 | 2026-09-18 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.