September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,826
Low
527
Severity not reported
2,544
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), apache (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-86887 A privacy issue was addressed by removing sensitive data. |
low | 3.3 | — | Apple / ipados | 2026-09-14 | 2026-09-21 |
| CVE-2026-86888 A permissions issue was addressed with additional restrictions. |
low | 3.3 | — | Apple / ipados | 2026-09-14 | 2026-09-21 |
| CVE-2026-84626 An information disclosure issue was addressed with improved state management. |
low | 3.3 | — | Apple / ipados | 2026-09-14 | 2026-09-18 |
| CVE-2026-84530 An information disclosure issue was addressed with improved memory management. |
low | 3.3 | — | Apple / ipados | 2026-09-14 | 2026-09-18 |
| CVE-2026-65371 This issue was addressed with improved redaction of sensitive information. |
low | 3.3 | — | Apple / ipados | 2026-09-14 | 2026-09-18 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.