September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,826
Low
527
Severity not reported
2,544
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), apache (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-86881 A certificate validation issue was addressed with improved certificate validatio... |
critical | 9.1 | — | Apple / ipados | 2026-09-14 | 2026-09-16 |
| CVE-2026-84625 A permissions issue was addressed with additional sandbox restrictions. |
critical | 9.1 | — | Apple / ipados | 2026-09-14 | 2026-09-23 |
| CVE-2026-84609 A permissions issue was addressed with improved path validation. |
critical | 9.8 | — | Apple / ipados | 2026-09-14 | 2026-09-18 |
| CVE-2026-84561 A double free issue was addressed with improved memory management. |
critical | 9.8 | — | Apple / ipados | 2026-09-14 | 2026-09-16 |
| CVE-2026-84520 A buffer overflow was addressed with improved size validation. |
critical | 9.8 | — | Apple / macos | 2026-09-14 | 2026-09-16 |
| CVE-2026-65414 An out-of-bounds write issue was addressed with improved bounds checking. |
critical | 9.8 | — | Apple / ipados | 2026-09-14 | 2026-09-16 |
| CVE-2026-65381 A validation issue existed in the entitlement verification. |
critical | 10.0 | — | Apple / macos | 2026-09-14 | 2026-09-17 |
| CVE-2026-43790 The issue was addressed with improved memory handling. |
critical | 9.1 | — | Apple / macos | 2026-09-14 | 2026-09-17 |
| CVE-2026-86904 A privacy issue was addressed with improved state management. |
high | 7.5 | — | Apple / ipados | 2026-09-14 | 2026-09-16 |
| CVE-2026-86917 A permissions issue was addressed with additional restrictions. |
high | 7.8 | — | Apple / macos | 2026-09-14 | 2026-09-15 |
| CVE-2026-86894 A logic issue was addressed with improved checks. |
high | 7.5 | — | Apple / macos | 2026-09-14 | 2026-09-16 |
| CVE-2026-86895 An information disclosure issue was addressed with improved state management. |
high | 7.5 | — | Apple / ipados | 2026-09-14 | 2026-09-16 |
| CVE-2026-86901 An out-of-bounds write issue was addressed with improved bounds checking. |
high | 7.1 | — | Apple / macos | 2026-09-14 | 2026-09-18 |
| CVE-2026-84631 This issue was addressed with additional entitlement checks. |
high | 7.8 | — | Apple / macos | 2026-09-14 | 2026-09-15 |
| CVE-2026-84632 The issue was addressed with improved memory handling. |
high | 7.3 | — | Apple / ipados | 2026-09-14 | 2026-09-16 |
| CVE-2026-84623 An authorization issue was addressed with improved state management. |
high | 7.5 | — | Apple / ipados | 2026-09-14 | 2026-09-23 |
| CVE-2026-84629 This issue was addressed with additional entitlement checks. |
high | 7.5 | — | Apple / ipados | 2026-09-14 | 2026-09-16 |
| CVE-2026-84607 A race condition was addressed with improved state management. |
high | 7.8 | — | Apple / ipados | 2026-09-14 | 2026-09-16 |
| CVE-2026-84611 An out-of-bounds write issue was addressed with improved bounds checking. |
high | 7.3 | — | Apple / ipados | 2026-09-14 | 2026-09-16 |
| CVE-2026-84620 An integer overflow was addressed with improved input validation. |
high | 7.3 | — | Apple / ipados | 2026-09-14 | 2026-09-18 |
| CVE-2026-84598 A path traversal issue was addressed with improved path validation. |
high | 7.5 | — | Apple / ipados | 2026-09-14 | 2026-09-16 |
| CVE-2026-84606 A privacy issue was addressed with improved handling of identifiers. |
high | 7.5 | — | Apple / ipados | 2026-09-14 | 2026-09-17 |
| CVE-2026-84578 A logic issue was addressed with improved checks. |
high | 8.8 | — | Apple / macos | 2026-09-14 | 2026-09-18 |
| CVE-2026-84580 The issue was addressed with improved checks. |
high | 8.4 | — | Apple / macos | 2026-09-14 | 2026-09-17 |
| CVE-2026-84581 A buffer overflow was addressed with improved bounds checking. |
high | 8.4 | — | Apple / macos | 2026-09-14 | 2026-09-16 |
| CVE-2026-84584 This issue was addressed with improved handling of symlinks. |
high | 8.4 | — | Apple / macos | 2026-09-14 | 2026-09-17 |
| CVE-2026-84568 A path traversal issue was addressed with improved path validation. |
high | 7.8 | — | Apple / macos | 2026-09-14 | 2026-09-15 |
| CVE-2026-84572 An out-of-bounds read was addressed with improved bounds checking. |
high | 7.1 | — | Apple / macos | 2026-09-14 | 2026-09-18 |
| CVE-2026-84575 An out-of-bounds write issue was addressed with improved bounds checking. |
high | 7.8 | — | Apple / ipados | 2026-09-14 | 2026-09-16 |
| CVE-2026-84577 An access issue was addressed with additional sandbox restrictions. |
high | 8.2 | — | Apple / macos | 2026-09-14 | 2026-09-16 |
| CVE-2026-84563 A logic issue was addressed with improved checks. |
high | 7.5 | — | Apple / macos | 2026-09-14 | 2026-09-16 |
| CVE-2026-84565 An out-of-bounds read was addressed with improved bounds checking. |
high | 7.1 | — | Apple / macos | 2026-09-14 | 2026-09-17 |
| CVE-2026-84566 The issue was addressed with improved memory handling. |
high | 7.8 | — | Apple / ipados | 2026-09-14 | 2026-09-18 |
| CVE-2026-84549 An out-of-bounds read was addressed with improved bounds checking. |
high | 7.5 | — | Apple / macos | 2026-09-14 | 2026-09-27 |
| CVE-2026-84553 A resource exhaustion issue was addressed with improved input validation. |
high | 7.5 | — | Apple / macos | 2026-09-14 | 2026-09-15 |
| CVE-2026-84543 An out-of-bounds access issue was addressed with improved bounds checking. |
high | 7.5 | — | Apple / macos | 2026-09-14 | 2026-09-16 |
| CVE-2026-84544 An integer overflow was addressed with improved input validation. |
high | 7.5 | — | Apple / macos | 2026-09-14 | 2026-09-17 |
| CVE-2026-84546 An out-of-bounds write issue was addressed with improved bounds checking. |
high | 8.4 | — | Apple / ipados | 2026-09-14 | 2026-09-16 |
| CVE-2026-84548 An integer overflow was addressed with improved input validation. |
high | 7.1 | — | Apple / macos | 2026-09-14 | 2026-09-17 |
| CVE-2026-84535 An authorization issue was addressed with improved state management. |
high | 8.2 | — | Apple / macos | 2026-09-14 | 2026-09-16 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.