September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,828
Low
527
Severity not reported
2,542
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), linux (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-86894 A logic issue was addressed with improved checks. |
high | 7.5 | — | Apple / macos | 2026-09-14 | 2026-09-16 |
| CVE-2026-86895 An information disclosure issue was addressed with improved state management. |
high | 7.5 | — | Apple / ipados | 2026-09-14 | 2026-09-16 |
| CVE-2026-86901 An out-of-bounds write issue was addressed with improved bounds checking. |
high | 7.1 | — | Apple / macos | 2026-09-14 | 2026-09-18 |
| CVE-2026-84631 This issue was addressed with additional entitlement checks. |
high | 7.8 | — | Apple / macos | 2026-09-14 | 2026-09-15 |
| CVE-2026-84632 The issue was addressed with improved memory handling. |
high | 7.3 | — | Apple / ipados | 2026-09-14 | 2026-09-16 |
| CVE-2026-84623 An authorization issue was addressed with improved state management. |
high | 7.5 | — | Apple / ipados | 2026-09-14 | 2026-09-23 |
| CVE-2026-84629 This issue was addressed with additional entitlement checks. |
high | 7.5 | — | Apple / ipados | 2026-09-14 | 2026-09-16 |
| CVE-2026-84607 A race condition was addressed with improved state management. |
high | 7.8 | — | Apple / ipados | 2026-09-14 | 2026-09-16 |
| CVE-2026-84611 An out-of-bounds write issue was addressed with improved bounds checking. |
high | 7.3 | — | Apple / ipados | 2026-09-14 | 2026-09-16 |
| CVE-2026-84620 An integer overflow was addressed with improved input validation. |
high | 7.3 | — | Apple / ipados | 2026-09-14 | 2026-09-18 |
| CVE-2026-84598 A path traversal issue was addressed with improved path validation. |
high | 7.5 | — | Apple / ipados | 2026-09-14 | 2026-09-16 |
| CVE-2026-84606 A privacy issue was addressed with improved handling of identifiers. |
high | 7.5 | — | Apple / ipados | 2026-09-14 | 2026-09-17 |
| CVE-2026-84578 A logic issue was addressed with improved checks. |
high | 8.8 | — | Apple / macos | 2026-09-14 | 2026-09-18 |
| CVE-2026-84580 The issue was addressed with improved checks. |
high | 8.4 | — | Apple / macos | 2026-09-14 | 2026-09-17 |
| CVE-2026-84581 A buffer overflow was addressed with improved bounds checking. |
high | 8.4 | — | Apple / macos | 2026-09-14 | 2026-09-16 |
| CVE-2026-84584 This issue was addressed with improved handling of symlinks. |
high | 8.4 | — | Apple / macos | 2026-09-14 | 2026-09-17 |
| CVE-2026-84568 A path traversal issue was addressed with improved path validation. |
high | 7.8 | — | Apple / macos | 2026-09-14 | 2026-09-15 |
| CVE-2026-84572 An out-of-bounds read was addressed with improved bounds checking. |
high | 7.1 | — | Apple / macos | 2026-09-14 | 2026-09-18 |
| CVE-2026-84575 An out-of-bounds write issue was addressed with improved bounds checking. |
high | 7.8 | — | Apple / ipados | 2026-09-14 | 2026-09-16 |
| CVE-2026-84577 An access issue was addressed with additional sandbox restrictions. |
high | 8.2 | — | Apple / macos | 2026-09-14 | 2026-09-16 |
| CVE-2026-84563 A logic issue was addressed with improved checks. |
high | 7.5 | — | Apple / macos | 2026-09-14 | 2026-09-16 |
| CVE-2026-84565 An out-of-bounds read was addressed with improved bounds checking. |
high | 7.1 | — | Apple / macos | 2026-09-14 | 2026-09-17 |
| CVE-2026-84566 The issue was addressed with improved memory handling. |
high | 7.8 | — | Apple / ipados | 2026-09-14 | 2026-09-18 |
| CVE-2026-84549 An out-of-bounds read was addressed with improved bounds checking. |
high | 7.5 | — | Apple / macos | 2026-09-14 | 2026-09-27 |
| CVE-2026-84553 A resource exhaustion issue was addressed with improved input validation. |
high | 7.5 | — | Apple / macos | 2026-09-14 | 2026-09-15 |
| CVE-2026-84543 An out-of-bounds access issue was addressed with improved bounds checking. |
high | 7.5 | — | Apple / macos | 2026-09-14 | 2026-09-16 |
| CVE-2026-84544 An integer overflow was addressed with improved input validation. |
high | 7.5 | — | Apple / macos | 2026-09-14 | 2026-09-17 |
| CVE-2026-84546 An out-of-bounds write issue was addressed with improved bounds checking. |
high | 8.4 | — | Apple / ipados | 2026-09-14 | 2026-09-16 |
| CVE-2026-84548 An integer overflow was addressed with improved input validation. |
high | 7.1 | — | Apple / macos | 2026-09-14 | 2026-09-17 |
| CVE-2026-84535 An authorization issue was addressed with improved state management. |
high | 8.2 | — | Apple / macos | 2026-09-14 | 2026-09-16 |
| CVE-2026-84515 An out-of-bounds write issue was addressed with improved bounds checking. |
high | 7.8 | — | Apple / macos | 2026-09-14 | 2026-09-16 |
| CVE-2026-84516 An out-of-bounds read was addressed with improved bounds checking. |
high | 8.1 | — | Apple / macos | 2026-09-14 | 2026-09-16 |
| CVE-2026-84505 An out-of-bounds write issue was addressed with improved bounds checking. |
high | 7.8 | — | Apple / macos | 2026-09-14 | 2026-09-16 |
| CVE-2026-84506 A use after free issue was addressed with improved memory management. |
high | 7.8 | — | Apple / macos | 2026-09-14 | 2026-10-20 |
| CVE-2026-84507 A race condition was addressed with improved state handling. |
high | 7.8 | — | Apple / ipados | 2026-09-14 | 2026-09-18 |
| CVE-2026-84511 An out-of-bounds write issue was addressed with improved bounds checking. |
high | 7.8 | — | Apple / ipados | 2026-09-14 | 2026-09-16 |
| CVE-2026-84512 A buffer overflow was addressed with improved bounds checking. |
high | 8.8 | — | Apple / macos | 2026-09-14 | 2026-09-17 |
| CVE-2026-81901 In Concrete CMS 9.2.0 through 9.5.2, the REST API page update endpoint (PUT /ccm... |
high | 8.7 | — | Concretecms / concrete cms | 2026-09-14 | 2026-09-18 |
| CVE-2026-81902 Concrete CMS 9 through 9.5.2 did not validate a CSRF token in the orphaned block... |
high | 8.1 | — | Concretecms / concrete cms | 2026-09-14 | 2026-09-18 |
| CVE-2026-84497 A buffer overflow was addressed with improved size validation. |
high | 7.8 | — | Apple / ipados | 2026-09-14 | 2026-09-16 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.