September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,833
Low
527
Severity not reported
2,537
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), linux (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-56198 Out-of-bounds read in Microsoft Trace Data Helper allows an authorized attacker... |
high | 7.8 | — | Microsoft / windows 11 24h2 | 2026-09-08 | 2026-09-29 |
| CVE-2026-57098 Improper verification of cryptographic signature in Windows RDP Client allows an... |
high | 7.5 | — | Microsoft / remote desktop client | 2026-09-08 | 2026-09-16 |
| CVE-2026-55007 Double free in Microsoft Exchange Server allows an unauthorized attacker to exec... |
high | 8.1 | — | Microsoft / exchange server | 2026-09-08 | 2026-10-05 |
| CVE-2026-50349 Concurrent execution using shared resource with improper synchronization ('race... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-47297 Deserialization of untrusted data in SQL Server allows an unauthorized attacker... |
high | 8.1 | — | Microsoft / sql server 2019 | 2026-09-08 | 2026-10-02 |
| CVE-2026-86073 n8n is an open source workflow automation platform. |
high | 7.6 | — | N8n / n8n | 2026-09-08 | 2026-09-11 |
| CVE-2026-84387 A improper neutralization of special elements used in a command ('command inject... |
high | 7.2 | — | — | 2026-09-08 | 2026-10-29 |
| CVE-2026-84393 A improper validation of certificate with host mismatch vulnerability in Fortine... |
high | 8.1 | — | — | 2026-09-08 | 2026-10-15 |
| CVE-2026-82071 Insufficient validation of storage engine configuration options in MongoDB Serve... |
high | 8.1 | — | Mongodb / mongodb | 2026-09-08 | 2026-09-16 |
| CVE-2026-82075 An uncontrolled resource consumption weakness exists in the request-handling pat... |
high | 7.5 | — | Mongodb / mongodb | 2026-09-08 | 2026-09-16 |
| CVE-2026-82064 A security issue in MongoDB Server allows an unauthenticated network user to cau... |
high | 7.5 | — | Mongodb / mongodb | 2026-09-08 | 2026-09-16 |
| CVE-2026-82066 A heap out-of-bounds read security issue exists in the query planning component... |
high | 8.1 | — | Mongodb / mongodb | 2026-09-08 | 2026-09-16 |
| CVE-2026-82067 Improper handling of case sensitivity in the configuration validation component... |
high | 8.1 | — | Mongodb / mongodb | 2026-09-08 | 2026-09-16 |
| CVE-2026-82061 A use-after-free security issue exists in the server's query execution memory tr... |
high | 8.1 | — | Mongodb / mongodb | 2026-09-08 | 2026-09-16 |
| CVE-2026-82053 A security issue exists in MongoDB's LDAP authorization integration where pooled... |
high | 8.1 | — | Mongodb / mongodb | 2026-09-08 | 2026-09-16 |
| CVE-2026-47625 NVIDIA Triton Inference Server for Linux contains a vulnerability where an attac... |
high | 7.5 | — | — | 2026-09-08 | 2026-09-08 |
| CVE-2026-20293 A vulnerability in the Unified Extensible Firmware Interface (UEFI) Shell implem... |
high | 7.1 | — | Cisco / enterprise nfv infrastructure software | 2026-09-08 | 2026-10-26 |
| CVE-2026-16497 NVIDIA Triton Inference Server for Linux contains a vulnerability where an attac... |
high | 7.5 | — | — | 2026-09-08 | 2026-09-08 |
| CVE-2026-86738 Snipe-IT versions before 8.7.0 contain a CSS injection vulnerability in the Cust... |
high | 8.7 | — | Snipeitapp / snipe-it | 2026-09-08 | 2026-09-09 |
| CVE-2026-86732 Craft CMS versions before 5.10.12 contain a remote code execution vulnerability... |
high | 8.8 | — | — | 2026-09-08 | 2026-09-10 |
| CVE-2026-86733 Snipe-IT before 8.7.0 streams the SQL entry from an uploaded backup archive dire... |
high | 7.2 | — | Snipeitapp / snipe-it | 2026-09-08 | 2026-09-09 |
| CVE-2026-86729 WWBN AVideo through commit e01e41ecc (no patched version available) exposes get_... |
high | 7.4 | — | — | 2026-09-08 | 2026-09-10 |
| CVE-2026-86730 Craft CMS versions before 5.10.12 fail to properly cleanse string-typed field-la... |
high | 8.8 | — | — | 2026-09-08 | 2026-09-08 |
| CVE-2026-86725 AVideo through c3edcc274c389816d434acadac07ee78eaf330c1 contains a missing autho... |
high | 7.1 | — | — | 2026-09-08 | 2026-09-08 |
| CVE-2026-86727 AVideo through 29.0 contains an information disclosure vulnerability in plugin/L... |
high | 7.5 | — | — | 2026-09-08 | 2026-09-10 |
| CVE-2026-86728 AVideo through 29.0 contains an authentication bypass vulnerability in plugin/Pl... |
high | 7.5 | — | — | 2026-09-08 | 2026-09-08 |
| CVE-2026-86721 AVideo through commit c3edcc274c contains an authorization bypass vulnerability... |
high | 7.5 | — | — | 2026-09-08 | 2026-09-19 |
| CVE-2026-86722 AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains an authe... |
high | 8.1 | — | — | 2026-09-08 | 2026-09-10 |
| CVE-2026-86723 AVideo through c3edcc274c389816d434acadac07ee78eaf330c1 contains an authenticati... |
high | 8.1 | — | — | 2026-09-08 | 2026-09-08 |
| CVE-2026-86666 A security flaw has been discovered in aircheng-org iWebShop-5 up to 5.15. |
high | 7.3 | — | — | 2026-09-08 | 2026-09-10 |
| CVE-2026-86718 WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a c... |
high | 7.1 | — | — | 2026-09-08 | 2026-09-08 |
| CVE-2026-86720 WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to val... |
high | 8.1 | — | — | 2026-09-08 | 2026-09-08 |
| CVE-2026-86600 In affected Snowflake drivers, WORKLOAD_IDENTITY authentication requests a cloud... |
high | 8.2 | — | — | 2026-09-08 | 2026-09-10 |
| CVE-2026-79572 An XXE (XML External Entity) vulnerability in the level-rule module of Distribut... |
high | 7.5 | — | — | 2026-09-08 | 2026-09-09 |
| CVE-2026-16025 Improper validation of specified quantity in input vulnerability in PayTR Paymen... |
high | 7.5 | — | — | 2026-09-08 | 2026-10-01 |
| CVE-2026-16037 Observable timing discrepancy vulnerability in PayTR Payment and Electronic Mone... |
high | 7.5 | — | — | 2026-09-08 | 2026-10-01 |
| CVE-2026-86665 A vulnerability was identified in aircheng-org iWebShop-5 up to 5.15. |
high | 7.3 | — | — | 2026-09-08 | 2026-09-08 |
| CVE-2026-9034 Use After Free vulnerability in Arm Ltd Bifrost GPU Userspace Driver, Arm Ltd Va... |
high | 7.8 | — | — | 2026-09-08 | 2026-09-10 |
| CVE-2026-9040 A race condition vulnerability in Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Val... |
high | 7.7 | — | — | 2026-09-08 | 2026-09-10 |
| CVE-2026-83527 An Authentication Bypass vulnerability in Sentry before R10.8.2, R10.7.3 and R10... |
high | 8.1 | — | — | 2026-09-08 | 2026-09-09 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.