September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,833
Low
527
Severity not reported
2,537
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), linux (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-12759 IBM Cloud Pak for Business Automation could allow an authenticated user to cause... |
medium | 6.5 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-90820 A security vulnerability has been detected in a2aproject a2a-java 1.2.0. |
medium | 4.3 | — | — | 2026-09-14 | 2026-09-15 |
| CVE-2026-86902 A parsing issue in the handling of directory paths was addressed with improved p... |
medium | 5.5 | — | Apple / macos | 2026-09-14 | 2026-09-18 |
| CVE-2026-86903 An out-of-bounds read was addressed with improved input validation. |
medium | 5.5 | — | Apple / ipados | 2026-09-14 | 2026-09-16 |
| CVE-2026-86905 This issue was addressed by removing the vulnerable code. |
medium | 5.5 | — | Apple / ipados | 2026-09-14 | 2026-09-16 |
| CVE-2026-86909 A logic issue was addressed with improved state management. |
medium | 4.4 | — | Apple / macos | 2026-09-14 | 2026-09-18 |
| CVE-2026-86910 A permissions issue was addressed with improved path validation. |
medium | 5.5 | — | Apple / macos | 2026-09-14 | 2026-09-18 |
| CVE-2026-86911 This issue was addressed with improved state management. |
medium | 5.5 | — | Apple / macos | 2026-09-14 | 2026-09-18 |
| CVE-2026-86924 A memory corruption issue was addressed with improved input validation. |
medium | 5.5 | — | Apple / ipados | 2026-09-14 | 2026-09-18 |
| CVE-2026-90818 A security flaw has been discovered in netease-youdao LobsterAI 2026.6.15/2026.8... |
medium | 4.3 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-86892 This issue was addressed with additional entitlement checks. |
medium | 5.5 | — | Apple / ipados | 2026-09-14 | 2026-09-18 |
| CVE-2026-86897 This issue was addressed with additional entitlement checks. |
medium | 5.5 | — | Apple / safari | 2026-09-14 | 2026-09-18 |
| CVE-2026-86898 A logic issue was addressed with improved state management. |
medium | 5.4 | — | Apple / safari | 2026-09-14 | 2026-09-18 |
| CVE-2026-86900 An out-of-bounds read issue was addressed with improved input validation. |
medium | 6.5 | — | Apple / macos | 2026-09-14 | 2026-09-18 |
| CVE-2026-86882 An out-of-bounds write issue was addressed with improved bounds checking. |
medium | 6.5 | — | Apple / ipados | 2026-09-14 | 2026-09-16 |
| CVE-2026-86883 A privacy issue was addressed with improved handling of files. |
medium | 5.5 | — | Apple / ipados | 2026-09-14 | 2026-09-16 |
| CVE-2026-86884 A permissions issue was addressed with additional restrictions. |
medium | 5.5 | — | Apple / ipados | 2026-09-14 | 2026-09-18 |
| CVE-2026-86885 An input validation issue was addressed with improved input validation. |
medium | 6.5 | — | Apple / ipados | 2026-09-14 | 2026-09-16 |
| CVE-2026-86886 A path traversal issue was addressed with improved input validation. |
medium | 5.5 | — | Apple / ipados | 2026-09-14 | 2026-09-18 |
| CVE-2026-86889 A certificate validation issue was addressed with improved certificate validatio... |
medium | 4.8 | — | Apple / macos | 2026-09-14 | 2026-09-16 |
| CVE-2026-86890 A logic issue was addressed with improved checks. |
medium | 4.6 | — | Apple / ipados | 2026-09-14 | 2026-09-16 |
| CVE-2026-84635 A logic issue was addressed with improved state management. |
medium | 6.5 | — | Apple / safari | 2026-09-14 | 2026-09-18 |
| CVE-2026-84636 An authorization issue was addressed with improved state management. |
medium | 5.5 | — | Apple / ipados | 2026-09-14 | 2026-09-18 |
| CVE-2026-86869 An out-of-bounds write issue was addressed with improved bounds checking. |
medium | 6.5 | — | Apple / ipados | 2026-09-14 | 2026-09-18 |
| CVE-2026-86870 A heap buffer overflow was addressed with improved bounds checking. |
medium | 6.5 | — | Apple / ipados | 2026-09-14 | 2026-09-18 |
| CVE-2026-86876 An out-of-bounds write issue was addressed with improved bounds checking. |
medium | 5.2 | — | Apple / ipados | 2026-09-14 | 2026-09-15 |
| CVE-2026-86878 A permissions issue was addressed with additional restrictions. |
medium | 5.5 | — | Apple / ipados | 2026-09-14 | 2026-09-16 |
| CVE-2026-86879 A denial-of-service issue was addressed with improved input validation. |
medium | 6.5 | — | Apple / ipados | 2026-09-14 | 2026-09-15 |
| CVE-2026-84621 An authorization issue was addressed with improved access control. |
medium | 5.5 | — | Apple / ipados | 2026-09-14 | 2026-09-23 |
| CVE-2026-84622 A memory initialization issue was addressed with improved memory handling. |
medium | 6.2 | — | Apple / ipados | 2026-09-14 | 2026-09-18 |
| CVE-2026-84624 A permissions issue was addressed with improved path validation. |
medium | 5.5 | — | Apple / ipados | 2026-09-14 | 2026-09-23 |
| CVE-2026-84628 An authorization issue was addressed with improved state management. |
medium | 5.5 | — | Apple / ipados | 2026-09-14 | 2026-09-23 |
| CVE-2026-84630 A race condition was addressed with improved state handling. |
medium | 4.7 | — | Apple / ipados | 2026-09-14 | 2026-09-16 |
| CVE-2026-84612 An authorization issue was addressed with improved access control. |
medium | 5.5 | — | Apple / ipados | 2026-09-14 | 2026-09-16 |
| CVE-2026-84615 An authorization issue was addressed with improved state management. |
medium | 5.5 | — | Apple / ipados | 2026-09-14 | 2026-09-18 |
| CVE-2026-84616 A type confusion issue was addressed with improved memory handling. |
medium | 5.5 | — | Apple / ipados | 2026-09-14 | 2026-09-18 |
| CVE-2026-84617 An authorization issue was addressed with improved state management. |
medium | 5.5 | — | Apple / ipados | 2026-09-14 | 2026-09-16 |
| CVE-2026-84618 A permissions issue was addressed with improved validation. |
medium | 5.5 | — | Apple / macos | 2026-09-14 | 2026-09-23 |
| CVE-2026-84619 An out-of-bounds write issue was addressed with improved bounds checking. |
medium | 6.1 | — | Apple / macos | 2026-09-14 | 2026-09-23 |
| CVE-2026-84593 A use after free issue was addressed with improved memory management. |
medium | 5.5 | — | Apple / ipados | 2026-09-14 | 2026-09-17 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.