September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,828
Low
527
Severity not reported
2,542
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), linux (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2025-64610 Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vuln... |
medium | 5.4 | — | Adobe / experience manager | 2026-09-08 | 2026-10-19 |
| CVE-2025-64618 Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vuln... |
medium | 5.4 | — | Adobe / experience manager | 2026-09-08 | 2026-10-19 |
| CVE-2025-64830 Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vuln... |
medium | 5.4 | — | Adobe / experience manager | 2026-09-08 | 2026-10-19 |
| CVE-2025-64838 Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vuln... |
medium | 5.4 | — | Adobe / experience manager | 2026-09-08 | 2026-10-19 |
| CVE-2025-64854 Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vuln... |
medium | 5.4 | — | Adobe / experience manager | 2026-09-08 | 2026-10-19 |
| CVE-2025-64542 Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) v... |
medium | 5.4 | — | Adobe / experience manager | 2026-09-08 | 2026-10-19 |
| CVE-2026-86675 A vulnerability was identified in itsourcecode Sales and Inventory System 1.0. |
medium | 6.3 | — | — | 2026-09-08 | 2026-09-10 |
| CVE-2026-86804 A vulnerability was identified in seakee CPA-Manager-Plus up to 1.11.10. |
medium | 5.3 | — | — | 2026-09-08 | 2026-09-11 |
| CVE-2026-86674 A vulnerability was found in ningzichun Student Management System up to 98760f57... |
medium | 6.3 | — | — | 2026-09-08 | 2026-09-11 |
| CVE-2026-69642 Improper neutralization of input during web page generation ('cross-site scripti... |
medium | 6.1 | — | Microsoft / skype for business server | 2026-09-08 | 2026-09-16 |
| CVE-2026-66306 Generation of error message containing sensitive information in Skype for Busine... |
medium | 6.5 | — | Microsoft / skype for business server | 2026-09-08 | 2026-09-16 |
| CVE-2026-66308 Out-of-bounds read in Skype for Business allows an authorized attacker to deny s... |
medium | 6.5 | — | Microsoft / skype for business server | 2026-09-08 | 2026-09-16 |
| CVE-2026-63523 Improper neutralization of input during web page generation ('cross-site scripti... |
medium | 6.1 | — | Microsoft / skype for business server | 2026-09-08 | 2026-09-16 |
| CVE-2026-66303 Null pointer dereference in Skype for Business allows an authorized attacker to... |
medium | 6.5 | — | Microsoft / skype for business server | 2026-09-08 | 2026-09-16 |
| CVE-2026-55256 In parsePartHeaders of multiple files, there is a possible persistent denial of... |
medium | 6.5 | — | Google / android | 2026-09-08 | 2026-09-24 |
| CVE-2026-45527 In convertCleanApertureToRect of HeifCleanAperture.cpp, there is a possible way... |
medium | 4.3 | — | Google / android | 2026-09-08 | 2026-09-24 |
| CVE-2026-28627 In btm_sec_encrypt_change of btm_sec.cc, there is a possible downgrade attack du... |
medium | 4.3 | — | Google / android | 2026-09-08 | 2026-09-15 |
| CVE-2026-28633 In initForUserNoTracing of VoiceInteractionManagerService.java, there is a possi... |
medium | 5.5 | — | Google / android | 2026-09-08 | 2026-09-15 |
| CVE-2026-28617 In add of WifiNetworkSuggestionsManager.java, there is a possible persistent DOS... |
medium | 5.5 | — | Google / android | 2026-09-08 | 2026-09-15 |
| CVE-2026-28596 In parseInterventionFromXml of GameManagerService.java, there is a possible perm... |
medium | 5.5 | — | Google / android | 2026-09-08 | 2026-09-15 |
| CVE-2026-28584 In createSessionInternal of PackageInstallerService.java, there is a possible wa... |
medium | 5.5 | — | Google / android | 2026-09-08 | 2026-09-15 |
| CVE-2026-86672 A vulnerability has been found in ningzichun Student Management System up to 987... |
medium | 5.3 | — | — | 2026-09-08 | 2026-09-11 |
| CVE-2026-9215 A cross site request forgery (CSRF) vulnerability in the listed NETGEAR models a... |
medium | 6.7 | — | Netgear / xr1000 firmware | 2026-09-08 | 2026-10-13 |
| CVE-2026-85875 Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to... |
medium | 5.5 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-17 |
| CVE-2026-83991 Missing authentication for critical function in Windows Cloud Files Mini Filter... |
medium | 5.5 | — | Microsoft / windows 10 1809 | 2026-09-08 | 2026-09-09 |
| CVE-2026-83949 Buffer over-read in Microsoft Office Word allows an unauthorized attacker to dis... |
medium | 5.5 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-08 |
| CVE-2026-83951 Buffer over-read in Microsoft Office Word allows an unauthorized attacker to dis... |
medium | 5.5 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-08 |
| CVE-2026-83501 Out-of-bounds read in Windows Virtualization-Based Security (VBS) Enclave allows... |
medium | 5.5 | — | Microsoft / windows 11 23h2 | 2026-09-08 | 2026-09-10 |
| CVE-2026-81958 Use of uninitialized resource in Microsoft Office Excel allows an unauthorized a... |
medium | 5.5 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-17 |
| CVE-2026-81823 The vulnerability, if exploited, could allow an unauthenticated miscreant to per... |
medium | 5.3 | — | — | 2026-09-08 | 2026-09-14 |
| CVE-2026-81824 The vulnerability, if exploited, could allow a miscreant to run arbitrary JavaSc... |
medium | 4.7 | — | — | 2026-09-08 | 2026-09-11 |
| CVE-2026-81395 Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to... |
medium | 5.5 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-17 |
| CVE-2026-81399 Buffer over-read in Microsoft Office Excel allows an unauthorized attacker to di... |
medium | 5.5 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-17 |
| CVE-2026-81400 Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to... |
medium | 5.5 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-17 |
| CVE-2026-81401 Access of resource using incompatible type ('type confusion') in Microsoft Offic... |
medium | 5.5 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-17 |
| CVE-2026-81390 Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to... |
medium | 5.5 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-17 |
| CVE-2026-81391 Use of uninitialized resource in Microsoft Office Excel allows an unauthorized a... |
medium | 5.5 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-17 |
| CVE-2026-81392 Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to... |
medium | 5.5 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-17 |
| CVE-2026-81393 Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to... |
medium | 5.5 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-17 |
| CVE-2026-81394 Exposure of sensitive system information to an unauthorized control sphere in Mi... |
medium | 5.5 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-17 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.