September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,826
Low
527
Severity not reported
2,544
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), apache (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-67389 Out-of-bounds read in SQL Server allows an authorized attacker to disclose infor... |
medium | 6.5 | — | Microsoft / sql server 2022 | 2026-09-08 | 2026-09-15 |
| CVE-2026-67390 Buffer over-read in SQL Server allows an authorized attacker to disclose informa... |
medium | 6.5 | — | Microsoft / sql server 2017 | 2026-09-08 | 2026-09-15 |
| CVE-2026-67393 Buffer over-read in SQL Server allows an authorized attacker to disclose informa... |
medium | 6.5 | — | Microsoft / sql server 2017 | 2026-09-08 | 2026-09-15 |
| CVE-2026-67383 Generation of error message containing sensitive information in SQL Server allow... |
medium | 6.5 | — | Microsoft / sql server 2025 | 2026-09-08 | 2026-09-16 |
| CVE-2026-66816 Insufficient logging in SQL Server allows an authorized attacker to bypass a sec... |
medium | 6.5 | — | Microsoft / sql server 2022 | 2026-09-08 | 2026-09-16 |
| CVE-2026-67369 Out-of-bounds read in SQL Server allows an authorized attacker to disclose infor... |
medium | 6.5 | — | Microsoft / sql server 2025 | 2026-09-08 | 2026-09-16 |
| CVE-2026-65812 Insertion of sensitive information into sent data in Microsoft Teams for Android... |
medium | 6.8 | — | Microsoft / teams | 2026-09-08 | 2026-09-29 |
| CVE-2026-64918 Insufficiently protected credentials in Microsoft Office allows an unauthorized... |
medium | 6.5 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-09 |
| CVE-2026-62801 Improper limitation of a pathname to a restricted directory ('path traversal') i... |
medium | 6.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-62762 Null pointer dereference in Active Directory Domain Services allows an authorize... |
medium | 6.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-29 |
| CVE-2026-58649 Origin validation error in .NET allows an unauthorized attacker to disclose info... |
medium | 6.5 | — | Microsoft / .net | 2026-09-08 | 2026-10-07 |
| CVE-2026-54611 InstantCMS is a free and open source content management system. |
medium | 5.5 | — | — | 2026-09-08 | 2026-09-09 |
| CVE-2026-86667 A weakness has been identified in aircheng-org iWebShop-5 up to 5.15. |
medium | 4.7 | — | — | 2026-09-08 | 2026-09-08 |
| CVE-2026-86668 A security vulnerability has been detected in aircheng-org iWebShop-5 up to 5.15... |
medium | 4.3 | — | — | 2026-09-08 | 2026-09-11 |
| CVE-2026-84385 A improper access control vulnerability in Fortinet FortiSOAR PaaS 7.6.0 through... |
medium | 5.4 | — | — | 2026-09-08 | 2026-09-10 |
| CVE-2026-84386 A unverified ownership vulnerability in Fortinet FortiClientWindows 7.4.0 throug... |
medium | 5.1 | — | — | 2026-09-08 | 2026-10-02 |
| CVE-2026-84391 A use of uninitialized variable vulnerability in Fortinet FortiAnalyzer 7.6.3 th... |
medium | 6.5 | — | — | 2026-09-08 | 2026-09-08 |
| CVE-2026-82070 A security issue in MongoDB Server's diagnostic reporting interface allows an au... |
medium | 6.5 | — | Mongodb / mongodb | 2026-09-08 | 2026-09-16 |
| CVE-2026-82073 A security issue in the MongoDB Server aggregation framework allows an authentic... |
medium | 6.5 | — | Mongodb / mongodb | 2026-09-08 | 2026-09-16 |
| CVE-2026-82074 MongoDB Server contains an incorrect authorization vulnerability in the aggregat... |
medium | 6.5 | — | Mongodb / mongodb | 2026-09-08 | 2026-09-16 |
| CVE-2026-82076 An integer overflow in the query planning component of MongoDB Server can allow... |
medium | 6.5 | — | Mongodb / mongodb | 2026-09-08 | 2026-09-14 |
| CVE-2026-82063 A use-after-free security issue in the cursor management component of MongoDB Se... |
medium | 5.3 | — | Mongodb / mongodb | 2026-09-08 | 2026-09-16 |
| CVE-2026-82065 A security issue in the MongoDB Server's storage engine integration layer allows... |
medium | 6.5 | — | Mongodb / mongodb | 2026-09-08 | 2026-09-16 |
| CVE-2026-82068 A security issue in MongoDB Server allows an authenticated user with write privi... |
medium | 6.5 | — | Mongodb / mongodb | 2026-09-08 | 2026-09-16 |
| CVE-2026-82069 A security issue in MongoDB Server's query statistics serialization on the route... |
medium | 6.5 | — | Mongodb / mongodb | 2026-09-08 | 2026-09-16 |
| CVE-2026-82057 A security issue was discovered in MongoDB where an authenticated user with read... |
medium | 6.5 | — | Mongodb / mongodb | 2026-09-08 | 2026-09-16 |
| CVE-2026-82058 A flaw in MongoDB's JSON Schema validation error generation code allows an authe... |
medium | 6.5 | — | Mongodb / mongodb | 2026-09-08 | 2026-09-16 |
| CVE-2026-82059 An internal aggregation expression in MongoDB Server was incorrectly registered... |
medium | 6.5 | — | Mongodb / mongodb | 2026-09-08 | 2026-09-16 |
| CVE-2026-82060 In MongoDB, insufficient validation of shard key values during document insertio... |
medium | 5.4 | — | Mongodb / mongodb | 2026-09-08 | 2026-09-16 |
| CVE-2026-82062 A security issue in MongoDB Server allows an authenticated user with elevated in... |
medium | 5.5 | — | Mongodb / mongodb | 2026-09-08 | 2026-09-16 |
| CVE-2026-82054 A security issue exists in MongoDB server's JSON Pointer parser used during $jso... |
medium | 6.5 | — | Mongodb / mongodb | 2026-09-08 | 2026-09-16 |
| CVE-2026-82055 A security issue exists in MongoDB's 2dsphere index key generation that can caus... |
medium | 6.5 | — | Mongodb / mongodb | 2026-09-08 | 2026-09-16 |
| CVE-2026-82056 A race condition in MongoDB server's text index query parsing can cause a heap u... |
medium | 5.3 | — | Mongodb / mongodb | 2026-09-08 | 2026-09-16 |
| CVE-2026-82052 The $regexFindAll expression can be used by an authenticated user who can run ag... |
medium | 6.5 | — | Mongodb / mongodb | 2026-09-08 | 2026-09-16 |
| CVE-2026-52307 An authenticated stored cross-site scripting (XSS) vulnerability in the Column M... |
medium | 5.4 | — | — | 2026-09-08 | 2026-09-14 |
| CVE-2026-22575 An improper access control vulnerability in Fortinet FortiManager 7.6.0 through... |
medium | 4.9 | — | — | 2026-09-08 | 2026-09-08 |
| CVE-2026-86853 A malicious webpage could repeatedly trigger external URL schemes, causing syste... |
medium | 4.3 | — | Mozilla / firefox mobile | 2026-09-08 | 2026-10-05 |
| CVE-2026-86735 snipe-it versions before 8.7.0 contain a server-side request forgery vulnerabili... |
medium | 5.0 | — | Snipeitapp / snipe-it | 2026-09-08 | 2026-09-09 |
| CVE-2026-86736 snipe-it before 8.7.0 contains an incorrect calculation vulnerability in checkou... |
medium | 4.3 | — | Snipeitapp / snipe-it | 2026-09-08 | 2026-09-19 |
| CVE-2026-86737 snipe-it versions before 8.7.0 fail to enforce asset view authorization in the G... |
medium | 4.3 | — | Snipeitapp / snipe-it | 2026-09-08 | 2026-09-10 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.