September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,186
Critical
1,210
High
4,308
Medium
4,071
Low
456
Severity not reported
1,141
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (605), oracle (274), apple (244), adobe (197), dell (137), ibm (104), arubanetworks (101), mongodb (64), apache (53)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-84511 An out-of-bounds write issue was addressed with improved bounds checking. |
high | 7.8 | — | Apple / ipados | 2026-09-14 | 2026-09-16 |
| CVE-2026-18212 A flaw was found in the SAML Redirect Binding implementation of Keycloak, an ope... |
high | 7.5 | — | — | 2026-09-16 | 2026-09-16 |
| CVE-2026-79651 A flaw was found in the theme localization endpoints of the keycloak-services co... |
high | 7.5 | — | — | 2026-09-16 | 2026-09-16 |
| CVE-2026-17526 Keycloak is an open-source identity and access management solution. |
high | 7.2 | — | — | 2026-09-16 | 2026-09-16 |
| CVE-2026-82996 Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion... |
high | 7.8 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-83011 Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion... |
high | 8.1 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-83030 Vulnerability in the Oracle Managed File Transfer product of Oracle Fusion Middl... |
high | 8.3 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-83044 Vulnerability in the Oracle XML Gateway product of Oracle E-Business Suite (comp... |
high | 7.1 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-83333 Vulnerability in the Oracle Net Services component of Oracle Database Server. |
high | 7.5 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-83349 Vulnerability in the Oracle Net Services component of Oracle Database Server. |
high | 7.5 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-83350 Vulnerability in the Oracle Net Services component of Oracle Database Server. |
high | 7.5 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-87908 multiparty is a Node.js library for parsing multipart/form-data request bodies. |
high | 7.5 | — | — | 2026-09-11 | 2026-09-16 |
| CVE-2026-87776 compression is a Node.js and Express compression middleware. |
high | 7.5 | — | — | 2026-09-11 | 2026-09-16 |
| CVE-2026-73966 Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM (compo... |
high | 7.2 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-83067 Vulnerability in the Oracle JDeveloper product of Oracle Fusion Middleware (comp... |
high | 8.1 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-83068 Vulnerability in the Oracle Enterprise Manager for Oracle Database product of Or... |
high | 7.7 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-83070 Vulnerability in the PeopleSoft Enterprise PRTL Interaction Hub product of Oracl... |
high | 7.7 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-83083 Vulnerability in the Oracle Marketing product of Oracle E-Business Suite (compon... |
high | 8.5 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-83084 Vulnerability in the Oracle Marketing product of Oracle E-Business Suite (compon... |
high | 7.7 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-83088 Vulnerability in the RDBMS component of Oracle Database Server. |
high | 7.7 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-83091 Vulnerability in the Oracle Field Service product of Oracle E-Business Suite (co... |
high | 7.6 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-83110 Vulnerability in the Oracle Marketing product of Oracle E-Business Suite (compon... |
high | 7.5 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-83111 Vulnerability in the Oracle Partner Management product of Oracle E-Business Suit... |
high | 7.1 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-83123 Vulnerability in the Oracle Report Manager product of Oracle E-Business Suite (c... |
high | 7.1 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-83127 Vulnerability in the Oracle Sales Offline product of Oracle E-Business Suite (co... |
high | 7.7 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-75624 IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, and 12.0.1.0 through 12.0.... |
high | 8.8 | — | Ibm / app connect enterprise | 2026-09-10 | 2026-09-16 |
| CVE-2026-78135 libcharon in strongSwan 5.9.7 through 6.0.7 mishandles behavioral workflow in th... |
high | 7.3 | — | Strongswan / strongswan | 2026-09-11 | 2026-09-16 |
| CVE-2026-68955 The installer for Rakuten Kobo Desktop Application (Windows version) insecurely... |
high | 7.8 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-82762 Improper neutralization of special elements used in an OS command ('OS Command I... |
high | 8.8 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-82765 Path traversal vulnerability exists in Contec FX5000 series, FX4000 series, and... |
high | 8.1 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-82766 Improper neutralization of special elements used in an OS command ('OS Command I... |
high | 8.8 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-82768 Path traversal vulnerability exists in SGA1000. |
high | 8.1 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-82770 Buffer overflow vulnerability exists in Contec RP-WAH-SR Series. |
high | 8.8 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-82772 Buffer overflow vulnerability exists in Contec EC1000 series. |
high | 8.8 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-82774 Improper neutralization of special elements used in an OS command ('OS Command I... |
high | 8.8 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-82777 Improper neutralization of special elements used in an OS command ('OS Command I... |
high | 8.8 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-82779 Improper neutralization of special elements used in an OS command ('OS Command I... |
high | 8.8 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-82780 Unrestricted upload of file with dangerous type issue exists in CONPROSYS TM Ser... |
high | 8.8 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-82789 An improper neutralization of directives in dynamically evaluated code ('Eval In... |
high | 8.8 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-82791 Improper neutralization of special elements used in an OS command ('OS Command I... |
high | 8.8 | — | — | 2026-09-14 | 2026-09-16 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.