September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,186
Critical
1,210
High
4,308
Medium
4,071
Low
456
Severity not reported
1,141
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (605), oracle (274), apple (244), adobe (197), dell (137), ibm (104), arubanetworks (101), mongodb (64), apache (53)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-88034 Improper neutralization of special elements in data query logic in the GridFS co... |
high | 8.3 | — | Mongodb / c\+\+ driver | 2026-09-10 | 2026-09-16 |
| CVE-2026-88033 Improper neutralization of special elements in data query logic in the GridFS co... |
high | 8.3 | — | Mongodb / java driver | 2026-09-10 | 2026-09-16 |
| CVE-2026-69896 Use after free in Windows Error Reporting allows an authorized attacker to eleva... |
high | 7.0 | — | Microsoft / windows 11 24h2 | 2026-09-08 | 2026-09-16 |
| CVE-2026-69891 Use after free in Windows Media allows an authorized attacker to elevate privile... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-16 |
| CVE-2026-69890 Use after free in Windows Virtual Trusted Platform Module allows an authorized a... |
high | 7.5 | — | Microsoft / windows 10 1809 | 2026-09-08 | 2026-09-16 |
| CVE-2026-90650 The MotoPress Hotel Booking plugin for WordPress is vulnerable to Stored Cross-S... |
high | 7.2 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-91848 A vulnerability was identified in WuzhiCMS up to 4.1.0. |
high | 7.3 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-91853 A vulnerability has been found in TOTOLINK X5000R 9.1.0cu.2089_B20211224. |
high | 7.4 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-92362 A vulnerability was detected in ag-ui-protocol ag-ui 1.0. |
high | 7.3 | — | — | 2026-09-16 | 2026-09-16 |
| CVE-2026-92380 A flaw has been found in WuzhiCMS up to 4.1.0. |
high | 7.3 | — | — | 2026-09-16 | 2026-09-16 |
| CVE-2026-69889 Use after free in Windows Bluetooth Service allows an authorized attacker to ele... |
high | 7.0 | — | Microsoft / windows 10 1809 | 2026-09-08 | 2026-09-16 |
| CVE-2026-69881 Null pointer dereference in Windows IKE Extension allows an unauthorized attacke... |
high | 7.5 | — | Microsoft / windows 10 1809 | 2026-09-08 | 2026-09-16 |
| CVE-2026-69866 Use after free in Windows Device Association Service allows an authorized attack... |
high | 7.0 | — | Microsoft / windows 10 1809 | 2026-09-08 | 2026-09-16 |
| CVE-2026-69864 Use after free in Windows Hello allows an authorized attacker to elevate privile... |
high | 7.8 | — | Microsoft / windows 10 21h2 | 2026-09-08 | 2026-09-16 |
| CVE-2026-69858 Use after free in Windows DNS allows an unauthorized attacker to execute code ov... |
high | 8.1 | — | Microsoft / windows server 2022 | 2026-09-08 | 2026-09-16 |
| CVE-2026-90553 vLLM before 0.28.0 contains a remote code execution vulnerability in the LlavaOn... |
high | 7.8 | — | Vllm / vllm | 2026-09-12 | 2026-09-16 |
| CVE-2026-64761 A privacy issue was addressed with improved handling of user preferences. |
high | 7.5 | — | Apple / ipados | 2026-09-14 | 2026-09-16 |
| CVE-2026-64790 A path handling issue was addressed with improved validation. |
high | 7.8 | — | Apple / macos | 2026-09-14 | 2026-09-16 |
| CVE-2026-90843 A security vulnerability has been detected in SabyasachiRana WebMap up to 8b95fe... |
high | 8.3 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-90854 A security flaw has been discovered in SourceCodester/katojkalemba Online Food O... |
high | 7.3 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-90876 A vulnerability has been found in SourceCodester Online Faculty Clearance System... |
high | 7.3 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-4129 There is an improper access control vulnerability in NI SystemLink that may allo... |
high | 8.1 | — | — | 2026-09-10 | 2026-09-16 |
| CVE-2026-4130 There is a storage of sensitive information in cleartext vulnerability in NI Sys... |
high | 7.1 | — | — | 2026-09-10 | 2026-09-16 |
| CVE-2026-84598 A path traversal issue was addressed with improved path validation. |
high | 7.5 | — | Apple / ipados | 2026-09-14 | 2026-09-16 |
| CVE-2026-88051 Tesseract is an open source OCR engine. |
high | 7.8 | — | Tesseract-ocr / tesseract ocr | 2026-09-10 | 2026-09-16 |
| CVE-2026-88052 Tesseract is an open source OCR engine. |
high | 7.8 | — | Tesseract-ocr / tesseract ocr | 2026-09-10 | 2026-09-16 |
| CVE-2026-57132 PraisonAI is a multi-agent teams system. |
high | 8.2 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-57119 PraisonAI is a multi-agent teams system. |
high | 7.5 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-88053 Tesseract is an open source OCR engine. |
high | 7.8 | — | Tesseract-ocr / tesseract ocr | 2026-09-10 | 2026-09-16 |
| CVE-2026-88032 A use-after-free in the reactive client-side encryption component of the MongoDB... |
high | 7.5 | — | Mongodb / java driver | 2026-09-10 | 2026-09-16 |
| CVE-2026-69503 Stack-based buffer overflow in Windows USB Driver allows an authorized attacker... |
high | 8.0 | — | Microsoft / windows 10 1809 | 2026-09-08 | 2026-09-16 |
| CVE-2026-65410 The issue was addressed with improved checks. |
high | 7.5 | — | Apple / ipados | 2026-09-14 | 2026-09-16 |
| CVE-2026-69422 Use after free in Windows USB Video Driver allows an authorized attacker to elev... |
high | 7.0 | — | Microsoft / windows 11 24h2 | 2026-09-08 | 2026-09-16 |
| CVE-2026-87088 Tanium addressed an unauthorized code execution vulnerability in Enforce. |
high | 7.0 | — | Tanium / enforce | 2026-09-09 | 2026-09-16 |
| CVE-2026-87084 Tanium addressed a server-side request forgery vulnerability in Enforce. |
high | 7.7 | — | Tanium / enforce | 2026-09-09 | 2026-09-16 |
| CVE-2026-87075 Tanium addressed an improper access controls vulnerability in Comply. |
high | 8.1 | — | Tanium / comply | 2026-09-09 | 2026-09-16 |
| CVE-2026-87072 Tanium addressed an improper access controls vulnerability in Comply. |
high | 7.1 | — | Tanium / comply | 2026-09-09 | 2026-09-16 |
| CVE-2026-87030 Tanium addressed a path traversal vulnerability in Comply. |
high | 8.5 | — | Tanium / comply | 2026-09-09 | 2026-09-16 |
| CVE-2026-87817 GitPython before 3.1.60 fails to properly validate the git directory location, a... |
high | 8.8 | — | Gitpython Project / gitpython | 2026-09-09 | 2026-09-16 |
| CVE-2026-87023 Tanium addressed a path traversal vulnerability in Comply. |
high | 8.5 | — | Tanium / comply | 2026-09-09 | 2026-09-16 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.