September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,186
Critical
1,210
High
4,308
Medium
4,071
Low
456
Severity not reported
1,141
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (605), oracle (274), apple (244), adobe (197), dell (137), ibm (104), arubanetworks (101), mongodb (64), apache (53)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-67373 Heap-based buffer overflow in SQL Server allows an authorized attacker to execut... |
high | 8.8 | — | Microsoft / sql server 2025 | 2026-09-08 | 2026-09-16 |
| CVE-2026-67370 Improper neutralization of special elements used in an sql command ('sql injecti... |
high | 8.8 | — | Microsoft / sql server 2017 | 2026-09-08 | 2026-09-16 |
| CVE-2026-66820 Improper neutralization of special elements used in an sql command ('sql injecti... |
high | 8.8 | — | Microsoft / sql server 2017 | 2026-09-08 | 2026-09-16 |
| CVE-2026-66819 Improper neutralization of special elements used in an sql command ('sql injecti... |
high | 8.8 | — | Microsoft / sql server 2017 | 2026-09-08 | 2026-09-16 |
| CVE-2026-66818 Improper privilege management in SQL Server allows an authorized attacker to ele... |
high | 8.8 | — | Microsoft / sql server 2017 | 2026-09-08 | 2026-09-16 |
| CVE-2026-66814 Insufficient granularity of access control in SQL Server allows an authorized at... |
high | 8.8 | — | Microsoft / sql server 2017 | 2026-09-08 | 2026-09-16 |
| CVE-2026-84607 A race condition was addressed with improved state management. |
high | 7.8 | — | Apple / ipados | 2026-09-14 | 2026-09-16 |
| CVE-2026-76442 As part of Cisco's ongoing commitment to proactive security and product quality,... |
high | 7.5 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-64752 A memory corruption issue was addressed by removing the vulnerable code. |
high | 7.3 | — | Apple / ipados | 2026-09-14 | 2026-09-16 |
| CVE-2026-65374 A memory corruption issue was addressed with improved validation. |
high | 8.8 | — | Apple / macos | 2026-09-14 | 2026-09-16 |
| CVE-2026-43684 A use-after-free issue was addressed with improved memory management. |
high | 7.8 | — | Apple / ipados | 2026-09-14 | 2026-09-16 |
| CVE-2026-61409 Dell Secure Connect Gateway (SCG) 5.0 Application, versions prior to 5.36.00.00,... |
high | 7.3 | — | Dell / secure connect gateway | 2026-09-07 | 2026-09-16 |
| CVE-2026-79643 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application... |
high | 7.3 | — | Dell / secure connect gateway | 2026-09-07 | 2026-09-16 |
| CVE-2026-79691 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application... |
high | 7.3 | — | Dell / secure connect gateway | 2026-09-07 | 2026-09-16 |
| CVE-2026-80127 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application... |
high | 7.2 | — | Dell / secure connect gateway | 2026-09-07 | 2026-09-16 |
| CVE-2026-79639 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application... |
high | 7.6 | — | Dell / secure connect gateway | 2026-09-07 | 2026-09-16 |
| CVE-2026-80166 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application... |
high | 7.8 | — | Dell / secure connect gateway | 2026-09-07 | 2026-09-16 |
| CVE-2026-49362 An unauthenticated remote attacker can create arbitrary durable queues via the C... |
high | 7.5 | — | Apache / artemis | 2026-09-10 | 2026-09-16 |
| CVE-2026-49363 An unauthenticated remote attacker connecting with the CORE protocol can discove... |
high | 7.5 | — | Apache / artemis | 2026-09-10 | 2026-09-16 |
| CVE-2026-65415 A race condition was addressed with additional validation. |
high | 8.1 | — | Apple / ipados | 2026-09-14 | 2026-09-16 |
| CVE-2026-84505 An out-of-bounds write issue was addressed with improved bounds checking. |
high | 7.8 | — | Apple / macos | 2026-09-14 | 2026-09-16 |
| CVE-2026-84575 An out-of-bounds write issue was addressed with improved bounds checking. |
high | 7.8 | — | Apple / ipados | 2026-09-14 | 2026-09-16 |
| CVE-2026-86895 An information disclosure issue was addressed with improved state management. |
high | 7.5 | — | Apple / ipados | 2026-09-14 | 2026-09-16 |
| CVE-2026-86904 A privacy issue was addressed with improved state management. |
high | 7.5 | — | Apple / ipados | 2026-09-14 | 2026-09-16 |
| CVE-2026-81941 IBM Langflow OSS 1.0.0 through 1.11.5 allows an authenticated non-administrative... |
high | 8.8 | — | Langflow / langflow | 2026-09-10 | 2026-09-16 |
| CVE-2026-81940 IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacke... |
high | 8.8 | — | Langflow / langflow | 2026-09-10 | 2026-09-16 |
| CVE-2026-81268 IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacke... |
high | 8.1 | — | Langflow / langflow | 2026-09-10 | 2026-09-16 |
| CVE-2026-81265 IBM Langflow OSS 1.0.0 through 1.11.5. |
high | 7.5 | — | Langflow / langflow | 2026-09-10 | 2026-09-16 |
| CVE-2026-81213 IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote attacker to obtain se... |
high | 8.6 | — | Langflow / langflow | 2026-09-10 | 2026-09-16 |
| CVE-2026-81211 IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacke... |
high | 8.8 | — | Langflow / langflow | 2026-09-10 | 2026-09-16 |
| CVE-2026-79742 IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacke... |
high | 8.8 | — | Langflow / langflow | 2026-09-10 | 2026-09-16 |
| CVE-2026-78575 IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacke... |
high | 8.8 | — | Langflow / langflow | 2026-09-10 | 2026-09-16 |
| CVE-2026-78571 IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacke... |
high | 8.8 | — | Langflow / langflow | 2026-09-10 | 2026-09-16 |
| CVE-2026-78569 IBM Langflow OSS 1.0.0 through 1.11.5 could allow an authenticated attacker to e... |
high | 8.8 | — | Langflow / langflow | 2026-09-10 | 2026-09-16 |
| CVE-2026-76059 IBM Langflow OSS 1.0.0 through 1.11.5 An attacker who could submit custom compon... |
high | 8.8 | — | Langflow / langflow | 2026-09-10 | 2026-09-16 |
| CVE-2026-80436 IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated a... |
high | 8.5 | — | Ibm / datastage on cloud pak for data | 2026-09-10 | 2026-09-16 |
| CVE-2026-80380 IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote attacker to per... |
high | 7.1 | — | Ibm / datastage on cloud pak for data | 2026-09-10 | 2026-09-16 |
| CVE-2026-81210 IBM DataStage on Cloud Pak for Data 5.4.0.0 concatenates three caller-supplied s... |
high | 7.7 | — | Ibm / datastage on cloud pak for data | 2026-09-10 | 2026-09-16 |
| CVE-2026-81207 IBM DataStage on Cloud Pak for Data 5.4.0.0 allows any authenticated tenant — wi... |
high | 8.5 | — | Ibm / datastage on cloud pak for data | 2026-09-10 | 2026-09-16 |
| CVE-2026-81540 IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated a... |
high | 8.5 | — | Ibm / datastage on cloud pak for data | 2026-09-10 | 2026-09-16 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.