September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,186
Critical
1,210
High
4,308
Medium
4,071
Low
456
Severity not reported
1,141
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (605), oracle (274), apple (244), adobe (197), dell (137), ibm (104), arubanetworks (101), mongodb (64), apache (53)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-87606 Missing authorization in SiteIsolation in Google Chrome prior to 153.0.8010.36 a... |
high | 8.1 | — | Google / chrome | 2026-09-09 | 2026-09-11 |
| CVE-2026-69773 Heap-based buffer overflow in Windows Biometric Service allows an authorized att... |
high | 8.0 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-11 |
| CVE-2026-69593 Heap-based buffer overflow in Windows Biometric Service allows an authorized att... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-11 |
| CVE-2026-69589 Heap-based buffer overflow in Windows Biometric Service allows an authorized att... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-11 |
| CVE-2026-69583 Heap-based buffer overflow in Windows Biometric Service allows an authorized att... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-11 |
| CVE-2026-69489 Heap-based buffer overflow in Windows Biometric Service allows an authorized att... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-11 |
| CVE-2026-69476 Heap-based buffer overflow in Windows Biometric Service allows an authorized att... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-11 |
| CVE-2026-70581 Integer overflow or wraparound in Windows Biometric Service allows an authorized... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-11 |
| CVE-2026-70573 Heap-based buffer overflow in Windows Biometric Service allows an authorized att... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-11 |
| CVE-2026-69787 Heap-based buffer overflow in Windows Biometric Service allows an authorized att... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-11 |
| CVE-2026-72993 Heap-based buffer overflow in Windows Biometric Service allows an authorized att... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-11 |
| CVE-2026-72988 Heap-based buffer overflow in Windows Biometric Service allows an authorized att... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-11 |
| CVE-2026-83988 Heap-based buffer overflow in Windows Biometric Service allows an authorized att... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-11 |
| CVE-2026-17037 The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordP... |
high | 7.2 | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-79963 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application... |
high | 7.4 | — | Dell / secure connect gateway | 2026-09-09 | 2026-09-11 |
| CVE-2026-78492 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application... |
high | 7.4 | — | Dell / secure connect gateway | 2026-09-09 | 2026-09-11 |
| CVE-2026-78484 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application... |
high | 7.8 | — | Dell / secure connect gateway | 2026-09-09 | 2026-09-11 |
| CVE-2026-78493 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application... |
high | 7.8 | — | Dell / secure connect gateway | 2026-09-09 | 2026-09-11 |
| CVE-2026-41870 Missing Authorization, Improper Control of Generation of Code ('Code Injection')... |
high | 8.8 | — | Apache / nutch | 2026-09-09 | 2026-09-11 |
| CVE-2026-21090 Out-of-bounds write in libsaviextractor.so prior to SMR Sep-2026 Release 1 allow... |
high | 7.8 | — | Samsung / android | 2026-09-09 | 2026-09-11 |
| CVE-2026-21091 Out-of-bounds write in libcodec2secevrcdec.so prior to SMR Sep-2026 Release 1 al... |
high | 7.8 | — | Samsung / android | 2026-09-09 | 2026-09-11 |
| CVE-2026-21094 Improper input validation in wpa_supplicant prior to SMR Sep-2026 Release 1 allo... |
high | 8.8 | — | Samsung / android | 2026-09-09 | 2026-09-11 |
| CVE-2026-67277 MikroTik RouterOS Missing Authentication for Critical Function Vulnerability |
high | 8.2 | Listed | MikroTik / RouterOS | 2026-09-05 | 2026-09-11 |
| CVE-2026-85217 A maliciously crafted add-in, when installed and executed in Autodesk Fusion Des... |
high | 8.6 | — | — | 2026-09-10 | 2026-09-11 |
| CVE-2026-82079 A stack-based buffer overflow vulnerability in the Nintendo Switch local wireles... |
high | 8.4 | — | — | 2026-09-10 | 2026-09-11 |
| CVE-2026-79987 A remote, authenticated, non-admin Craft CMS Control Panel user with only the ac... |
high | 8.8 | — | — | 2026-09-10 | 2026-09-11 |
| CVE-2026-79972 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application... |
high | 7.2 | — | Dell / secure connect gateway | 2026-09-09 | 2026-09-11 |
| CVE-2026-78494 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application... |
high | 7.4 | — | Dell / secure connect gateway | 2026-09-09 | 2026-09-11 |
| CVE-2026-79641 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application... |
high | 7.5 | — | Dell / secure connect gateway | 2026-09-09 | 2026-09-11 |
| CVE-2026-79637 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application... |
high | 7.7 | — | Dell / secure connect gateway | 2026-09-09 | 2026-09-11 |
| CVE-2026-73769 A vulnerability in the web-based management interface of vulnerable CPPM systems... |
high | 7.2 | — | — | 2026-09-09 | 2026-09-11 |
| CVE-2026-73787 A vulnerability in the CPPM web interface could allow an authenticated remote at... |
high | 7.2 | — | — | 2026-09-09 | 2026-09-11 |
| CVE-2026-23855 Dell iDRAC9, 14G versions prior to 7.00.00.184, 15G/16G versions prior to 7.30.1... |
high | 7.2 | — | — | 2026-09-09 | 2026-09-11 |
| CVE-2026-21087 Out-of-bounds write in libmdnie.so prior to SMR Sep-2026 Release 1 allows local... |
high | 7.8 | — | Samsung / android | 2026-09-09 | 2026-09-11 |
| CVE-2026-19584 Velociraptor allows for the creation of notebook backups in its default enabled... |
high | 7.7 | — | — | 2026-09-10 | 2026-09-11 |
| CVE-2026-83976 Heap-based buffer overflow in Windows Biometric Service allows an authorized att... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-10 |
| CVE-2026-83955 Heap-based buffer overflow in Windows Biometric Service allows an authorized att... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-10 |
| CVE-2026-81804 Unauthenticated Sensitive Data Exposure in ZHBackup – Backup, Restore & Migratio... |
high | 7.5 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-19303 IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacke... |
high | 8.1 | — | Langflow / langflow | 2026-09-04 | 2026-09-10 |
| CVE-2026-19283 IBM Observability with Instana (Agent) Build 1.0.303 through 1.0.323 IBM Instana... |
high | 7.7 | — | — | 2026-09-04 | 2026-09-10 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.