September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,186
Critical
1,210
High
4,308
Medium
4,071
Low
456
Severity not reported
1,141
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (605), oracle (274), apple (244), adobe (197), dell (137), ibm (104), arubanetworks (101), mongodb (64), apache (53)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-18175 IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to manipulate databas... |
high | 7.5 | — | Ibm / i | 2026-09-04 | 2026-09-10 |
| CVE-2026-14873 The Bulk Password Reset plugin for WordPress is vulnerable to privilege escalati... |
high | 8.0 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-87471 Incorrect authorization in ServiceWorker in Google Chrome prior to 153.0.8010.36... |
high | 8.1 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-53932 laravel-backup-restore restores database backups made with spatie/laravel-backup... |
high | 8.0 | — | — | 2026-09-04 | 2026-09-10 |
| CVE-2026-48019 Laravel is a web application framework. |
high | 8.9 | — | — | 2026-09-04 | 2026-09-10 |
| CVE-2026-21088 Improper input validation in loading a subtitle frame in libsubextractor.so prio... |
high | 7.8 | — | Samsung / android | 2026-09-09 | 2026-09-10 |
| CVE-2026-21089 Improper input validation in removing style tag in libsubextractor.so prior to S... |
high | 7.8 | — | Samsung / android | 2026-09-09 | 2026-09-10 |
| CVE-2026-21100 Improper access control in SystemUI prior to SMR Sep-2026 Release 1 allows local... |
high | 7.1 | — | Samsung / android | 2026-09-09 | 2026-09-10 |
| CVE-2026-8862 IBM Netezza Software 11.3.0.3 through Interim Fix 002 has credentials that are h... |
high | 7.5 | — | Ibm / netezza performance server | 2026-09-03 | 2026-09-10 |
| CVE-2026-57866 Server side request forgery in Apache Impala versions 4.4.x and 4.5.x. |
high | 8.8 | — | Apache / impala | 2026-09-09 | 2026-09-10 |
| CVE-2026-65181 Insufficient authorization of Data Source tables in Impala 2.7-4.5 allows a clie... |
high | 8.1 | — | Apache / impala | 2026-09-09 | 2026-09-10 |
| CVE-2026-73334 Potential problem for users of the org.apache.parquet.crypto.keytools package in... |
high | 8.1 | — | Apache / parquet | 2026-09-09 | 2026-09-10 |
| CVE-2026-87933 A vulnerability was found in DaveGamble cJSON up to 1.7.19. |
high | 7.3 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-87993 The consul-template library is vulnerable to an information disclosure issue in... |
high | 7.7 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-88021 Consul and Consul Enterprise are vulnerable to an authorization bypass in the Co... |
high | 7.1 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-87431 Missing authorization in Extensions in Google Chrome prior to 153.0.8010.36 allo... |
high | 7.5 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-86259 OpenMAIC before 1.0.1 skips server-side request forgery validation in non-produc... |
high | 7.5 | — | — | 2026-09-06 | 2026-09-10 |
| CVE-2026-81192 `OpenTelemetry.Resources.Host` NuGet package, which provides OpenTelemetry resou... |
high | 7.0 | — | — | 2026-09-08 | 2026-09-10 |
| CVE-2026-87806 Parse Server versions <= 8.6.87 and >= 9.0.0 < 9.10.1-alpha.7 contain an authent... |
high | 7.4 | — | — | 2026-09-09 | 2026-09-10 |
| CVE-2026-64836 ICEcoder versions through 8.1 contain a path traversal vulnerability in the file... |
high | 8.8 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-64837 ICEcoder through 8.1 passes an unescaped filesystem path into a shell command in... |
high | 8.8 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-64838 ICEcoder versions through 8.1 fail to properly validate the oldFileName paramete... |
high | 8.3 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-88937 knowns through 0.33.0 fails to properly validate template destination paths in t... |
high | 8.8 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-73693 FileRun before 2026.3.0 contains an OS command injection vulnerability in the Ph... |
high | 8.8 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-73699 FileRun before 2026.3.0 contains a PHP object injection vulnerability that allow... |
high | 7.2 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-89043 passport-saml-encrypted through 0.1.13 contains an XML signature wrapping vulner... |
high | 7.4 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-53938 OpenIDC/cjose is a C library implementing the Javascript Object Signing and Encr... |
high | 8.2 | — | — | 2026-09-09 | 2026-09-10 |
| CVE-2026-88045 rclone is a command-line program to sync files and directories to and from diffe... |
high | 7.5 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-89046 zstd-jni versions 1.5.5-6 through 1.5.7-13 contain an out-of-bounds read vulnera... |
high | 8.2 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-87090 Consul and Consul Enterprise are vulnerable to an authorization bypass in the ca... |
high | 8.3 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-87499 Incorrect authorization in Network in Google Chrome prior to 153.0.8010.36 allow... |
high | 8.1 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87505 Incorrect authorization in FileSystem in Google Chrome prior to 153.0.8010.36 al... |
high | 8.1 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-9034 Use After Free vulnerability in Arm Ltd Bifrost GPU Userspace Driver, Arm Ltd Va... |
high | 7.8 | — | — | 2026-09-08 | 2026-09-10 |
| CVE-2026-7476 Use After Free vulnerability in Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valha... |
high | 7.8 | — | — | 2026-09-08 | 2026-09-10 |
| CVE-2026-7477 Use After Free vulnerability in Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valha... |
high | 7.8 | — | — | 2026-09-08 | 2026-09-10 |
| CVE-2026-79602 A guest with a PCI device assigned that has at least a BAR on the IO port
space... |
high | 8.8 | — | — | 2026-09-08 | 2026-09-10 |
| CVE-2026-62646 A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). |
high | 7.4 | — | — | 2026-09-08 | 2026-09-10 |
| CVE-2026-5729 Use After Free vulnerability in Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5... |
high | 7.8 | — | — | 2026-09-08 | 2026-09-10 |
| CVE-2026-0860 Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Arm... |
high | 7.5 | — | — | 2026-09-08 | 2026-09-10 |
| CVE-2026-69298 Integer overflow or wraparound in Windows Biometric Service allows an authorized... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-10 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.