September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,186
Critical
1,210
High
4,308
Medium
4,071
Low
456
Severity not reported
1,141
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (605), oracle (274), apple (244), adobe (197), dell (137), ibm (104), arubanetworks (101), mongodb (64), apache (53)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-69323 Heap-based buffer overflow in Windows Biometric Service allows an authorized att... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-10 |
| CVE-2026-69467 Stack-based buffer overflow in Microsoft Graphics Component allows an authorized... |
high | 7.8 | — | Microsoft / windows 10 21h2 | 2026-09-08 | 2026-09-10 |
| CVE-2026-69580 Heap-based buffer overflow in Windows Biometric Service allows an authorized att... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-10 |
| CVE-2026-72990 Heap-based buffer overflow in Windows Biometric Service allows an authorized att... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-10 |
| CVE-2026-72995 Heap-based buffer overflow in Windows Biometric Service allows an authorized att... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-10 |
| CVE-2026-73001 Heap-based buffer overflow in Windows Biometric Service allows an authorized att... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-10 |
| CVE-2026-73006 Stack-based buffer overflow in Microsoft Graphics Component allows an unauthoriz... |
high | 8.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-10 |
| CVE-2026-73011 Heap-based buffer overflow in Windows Biometric Service allows an authorized att... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-10 |
| CVE-2026-73021 Heap-based buffer overflow in Windows Biometric Service allows an authorized att... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-10 |
| CVE-2026-73026 Heap-based buffer overflow in Windows Biometric Service allows an authorized att... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-10 |
| CVE-2026-87537 Missing authorization in Extensions in Google Chrome prior to 153.0.8010.36 allo... |
high | 8.1 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87536 Use after free in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote at... |
high | 8.8 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87533 Use after free in DevTools in Google Chrome prior to 153.0.8010.36 allowed a loc... |
high | 8.1 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-9040 A race condition vulnerability in Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Val... |
high | 7.7 | — | — | 2026-09-08 | 2026-09-10 |
| CVE-2026-88271 GeoVision GV-LPC2211 V1.13 allows a Guest user to overwrite device configuration... |
high | 8.8 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-88272 GeoVision GV-LPC2211 V1.13 allows an administrator-controlled username containin... |
high | 7.2 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-88277 GeoVision GV-LPC2211 V1.13 allows an authenticated ONVIF user to inject shell co... |
high | 8.8 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-87925 A vulnerability was detected in Rizwan17 inventory-management-system up to bfe78... |
high | 7.3 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-86208 A security flaw has been discovered in SourceCodester Class and Exam Timetabling... |
high | 7.3 | — | — | 2026-09-06 | 2026-09-10 |
| CVE-2026-86213 A vulnerability was found in Mstfakts College-Management-System. |
high | 7.3 | — | — | 2026-09-06 | 2026-09-10 |
| CVE-2026-86810 A vulnerability was detected in Open-Web-Analytics up to 1.9.1. |
high | 7.3 | — | — | 2026-09-08 | 2026-09-10 |
| CVE-2026-84819 Unauthenticated Cross Site Scripting (XSS) in WPAdverts <= 2.3.3 versions. |
high | 7.1 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-81794 Unauthenticated Broken Access Control in Shirt Product Designer for WooCommerce... |
high | 7.5 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-81801 Subscriber Settings Change in WP-Stateless <= 4.4.1 versions. |
high | 8.1 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-79324 Missing authorization in the Address Delete controller in Mageplaza GDPR for Mag... |
high | 7.5 | — | Mageplaza / gdpr | 2026-09-09 | 2026-09-10 |
| CVE-2026-79323 Information disclosure in the blogComments GraphQL query in Magefan Blog GraphQL... |
high | 7.5 | — | Mageplaza / magefan blog | 2026-09-09 | 2026-09-10 |
| CVE-2026-79322 SQL injection in the RelatedProduct block in Mageplaza Blog for Magento 2 (magep... |
high | 8.6 | — | Mageplaza / mageplaza blog | 2026-09-09 | 2026-09-10 |
| CVE-2026-81996 Acrobat Reader is affected by an Incorrect Authorization vulnerability that coul... |
high | 8.8 | — | Adobe / acrobat | 2026-09-08 | 2026-09-10 |
| CVE-2026-73763 A vulnerability exists in a management component that could allow an unauthentic... |
high | 8.8 | — | Hpe / arubaos-cx | 2026-09-01 | 2026-09-10 |
| CVE-2026-88874 AVideo through revision c3edcc274c389816d434acadac07ee78eaf330c1 (master, 2026-0... |
high | 7.5 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-88286 GeoVision GV-LPC2211 V1.13 improperly manages PTZ connection state, allowing an... |
high | 7.5 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-88287 GeoVision GV-LPC2211 V1.13 fails to bound the number of Scopes tokens in unauthe... |
high | 7.5 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-88289 GeoVision GV-LPC2211 V1.14 (260903) fails to validate attacker-controlled variab... |
high | 7.5 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-88290 GeoVision GV-LPC2211 V1.14 (260903) allows unauthenticated clients to declare un... |
high | 7.5 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-88273 GeoVision GV-LPC2211 V1.13 allows an administrator-controlled PPPoE username to... |
high | 7.2 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-88274 GeoVision GV-LPC2211 V1.13 allows an administrator-controlled wireless SSID cont... |
high | 7.2 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-88275 GeoVision GV-LPC2211 V1.13 allows an administrator-controlled WPA-PSK containing... |
high | 7.2 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-88276 GeoVision GV-LPC2211 V1.13 allows administrator-controlled WEP key values contai... |
high | 7.2 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-88282 GeoVision GV-LPC2211 V1.13 allows an administrator-controlled FTP username conta... |
high | 7.2 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-87569 Missing authorization in Views in Google Chrome prior to 153.0.8010.36 allowed a... |
high | 8.8 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.