September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,186
Critical
1,210
High
4,308
Medium
4,071
Low
456
Severity not reported
1,141
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (605), oracle (274), apple (244), adobe (197), dell (137), ibm (104), arubanetworks (101), mongodb (64), apache (53)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-87570 Incorrect authorization in SiteIsolation in Google Chrome prior to 153.0.8010.36... |
high | 8.8 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87433 Race condition in FileAPI in Google Chrome prior to 153.0.8010.36 allowed a remo... |
high | 8.8 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87450 Incorrect authorization in Permissions in Google Chrome prior to 153.0.8010.36 a... |
high | 7.5 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-86541 knowns versions before 0.30.0 contain a path traversal vulnerability in the hand... |
high | 8.3 | — | — | 2026-09-07 | 2026-09-10 |
| CVE-2026-86712 SiYuan before 3.8.2 trusts the attacker-writable text/siyuan clipboard MIME type... |
high | 8.8 | — | — | 2026-09-08 | 2026-09-10 |
| CVE-2026-86600 In affected Snowflake drivers, WORKLOAD_IDENTITY authentication requests a cloud... |
high | 8.2 | — | — | 2026-09-08 | 2026-09-10 |
| CVE-2026-86729 WWBN AVideo through commit e01e41ecc (no patched version available) exposes get_... |
high | 7.4 | — | — | 2026-09-08 | 2026-09-10 |
| CVE-2026-86438 Lara Dashboard before 1.3.2 fails to authorize the MarketplaceModuleBrowser inst... |
high | 7.2 | — | — | 2026-09-07 | 2026-09-10 |
| CVE-2026-86117 Coolify through 4.3.17 contains an authentication bypass vulnerability in the OA... |
high | 8.1 | — | — | 2026-09-05 | 2026-09-10 |
| CVE-2026-85623 goose 1.37.0 executes arbitrary commands from recipe stdio extensions and retry.... |
high | 8.8 | — | — | 2026-09-04 | 2026-09-10 |
| CVE-2026-85664 Chroma 1.5.9 fails to validate maximum bounds on HNSW index parameters max_neigh... |
high | 7.5 | — | — | 2026-09-04 | 2026-09-10 |
| CVE-2026-85674 aider (aider-chat) automatically loads a .aider.conf.yml configuration file from... |
high | 7.8 | — | — | 2026-09-04 | 2026-09-10 |
| CVE-2026-85581 SiYuan before v3.8.2 contains a denial of service vulnerability in the unauthent... |
high | 7.5 | — | — | 2026-09-04 | 2026-09-10 |
| CVE-2026-85610 OpenPanel before 2.3.0 fails to properly validate chart formula expressions, all... |
high | 8.8 | — | — | 2026-09-04 | 2026-09-10 |
| CVE-2026-85525 Improper OCSP response validation in the Snowflake Python, Go, JDBC, and Node.js... |
high | 7.4 | — | — | 2026-09-04 | 2026-09-10 |
| CVE-2026-81805 Unauthenticated Privilege Escalation in SiteSkite <= 2.1.5 versions. |
high | 8.1 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-80113 PassMark PerformanceTest before 11.1 build 1012, BurnInTest before 11.1 build 10... |
high | 7.1 | — | — | 2026-09-04 | 2026-09-10 |
| CVE-2026-80118 PassMark PerformanceTest before 11.1 build 1012, BurnInTest before 11.1 build 10... |
high | 7.1 | — | — | 2026-09-04 | 2026-09-10 |
| CVE-2026-77110 Adobe Commerce is affected by an Improper Limitation of a Pathname to a Restrict... |
high | 7.6 | — | Adobe / commerce | 2026-09-08 | 2026-09-10 |
| CVE-2026-71808 A SQL Injection vulnerability in Siam Ordering (siam-server) 1.0.0 allows remote... |
high | 8.8 | — | — | 2026-09-09 | 2026-09-10 |
| CVE-2026-71613 Buffer Overflow vulnerability in GPAC c2dee3aff638cd96f9617ac5b17dc2868cd90ef3 a... |
high | 7.8 | — | — | 2026-09-09 | 2026-09-10 |
| CVE-2026-42804 A stack-based buffer overflow vulnerability exists in the Bosch Sensortec BHI360... |
high | 7.6 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-42805 A stack-based buffer overflow vulnerability exists in the Bosch Sensortec BHI385... |
high | 8.4 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-42807 A heap-based buffer overflow vulnerability in the PC bridge protocol decoder of... |
high | 8.0 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-19298 IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacke... |
high | 8.8 | — | Langflow / langflow | 2026-09-04 | 2026-09-10 |
| CVE-2026-16826 IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local attacker to execute arbitrary c... |
high | 7.8 | — | Ibm / i | 2026-09-04 | 2026-09-10 |
| CVE-2026-17255 IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of... |
high | 7.5 | — | Ibm / i | 2026-09-04 | 2026-09-10 |
| CVE-2026-81992 Acrobat Reader is affected by a Heap-based Buffer Overflow vulnerability that co... |
high | 7.8 | — | Adobe / acrobat | 2026-09-08 | 2026-09-10 |
| CVE-2026-81987 Acrobat Reader is affected by an Integer Overflow or Wraparound vulnerability th... |
high | 7.8 | — | Adobe / acrobat | 2026-09-08 | 2026-09-10 |
| CVE-2026-80161 Acrobat Reader is affected by an Access of Resource Using Incompatible Type ('Ty... |
high | 7.8 | — | Adobe / acrobat | 2026-09-08 | 2026-09-10 |
| CVE-2026-79907 Acrobat Reader is affected by a Double Free vulnerability that could result in a... |
high | 7.8 | — | Adobe / acrobat | 2026-09-08 | 2026-09-10 |
| CVE-2026-84694 Coolify before 4.2.0 fails to properly escape environment variable key names in... |
high | 8.8 | — | — | 2026-09-02 | 2026-09-10 |
| CVE-2026-84715 FeatherPanel versions before 1.3.7.10 fail to validate permissions in the Subuse... |
high | 8.8 | — | — | 2026-09-02 | 2026-09-10 |
| CVE-2026-85182 vhr through commit 03abbd3 fails to verify that the account ID in PUT /hr/pass r... |
high | 7.5 | — | — | 2026-09-03 | 2026-09-10 |
| CVE-2026-85211 Label Studio fails to apply organization filters when resolving storage URIs for... |
high | 7.7 | — | — | 2026-09-03 | 2026-09-10 |
| CVE-2026-85212 CRMEB contains an authentication bypass vulnerability in the verifyAuth() method... |
high | 8.3 | — | — | 2026-09-03 | 2026-09-10 |
| CVE-2026-85213 Kill Bill through 0.24.21 fails to enforce permission annotations on several Adm... |
high | 7.6 | — | — | 2026-09-03 | 2026-09-10 |
| CVE-2026-85214 vhr fails to validate user authorization in the PUT /hr/info endpoint, allowing... |
high | 8.1 | — | — | 2026-09-03 | 2026-09-10 |
| CVE-2026-85390 Checkmate through 3.11.0 omits the isAllowed role guard middleware on maintenanc... |
high | 7.1 | — | — | 2026-09-03 | 2026-09-10 |
| CVE-2026-85607 Blinko 1.8.7 contains an authorization bypass (IDOR) vulnerability in multiple t... |
high | 8.8 | — | — | 2026-09-04 | 2026-09-10 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.