September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,186
Critical
1,210
High
4,308
Medium
4,071
Low
456
Severity not reported
1,141
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (605), oracle (274), apple (244), adobe (197), dell (137), ibm (104), arubanetworks (101), mongodb (64), apache (53)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-20322 As part of Cisco's ongoing commitment to proactive security and product quality,... |
critical | 9.9 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-20326 As part of Cisco's ongoing commitment to proactive security and product quality,... |
critical | 9.8 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-28384 An improper sanitization of the compression_algorithm parameter in Canonical LXD... |
critical | 9.9 | — | Canonical / lxd | 2026-03-12 | 2026-09-18 |
| CVE-2026-20284 A vulnerability in the SXP REST API of Cisco ISE could allow an authenticated, r... |
critical | 9.1 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-47691 Netty is a network application framework for development of protocol servers and... |
critical | 10.0 | — | Netty / netty | 2026-06-12 | 2026-09-18 |
| CVE-2026-45674 Netty is a network application framework for development of protocol servers and... |
critical | 10.0 | — | Netty / netty | 2026-06-12 | 2026-09-18 |
| CVE-2026-42581 Netty is an asynchronous, event-driven network application framework. |
critical | 9.8 | — | Netty / netty | 2026-05-13 | 2026-09-18 |
| CVE-2026-42579 Netty is an asynchronous, event-driven network application framework. |
critical | 9.1 | — | Netty / netty | 2026-05-13 | 2026-09-18 |
| CVE-2026-27446 Missing Authentication for Critical Function (CWE-306) vulnerability in Apache A... |
critical | 9.8 | — | Apache / artemis | 2026-03-04 | 2026-09-18 |
| CVE-2026-20279 As part of Cisco's ongoing commitment to proactive security and product quality,... |
critical | 9.8 | — | — | 2026-09-02 | 2026-09-18 |
| CVE-2026-84609 A permissions issue was addressed with improved path validation. |
critical | 9.8 | — | Apple / ipados | 2026-09-14 | 2026-09-18 |
| CVE-2018-13410 Info-ZIP Zip 3.0, when the -T and -TT command-line options are used, allows atta... |
critical | 9.8 | — | Info-zip Project / zip | 2018-07-06 | 2026-09-18 |
| CVE-2026-20341 A vulnerability in the sftunnel inter-device communication protocol of Cisco Sec... |
critical | 9.1 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-20324 A vulnerability in the sftunnel inter-device communication protocol of Cisco Sec... |
critical | 9.9 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-20242 A vulnerability in the External Database Access feature of Cisco Secure Firewall... |
critical | 9.8 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-20194 As part of Cisco's ongoing commitment to proactive security and product quality,... |
critical | 9.1 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-68536 Server-Side Request Forgery / Local File Inclusion in Apache MyFace Core. |
critical | 9.8 | — | — | 2026-09-16 | 2026-09-17 |
| CVE-2026-63472 Vendure is an open-source headless commerce platform. |
critical | 9.1 | — | — | 2026-09-17 | 2026-09-17 |
| CVE-2026-62101 Unauthenticated Broken Authentication in EduAdmin Booking <= 5.4.2 versions. |
critical | 9.8 | — | — | 2026-09-17 | 2026-09-17 |
| CVE-2026-62108 Unauthenticated Broken Authentication in Headless Single Sign On <= 1.7.0 versio... |
critical | 9.8 | — | — | 2026-09-17 | 2026-09-17 |
| CVE-2026-92935 vm2 is a sandbox for running untrusted Node.js code. |
critical | 9.0 | — | — | 2026-09-17 | 2026-09-17 |
| CVE-2026-92940 vm2 versions 3.11.3 through 3.11.6 expose the host process's real https.globalAg... |
critical | 10.0 | — | — | 2026-09-17 | 2026-09-17 |
| CVE-2026-92946 vm2 before 3.11.7 contains a remote code execution vulnerability when require.ex... |
critical | 10.0 | — | — | 2026-09-17 | 2026-09-17 |
| CVE-2026-92951 vm2 before 3.11.7 contains an incorrect authorization vulnerability in the exter... |
critical | 9.9 | — | — | 2026-09-17 | 2026-09-17 |
| CVE-2026-92956 vm2 versions 3.10.1 through 3.11.6 contain a sandbox escape reachable from a def... |
critical | 10.0 | — | — | 2026-09-17 | 2026-09-17 |
| CVE-2026-78509 Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized at... |
critical | 9.8 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-17 |
| CVE-2026-67631 Heap-based buffer overflow in SQL Server allows an unauthorized attacker to exec... |
critical | 9.8 | — | Microsoft / sql server 2017 | 2026-09-08 | 2026-09-17 |
| CVE-2026-67636 Out-of-bounds read in SQL Server allows an unauthorized attacker to execute code... |
critical | 9.0 | — | Microsoft / sql server 2019 | 2026-09-08 | 2026-09-17 |
| CVE-2026-67643 Heap-based buffer overflow in SQL Server allows an unauthorized attacker to exec... |
critical | 9.8 | — | Microsoft / sql server 2022 | 2026-09-08 | 2026-09-17 |
| CVE-2026-67378 Untrusted pointer dereference in SQL Server allows an unauthorized attacker to e... |
critical | 9.0 | — | Microsoft / sql server 2019 | 2026-09-08 | 2026-09-17 |
| CVE-2026-73010 Use after free in Windows Failover Cluster allows an unauthorized attacker to ex... |
critical | 9.8 | — | Microsoft / windows 10 1809 | 2026-09-08 | 2026-09-17 |
| CVE-2026-92395 @fastify/proxy-addr is a Fastify plugin that determines a request's client addre... |
critical | 9.1 | — | — | 2026-09-16 | 2026-09-17 |
| CVE-2026-91738 Improper input validation in ANGLE in Google Chrome prior to 153.0.8010.47 allow... |
critical | 9.6 | — | Google / chrome | 2026-09-15 | 2026-09-17 |
| CVE-2026-12793 The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnera... |
critical | 9.8 | — | — | 2026-09-16 | 2026-09-17 |
| CVE-2026-20274 As part of Cisco's ongoing commitment to proactive security and product quality,... |
critical | 9.8 | — | Cisco / ios xr | 2026-09-02 | 2026-09-17 |
| CVE-2026-91729 Use after free in DigitalCredentials in Google Chrome prior to 153.0.8010.47 all... |
critical | 9.6 | — | Google / chrome | 2026-09-15 | 2026-09-17 |
| CVE-2026-91728 Integer overflow in V8 in Google Chrome prior to 153.0.8010.47 allowed a remote... |
critical | 9.6 | — | Google / chrome | 2026-09-15 | 2026-09-17 |
| CVE-2026-65381 A validation issue existed in the entitlement verification. |
critical | 10.0 | — | Apple / macos | 2026-09-14 | 2026-09-17 |
| CVE-2026-43790 The issue was addressed with improved memory handling. |
critical | 9.1 | — | Apple / macos | 2026-09-14 | 2026-09-17 |
| CVE-2026-11921 IBM Verify Identity Access containers may not apply management password change o... |
critical | 9.1 | — | — | 2026-09-15 | 2026-09-17 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.