September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,186
Critical
1,210
High
4,308
Medium
4,071
Low
456
Severity not reported
1,141
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (605), oracle (274), apple (244), adobe (197), dell (137), ibm (104), arubanetworks (101), mongodb (64), apache (53)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-0187 In gsa_sw_pk_hash_compare of image-auth-srv.c, there is a possible escalation of... |
medium | 6.7 | — | Google / android | 2026-09-15 | 2026-09-21 |
| CVE-2026-0192 In Bootloader, there is a possible escalation of privilege due to a missing perm... |
medium | 6.7 | — | Google / android | 2026-09-15 | 2026-09-21 |
| CVE-2026-0197 In VPU, there is a possible information dislclosure due to a logic error in the... |
medium | 4.4 | — | Google / android | 2026-09-15 | 2026-09-21 |
| CVE-2026-55302 In multiple locations, there is a possible permission bypass due to a logic erro... |
medium | 6.7 | — | Google / android | 2026-09-15 | 2026-09-21 |
| CVE-2026-55304 In addr_remap_address_map of remap.c, there is a possible escalation of privileg... |
medium | 6.7 | — | Google / android | 2026-09-15 | 2026-09-21 |
| CVE-2026-55317 In printf of printf.c, there is a possible out-of-bounds write due to improper i... |
medium | 6.7 | — | Google / android | 2026-09-15 | 2026-09-21 |
| CVE-2026-55332 In multiple locations, there is a possible out-of-bounds write due to improper i... |
medium | 6.7 | — | Google / android | 2026-09-15 | 2026-09-21 |
| CVE-2026-55365 In multiple functions of remap.c, there is a possible out-of-bounds write due to... |
medium | 6.7 | — | Google / android | 2026-09-15 | 2026-09-21 |
| CVE-2026-56879 In gmc_mb_msg_handler of gmc_mba.c, there is a possible memory corruption due to... |
medium | 6.7 | — | Google / android | 2026-09-15 | 2026-09-21 |
| CVE-2026-94113 Frappe ERPNext versions before 15.121.0 and 16.x before 16.34.0 contain an infor... |
medium | 6.5 | — | — | 2026-09-20 | 2026-09-21 |
| CVE-2026-94046 A weakness has been identified in 0215AndrewFeng ACE-MCP up to 4.10.8. |
medium | 4.3 | — | — | 2026-09-20 | 2026-09-21 |
| CVE-2026-94051 A vulnerability was found in 0717376 cowork_bench up to d943e75bc0fc8e3b27141979... |
medium | 6.3 | — | — | 2026-09-20 | 2026-09-21 |
| CVE-2026-94093 A security vulnerability has been detected in DLR-RM stable-baselines3 up to 2.9... |
medium | 6.3 | — | — | 2026-09-20 | 2026-09-21 |
| CVE-2026-94031 A vulnerability was detected in 0-Gaurav-0 nexus-mcp aed0026e7ac1f23dc940e46e9fd... |
medium | 6.3 | — | — | 2026-09-20 | 2026-09-21 |
| CVE-2026-94041 A vulnerability has been found in AdithyaYelloju Restaurant-Management-System up... |
medium | 6.3 | — | — | 2026-09-20 | 2026-09-21 |
| CVE-2026-56888 In multiple locations, there is a possible permission bypass due to side channel... |
medium | 6.2 | — | Google / android | 2026-09-15 | 2026-09-21 |
| CVE-2026-90536 WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to aut... |
medium | 5.3 | — | — | 2026-09-12 | 2026-09-21 |
| CVE-2026-90546 WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to val... |
medium | 4.3 | — | — | 2026-09-12 | 2026-09-21 |
| CVE-2026-90551 WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to val... |
medium | 5.3 | — | — | 2026-09-12 | 2026-09-21 |
| CVE-2026-90499 A security flaw has been discovered in lenve vhr 1.0-SNAPSHOT. |
medium | 5.4 | — | — | 2026-09-13 | 2026-09-21 |
| CVE-2026-90494 A flaw has been found in restify node-restify up to 12.0.0. |
medium | 5.3 | — | — | 2026-09-13 | 2026-09-21 |
| CVE-2026-56889 In multiple locations, there is a possible permission bypass due to an integer o... |
medium | 6.7 | — | Google / android | 2026-09-15 | 2026-09-21 |
| CVE-2026-83250 Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience... |
medium | 6.5 | — | — | 2026-09-15 | 2026-09-21 |
| CVE-2026-83251 Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience... |
medium | 6.5 | — | — | 2026-09-15 | 2026-09-21 |
| CVE-2026-56892 In ReadDataElement of common.c, there is a possible information disclosure due t... |
medium | 6.2 | — | Google / android | 2026-09-15 | 2026-09-21 |
| CVE-2026-83175 Vulnerability in the Oracle Application Object Library product of Oracle E-Busin... |
medium | 6.5 | — | — | 2026-09-15 | 2026-09-21 |
| CVE-2026-83198 Vulnerability in the Oracle Field Service product of Oracle E-Business Suite (co... |
medium | 5.4 | — | — | 2026-09-15 | 2026-09-21 |
| CVE-2026-56907 In VPU, there is a possible shared memory overwrite due to improper input valida... |
medium | 6.7 | — | Google / android | 2026-09-15 | 2026-09-21 |
| CVE-2026-56964 In multiple locations, there is a possible use-after-free due to a race conditio... |
medium | 6.4 | — | Google / android | 2026-09-15 | 2026-09-21 |
| CVE-2026-56958 In gf_algo_get_cached_dump_data of gf_algo.c, there is a possible out-of-bounds... |
medium | 5.5 | — | Google / android | 2026-09-15 | 2026-09-21 |
| CVE-2026-56950 In validate_ns_buf of mbu_class.rs, there is a possible information disclosure d... |
medium | 4.4 | — | Google / android | 2026-09-15 | 2026-09-21 |
| CVE-2026-56932 In Trusted Execution Environment, there is a possible memory corruption due to i... |
medium | 6.7 | — | Google / android | 2026-09-15 | 2026-09-21 |
| CVE-2026-56923 In handle_unmap_req of tipc_virtio_dev.c, there is a possible memory corruption... |
medium | 6.4 | — | Google / android | 2026-09-15 | 2026-09-21 |
| CVE-2026-56922 In CPM, there is a possible permission bypass due to a confused deputy. |
medium | 6.7 | — | Google / android | 2026-09-15 | 2026-09-21 |
| CVE-2026-56915 In bigo_worker_thread of bigo.c, there is a possible escalation of privilege due... |
medium | 6.4 | — | Google / android | 2026-09-15 | 2026-09-21 |
| CVE-2026-94138 A security flaw has been discovered in Chengdu Feiyuxing Technology Feiyu Star R... |
medium | 6.6 | — | — | 2026-09-21 | 2026-09-21 |
| CVE-2026-94151 A weakness has been identified in Omega Solution HRM OS up to 20260717. |
medium | 5.3 | — | — | 2026-09-21 | 2026-09-21 |
| CVE-2026-94103 A vulnerability has been found in RooCMS up to 1.2.2/1.3.4/1.4RC2. |
medium | 4.7 | — | — | 2026-09-21 | 2026-09-21 |
| CVE-2026-83416 Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (compo... |
medium | 4.3 | — | Oracle / coherence | 2026-09-15 | 2026-09-21 |
| CVE-2026-94028 A weakness has been identified in mealie-recipes Mealie up to 3.25.1. |
medium | 4.3 | — | — | 2026-09-20 | 2026-09-21 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.