September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,186
Critical
1,210
High
4,308
Medium
4,071
Low
456
Severity not reported
1,141
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (605), oracle (274), apple (244), adobe (197), dell (137), ibm (104), arubanetworks (101), mongodb (64), apache (53)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-87169 Vulnerability in the Oracle Contract Lifecycle Management for Public Sector prod... |
medium | 6.1 | — | — | 2026-09-15 | 2026-09-18 |
| CVE-2026-86739 Snipe-IT 8.6.3 and earlier do not check the return value of Storage::put() when... |
medium | 6.5 | — | Snipeitapp / snipe-it | 2026-09-09 | 2026-09-18 |
| CVE-2026-86255 wger before 2.5 fails to validate the maximum duration of routine date ranges, a... |
medium | 6.5 | — | — | 2026-09-06 | 2026-09-18 |
| CVE-2026-86416 ILIAS versions before 9.23, 10.11, and 11.4 contain an authorization bypass vuln... |
medium | 5.4 | — | — | 2026-09-07 | 2026-09-18 |
| CVE-2026-86176 NetBox through 4.7.0 fails to properly scope user-private records in REST and Gr... |
medium | 4.3 | — | — | 2026-09-05 | 2026-09-18 |
| CVE-2026-18555 The Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots pl... |
medium | 6.1 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-26947 Dell ECS versions 3.8.1.0 through 3.8.1.7, and Dell ObjectScale versions prior t... |
medium | 6.7 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-92839 Canva Desktop before v1.125.0 performed double decoding in the deeplink handler. |
medium | 4.3 | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-84525 A logging issue was addressed with improved data redaction. |
medium | 5.5 | — | Apple / macos | 2026-09-14 | 2026-09-18 |
| CVE-2026-65403 This issue was addressed with improved checks. |
medium | 5.5 | — | Apple / ipados | 2026-09-14 | 2026-09-18 |
| CVE-2026-57006 In acfw_ffa.c, there is a possible secret read due to a logic error in the code. |
medium | 4.4 | — | Google / android | 2026-09-15 | 2026-09-18 |
| CVE-2026-65399 A file quarantine bypass was addressed with additional checks. |
medium | 4.4 | — | Apple / ipados | 2026-09-14 | 2026-09-18 |
| CVE-2026-86869 An out-of-bounds write issue was addressed with improved bounds checking. |
medium | 6.5 | — | Apple / ipados | 2026-09-14 | 2026-09-18 |
| CVE-2026-56989 In multiple locations, there is a possible out-of-bounds write due to a missing... |
medium | 6.7 | — | Google / android | 2026-09-15 | 2026-09-18 |
| CVE-2026-56992 In multiple files, there is a possible permission bypass due to a confused deput... |
medium | 6.7 | — | Google / android | 2026-09-15 | 2026-09-18 |
| CVE-2026-84636 An authorization issue was addressed with improved state management. |
medium | 5.5 | — | Apple / ipados | 2026-09-14 | 2026-09-18 |
| CVE-2026-57035 In multiple locations, there is a possible out-of-bounds write due to a missing... |
medium | 6.7 | — | Google / android | 2026-09-15 | 2026-09-18 |
| CVE-2026-57042 In multiple functions of DreamPickerReceiver.kt, there is a possible permission... |
medium | 6.7 | — | Google / android | 2026-09-15 | 2026-09-18 |
| CVE-2026-84567 The issue was addressed with improved memory handling. |
medium | 5.5 | — | Apple / macos | 2026-09-14 | 2026-09-18 |
| CVE-2026-84564 An uninitialized memory issue was addressed with improved memory initialization. |
medium | 4.3 | — | Apple / ipados | 2026-09-14 | 2026-09-18 |
| CVE-2026-84531 An out-of-bounds write issue was addressed with improved bounds checking. |
medium | 6.2 | — | Apple / ipados | 2026-09-14 | 2026-09-18 |
| CVE-2026-84527 A logging issue was addressed with improved data redaction. |
medium | 5.5 | — | Apple / ipados | 2026-09-14 | 2026-09-18 |
| CVE-2026-93383 Information leak in Permissions in Google Chrome prior to 153.0.8010.52 allowed... |
medium | 4.3 | — | Google / chrome | 2026-09-17 | 2026-09-18 |
| CVE-2026-93385 Information leak in Paint in Google Chrome prior to 153.0.8010.52 allowed a remo... |
medium | 6.5 | — | Google / chrome | 2026-09-17 | 2026-09-18 |
| CVE-2026-93386 UI misrepresentation in WebAppInstalls in Google Chrome prior to 153.0.8010.52 a... |
medium | 5.4 | — | Google / chrome | 2026-09-17 | 2026-09-18 |
| CVE-2026-83347 Vulnerability in the Oracle Net Services component of Oracle Database Server. |
medium | 6.5 | — | — | 2026-09-15 | 2026-09-18 |
| CVE-2026-93387 Improper state validation in Skia in Google Chrome prior to 153.0.8010.52 allowe... |
medium | 4.3 | — | Google / chrome | 2026-09-17 | 2026-09-18 |
| CVE-2026-84514 This issue was addressed with additional entitlement checks. |
medium | 5.5 | — | Apple / macos | 2026-09-14 | 2026-09-18 |
| CVE-2026-84513 A privacy issue was addressed with improved private data redaction for log entri... |
medium | 5.5 | — | Apple / ipados | 2026-09-14 | 2026-09-18 |
| CVE-2026-84510 A heap buffer overflow was addressed with improved bounds checking. |
medium | 6.5 | — | Apple / ipados | 2026-09-14 | 2026-09-18 |
| CVE-2026-86870 A heap buffer overflow was addressed with improved bounds checking. |
medium | 6.5 | — | Apple / ipados | 2026-09-14 | 2026-09-18 |
| CVE-2026-84574 A permissions issue was addressed with improved state management. |
medium | 4.4 | — | Apple / macos | 2026-09-14 | 2026-09-18 |
| CVE-2026-81921 Concrete CMS 8.5.3 through 9.5.2 enabled the OAuth 2.0 refresh-token grant using... |
medium | 5.4 | — | Concretecms / concrete cms | 2026-09-15 | 2026-09-18 |
| CVE-2026-81920 Concrete CMS below 9.5.3 was vulnerable to Cross-Site Request Forgery in the das... |
medium | 4.3 | — | Concretecms / concrete cms | 2026-09-15 | 2026-09-18 |
| CVE-2026-81919 Concrete CMS below 9.5.3 did not validate an anti-CSRF token on the block-arrang... |
medium | 4.3 | — | Concretecms / concrete cms | 2026-09-15 | 2026-09-18 |
| CVE-2026-81916 Concrete CMS before 9.5.3 evaluated the authorization check for an Express entry... |
medium | 4.3 | — | Concretecms / concrete cms | 2026-09-11 | 2026-09-18 |
| CVE-2026-81917 Concrete CMS below 9.5.3 does not apply HTML output escaping to the file descrip... |
medium | 5.4 | — | Concretecms / concrete cms | 2026-09-11 | 2026-09-18 |
| CVE-2026-91707 The The Divi theme for WordPress is vulnerable to arbitrary shortcode execution... |
medium | 5.3 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-92561 The Booking Calendar plugin for WordPress is vulnerable to Reflected Cross-Site... |
medium | 6.1 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-89064 The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to Ins... |
medium | 5.3 | — | — | 2026-09-17 | 2026-09-18 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.