September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,186
Critical
1,210
High
4,308
Medium
4,071
Low
456
Severity not reported
1,141
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (605), oracle (274), apple (244), adobe (197), dell (137), ibm (104), arubanetworks (101), mongodb (64), apache (53)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-11928 IBM Verify Identity Access is vulnerable to a buffer overflow attack. |
critical | 9.8 | — | — | 2026-09-15 | 2026-09-17 |
| CVE-2026-92941 vm2 versions from 3.11.3 before 3.11.7 expose the host tls module to NodeVM sand... |
critical | 10.0 | — | — | 2026-09-17 | 2026-09-17 |
| CVE-2026-92947 vm2 before 3.11.7 exposes Node's shared Buffer pool to sandboxed code, allowing... |
critical | 10.0 | — | — | 2026-09-17 | 2026-09-17 |
| CVE-2026-83229 Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (compone... |
critical | 9.1 | — | — | 2026-09-15 | 2026-09-17 |
| CVE-2026-83103 Vulnerability in the Oracle Forms product of Oracle Fusion Middleware (component... |
critical | 9.1 | — | — | 2026-09-15 | 2026-09-17 |
| CVE-2026-83105 Vulnerability in the Oracle Forms product of Oracle Fusion Middleware (component... |
critical | 9.0 | — | — | 2026-09-15 | 2026-09-17 |
| CVE-2026-83107 Vulnerability in the Oracle Forms product of Oracle Fusion Middleware (component... |
critical | 9.1 | — | — | 2026-09-15 | 2026-09-17 |
| CVE-2026-83064 Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware... |
critical | 9.1 | — | — | 2026-09-15 | 2026-09-17 |
| CVE-2026-83058 Vulnerability in the Oracle Internet Directory product of Oracle Fusion Middlewa... |
critical | 9.9 | — | — | 2026-09-15 | 2026-09-17 |
| CVE-2026-83056 Vulnerability in the Oracle Internet Directory product of Oracle Fusion Middlewa... |
critical | 9.9 | — | — | 2026-09-15 | 2026-09-17 |
| CVE-2026-83057 Vulnerability in the Oracle Internet Directory product of Oracle Fusion Middlewa... |
critical | 9.9 | — | — | 2026-09-15 | 2026-09-17 |
| CVE-2026-83055 Vulnerability in the Oracle Internet Directory product of Oracle Fusion Middlewa... |
critical | 9.9 | — | — | 2026-09-15 | 2026-09-17 |
| CVE-2026-92955 vm2 before 3.11.8 contains a sandbox escape vulnerability in NodeVM that allows... |
critical | 10.0 | — | — | 2026-09-17 | 2026-09-17 |
| CVE-2026-92960 vm2 before 3.11.6 fails to restrict access to os and dns builtins under the buil... |
critical | 10.0 | — | — | 2026-09-17 | 2026-09-17 |
| CVE-2026-92934 vm2 before 3.11.8 contains an incomplete fix for Error.cause sanitization that a... |
critical | 9.0 | — | — | 2026-09-17 | 2026-09-17 |
| CVE-2026-92939 vm2 3.11.3 through 3.11.6 exposes the host Node.js crypto module to a NodeVM san... |
critical | 9.9 | — | — | 2026-09-17 | 2026-09-17 |
| CVE-2026-57139 PraisonAI is a multi-agent teams system. |
critical | 9.8 | — | — | 2026-09-15 | 2026-09-17 |
| CVE-2026-57147 PraisonAI is a multi-agent teams system. |
critical | 9.8 | — | — | 2026-09-15 | 2026-09-17 |
| CVE-2026-83282 Vulnerability in the Oracle Business Intelligence Enterprise Edition product of... |
critical | 9.9 | — | — | 2026-09-15 | 2026-09-17 |
| CVE-2026-83260 Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component:... |
critical | 9.1 | — | — | 2026-09-15 | 2026-09-17 |
| CVE-2026-83268 Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component:... |
critical | 9.1 | — | — | 2026-09-15 | 2026-09-17 |
| CVE-2026-83196 Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (compone... |
critical | 9.1 | — | — | 2026-09-15 | 2026-09-17 |
| CVE-2026-57138 PraisonAI is a multi-agent teams system. |
critical | 9.9 | — | — | 2026-09-15 | 2026-09-17 |
| CVE-2026-91718 Use after free in Core in Google Chrome prior to 153.0.8010.47 allowed a remote... |
critical | 9.6 | — | Google / chrome | 2026-09-15 | 2026-09-17 |
| CVE-2026-91716 Use after free in Auth in Google Chrome prior to 153.0.8010.47 allowed a remote... |
critical | 9.6 | — | Google / chrome | 2026-09-15 | 2026-09-17 |
| CVE-2026-91710 Use after free in WebAppInstalls in Google Chrome prior to 153.0.8010.47 allowed... |
critical | 9.6 | — | Google / chrome | 2026-09-15 | 2026-09-17 |
| CVE-2026-76420 A vulnerability in the internal configuration of the Apache JServ Protocol (AJP)... |
critical | 9.0 | — | — | 2026-09-16 | 2026-09-17 |
| CVE-2026-76423 A vulnerability in the REST API of Cisco ISE and Cisco ISE-PIC could allow an un... |
critical | 10.0 | — | — | 2026-09-16 | 2026-09-17 |
| CVE-2026-73447 A privileged attacker can exploit certain operation to execute arbitrary command... |
critical | 9.1 | — | — | 2026-09-16 | 2026-09-17 |
| CVE-2026-73456 Under certain circumstances on affected platforms running Arista EOS with gRPC N... |
critical | 10.0 | — | — | 2026-09-16 | 2026-09-17 |
| CVE-2026-20307 A vulnerability in the web-based management interface of Cisco ISE could allow a... |
critical | 9.9 | — | — | 2026-09-16 | 2026-09-17 |
| CVE-2026-20176 A vulnerability in Cisco ISE could allow an authenticated, remote attacker to ex... |
critical | 9.1 | — | — | 2026-09-16 | 2026-09-17 |
| CVE-2026-20211 A vulnerability in Cisco ISE could allow an authenticated, remote attacker to ex... |
critical | 9.1 | — | — | 2026-09-16 | 2026-09-17 |
| CVE-2026-83020 Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion... |
critical | 10.0 | — | — | 2026-09-15 | 2026-09-17 |
| CVE-2026-73453 An unauthenticated P4Runtime (Programming Protocol-Independent Packet Processors... |
critical | 10.0 | — | — | 2026-09-16 | 2026-09-17 |
| CVE-2026-73437 On affected platforms running Arista EOS with Dynamic Host Configuration Protoco... |
critical | 9.6 | — | — | 2026-09-15 | 2026-09-17 |
| CVE-2026-20305 A vulnerability in the diagnostic tools of Cisco ISE and ISE-PIC could allow an... |
critical | 9.1 | — | — | 2026-09-16 | 2026-09-17 |
| CVE-2026-20306 A vulnerability in the REST API of Cisco ISE and ISE-PIC could allow an authenti... |
critical | 9.1 | — | — | 2026-09-16 | 2026-09-17 |
| CVE-2026-81046 Dell ThinOS 10, versions prior to 2605_10.2616, contain a Protection Mechanism F... |
critical | 9.4 | — | Dell / thinos | 2026-09-10 | 2026-09-16 |
| CVE-2026-81467 Dell ThinOS 10, versions prior to 2605_10. |
critical | 9.8 | — | Dell / thinos | 2026-09-10 | 2026-09-16 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.