September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,182
Critical
1,210
High
4,307
Medium
4,068
Low
456
Severity not reported
1,141
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (605), oracle (274), apple (244), adobe (197), dell (137), ibm (104), arubanetworks (101), mongodb (64), apache (53)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-83076 Vulnerability in the Oracle HR Intelligence product of Oracle E-Business Suite (... |
medium | 6.8 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-92081 fastify is a fast and low-overhead web framework for Node.js. |
medium | 5.9 | — | — | 2026-09-16 | 2026-09-16 |
| CVE-2026-43741 A logic issue was addressed with improved state management. |
medium | 5.5 | — | Apple / macos | 2026-09-14 | 2026-09-16 |
| CVE-2026-87727 a-blog cms Ver. |
medium | 6.5 | — | — | 2026-09-11 | 2026-09-16 |
| CVE-2026-82763 Cross-site scripting vulnerability exists in Contec FX5000 series, FX4000 series... |
medium | 5.4 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-82764 Cross-site request forgery vulnerability exists in multiple Contec products. |
medium | 4.3 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-82767 Cross-site scripting vulnerability exists in SGA1000. |
medium | 5.2 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-82769 Cross-site scripting vulnerability exists in Contec RP-WAH-SR Series. |
medium | 5.4 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-82771 Cross-site scripting vulnerability exists in Contec EC1000 series. |
medium | 5.4 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-82773 Cross-site scripting vulnerability exists in CONPROSYS M2M Gateway Series and CO... |
medium | 6.1 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-82775 An exposure of information through directory listing issue exists in CONPROSYS M... |
medium | 4.3 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-82776 Cross-site scripting vulnerability exists in CONPROSYS PAC Series. |
medium | 6.1 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-82778 An exposure of information through directory listing issue exists in CONPROSYS P... |
medium | 4.3 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-82781 Cross-site scripting vulnerability exists in CONPROSYS nano Series. |
medium | 5.4 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-82782 Out-of-bounds write vulnerability exists in CONPROSYS nano Series. |
medium | 4.3 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-82783 Plaintext storage of a password issue exists in CONPROSYS nano Series . |
medium | 4.2 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-82784 Missing authentication for critical function vulnerability exists in Remote I/O... |
medium | 6.5 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-82785 Stack-based buffer overflow vulnerability exists in Remote I/O Coupler Unit (Ser... |
medium | 4.3 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-82786 Insufficiently protected credentials issue exists in Remote I/O Coupler Unit (Se... |
medium | 6.3 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-82788 Cross-site scripting vulnerability exists in CPSL-08P1EN. |
medium | 6.1 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-82790 Cross-site scripting vulnerability exists in PC-HELPER Wireless I/O DIO-0404RY-L... |
medium | 5.4 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-82792 Cross-site scripting vulnerability exists in Contec CAN 2.0B Communication Wirel... |
medium | 5.2 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-82795 SolarView Compact contains a cross-site scripting vulnerability in Schedule Sett... |
medium | 5.4 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-82796 SolarView Compact contains a cross-site scripting vulnerability in Image Managem... |
medium | 5.4 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-85125 The Android application "YAMAP -Social Trekking GPS App" contains an improper ac... |
medium | 5.4 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-81326 QND uses a hard-coded cryptographic key, which may allow a local attacker who is... |
medium | 5.5 | — | — | 2026-09-16 | 2026-09-16 |
| CVE-2026-89156 PCRE2 before 10.48 has a pcre2_match out-of-bounds read after a JIT fallback whe... |
medium | 5.9 | — | Pcre / pcre2 | 2026-09-11 | 2026-09-16 |
| CVE-2026-69642 Improper neutralization of input during web page generation ('cross-site scripti... |
medium | 6.1 | — | Microsoft / skype for business server | 2026-09-08 | 2026-09-16 |
| CVE-2026-66308 Out-of-bounds read in Skype for Business allows an authorized attacker to deny s... |
medium | 6.5 | — | Microsoft / skype for business server | 2026-09-08 | 2026-09-16 |
| CVE-2026-15887 IBM WebSphere Application Server 9.0, and 8.5 is affected by blind server-side r... |
medium | 5.4 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-16189 IBM WebSphere Application Server 9.0, and 8.5 could allow a remote attacker to i... |
medium | 4.8 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-16435 IBM WebSphere Application Server 9.0, and 8.5 is affected by an authentication b... |
medium | 5.9 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-18065 IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote unauthenticated attacker to ga... |
medium | 5.3 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-13277 IBM Verify Identity Access could allow a remote attacker to conduct phishing att... |
medium | 4.7 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-19280 IBM i 7.6, 7.5, 7.4, and 7.3 could allow a denial of service as a result of a bu... |
medium | 5.2 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-78415 IBM Sterling Secure Proxy 6.2.0.0 through 6.2.1.2 could allow a remote authentic... |
medium | 5.4 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-12758 IBM Cloud Pak for Business Automation could allow a remote attacker to bypass au... |
medium | 5.4 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-12759 IBM Cloud Pak for Business Automation could allow an authenticated user to cause... |
medium | 6.5 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-13265 IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 throu... |
medium | 6.8 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-11864 IBM Cloud Pak for Business Automation 26.0.0 through 26.0.0 Interim Fix 001, 25.... |
medium | 6.5 | — | — | 2026-09-15 | 2026-09-16 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.