September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,182
Critical
1,210
High
4,307
Medium
4,068
Low
456
Severity not reported
1,141
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (605), oracle (274), apple (244), adobe (197), dell (137), ibm (104), arubanetworks (101), mongodb (64), apache (53)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-73463 On affected platforms running Arista EOS, when multiple gRPC Network Security In... |
medium | 5.3 | — | — | 2026-09-16 | 2026-09-16 |
| CVE-2026-19640 On affected platforms running Arista EOS, an authenticated user with access to t... |
medium | 4.2 | — | — | 2026-09-16 | 2026-09-16 |
| CVE-2026-73436 On affected platforms running Arista EOS with OSPFv2 and OSPFv2 segment routing... |
medium | 6.5 | — | — | 2026-09-16 | 2026-09-16 |
| CVE-2026-73440 On affected platforms running Arista EOS with Simple Network Management Protocol... |
medium | 4.2 | — | — | 2026-09-16 | 2026-09-16 |
| CVE-2026-73468 A specially crafted packet can cause the premature expiry of multicast forwardin... |
medium | 6.5 | — | — | 2026-09-16 | 2026-09-16 |
| CVE-2026-73469 When specific platforms are using Arista EOS with a loose Unicast Reverse Path F... |
medium | 5.8 | — | — | 2026-09-16 | 2026-09-16 |
| CVE-2026-77190 On affected platforms running Arista EOS, an unauthenticated attacker who is net... |
medium | 6.5 | — | — | 2026-09-16 | 2026-09-16 |
| CVE-2026-84397 Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vuln... |
medium | 5.4 | — | — | 2026-09-16 | 2026-09-16 |
| CVE-2026-65402 A use after free issue was addressed with improved memory management. |
medium | 5.5 | — | Apple / ipados | 2026-09-14 | 2026-09-16 |
| CVE-2026-65405 A memory initialization issue was addressed with improved memory handling. |
medium | 5.5 | — | Apple / ipados | 2026-09-14 | 2026-09-16 |
| CVE-2026-65409 A type confusion issue was addressed with improved memory handling. |
medium | 5.5 | — | Apple / ipados | 2026-09-14 | 2026-09-16 |
| CVE-2026-84487 An integer overflow was addressed with improved input validation. |
medium | 6.5 | — | Apple / ipados | 2026-09-14 | 2026-09-16 |
| CVE-2026-84492 A race condition was addressed with improved state handling. |
medium | 4.7 | — | Apple / ipados | 2026-09-14 | 2026-09-16 |
| CVE-2026-84523 An out-of-bounds write issue was addressed with improved bounds checking. |
medium | 5.5 | — | Apple / ipados | 2026-09-14 | 2026-09-16 |
| CVE-2026-65406 A logic issue was addressed with improved validation. |
medium | 5.5 | — | Apple / ipados | 2026-09-14 | 2026-09-16 |
| CVE-2026-65395 An out-of-bounds write issue was addressed with improved bounds checking. |
medium | 6.5 | — | Apple / ipados | 2026-09-14 | 2026-09-16 |
| CVE-2026-84612 An authorization issue was addressed with improved access control. |
medium | 5.5 | — | Apple / ipados | 2026-09-14 | 2026-09-16 |
| CVE-2026-84630 A race condition was addressed with improved state handling. |
medium | 4.7 | — | Apple / ipados | 2026-09-14 | 2026-09-16 |
| CVE-2026-86882 An out-of-bounds write issue was addressed with improved bounds checking. |
medium | 6.5 | — | Apple / ipados | 2026-09-14 | 2026-09-16 |
| CVE-2026-84583 A permissions issue was addressed with additional restrictions. |
medium | 5.5 | — | Apple / ipados | 2026-09-14 | 2026-09-16 |
| CVE-2026-85732 oras-go is a Go library for managing OCI artifacts. |
medium | 4.7 | — | — | 2026-09-16 | 2026-09-16 |
| CVE-2026-9338 IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to a denial of servi... |
medium | 5.3 | — | Ibm / websphere application server | 2026-09-10 | 2026-09-16 |
| CVE-2026-88035 A size check in the client-side authentication path of the MongoDB C Driver can... |
medium | 5.5 | — | Mongodb / c driver | 2026-09-10 | 2026-09-16 |
| CVE-2026-84536 An integer underflow was addressed with improved input validation. |
medium | 6.5 | — | Apple / macos | 2026-09-14 | 2026-09-16 |
| CVE-2026-84517 An integer overflow was addressed with improved input validation. |
medium | 5.5 | — | Apple / macos | 2026-09-14 | 2026-09-16 |
| CVE-2026-84555 An authorization issue was addressed with improved access control. |
medium | 5.5 | — | Apple / macos | 2026-09-14 | 2026-09-16 |
| CVE-2026-91842 A vulnerability has been found in OpenBankProject OBP-API up to 1.10.1. |
medium | 4.1 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-92364 A vulnerability has been found in itsourcecode Leave Management System 1.0. |
medium | 6.3 | — | — | 2026-09-16 | 2026-09-16 |
| CVE-2026-92383 A security vulnerability has been detected in PbootCMS up to 3.2.24. |
medium | 4.3 | — | — | 2026-09-16 | 2026-09-16 |
| CVE-2026-64717 A race condition was addressed with improved state handling. |
medium | 6.3 | — | Apple / ipados | 2026-09-14 | 2026-09-16 |
| CVE-2026-69874 Untrusted pointer dereference in Windows ALPC allows an authorized attacker to e... |
medium | 6.4 | — | Microsoft / windows 10 1809 | 2026-09-08 | 2026-09-16 |
| CVE-2026-64714 A memory corruption issue was addressed with improved bounds checking. |
medium | 5.5 | — | Apple / ipados | 2026-09-14 | 2026-09-16 |
| CVE-2026-81910 Concrete CMS 9 through 9.5.2 is vulnerable to Server-Side Template Injection (SS... |
medium | 6.5 | — | Concretecms / concrete cms | 2026-09-11 | 2026-09-16 |
| CVE-2026-69862 Out-of-bounds read in Windows Wireless Wide Area Network Service allows an autho... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-16 |
| CVE-2026-90555 vLLM versions before 0.28.0 fail to validate audio sample rate headers in the tr... |
medium | 6.5 | — | Vllm / vllm | 2026-09-12 | 2026-09-16 |
| CVE-2026-64756 A path handling issue was addressed with improved validation. |
medium | 5.5 | — | Apple / ipados | 2026-09-14 | 2026-09-16 |
| CVE-2026-65380 An issue existed in the handling of snapshots. |
medium | 5.5 | — | Apple / macos | 2026-09-14 | 2026-09-16 |
| CVE-2026-90831 A vulnerability was detected in GNU Binutils 2.47. |
medium | 5.3 | — | Gnu / binutils | 2026-09-14 | 2026-09-16 |
| CVE-2026-90807 A vulnerability was found in nanocoai NanoClaw up to 2.1.17. |
medium | 6.3 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-90812 A security vulnerability has been detected in cosmicstack-labs mercury-agent up... |
medium | 4.3 | — | — | 2026-09-14 | 2026-09-16 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.