September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,171
Critical
1,210
High
4,305
Medium
4,059
Low
456
Severity not reported
1,141
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (605), oracle (274), apple (244), adobe (197), dell (137), ibm (104), arubanetworks (101), mongodb (64), apache (53)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-17442 IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, and 12.0.1.0 through 12.0.... |
medium | 5.5 | — | Ibm / app connect enterprise | 2026-09-04 | 2026-09-10 |
| CVE-2026-18076 IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to caus... |
medium | 6.5 | — | Ibm / i | 2026-09-04 | 2026-09-10 |
| CVE-2026-14470 IBM Langflow OSS 1.0.0 through 1.10.2 could allow an authenticated attacker to t... |
medium | 6.5 | — | Langflow / langflow | 2026-09-04 | 2026-09-10 |
| CVE-2026-79910 Acrobat Reader is affected by an out-of-bounds read vulnerability that could lea... |
medium | 5.5 | — | Adobe / acrobat | 2026-09-08 | 2026-09-10 |
| CVE-2026-84697 Mailpit's IsInternalIP deny list function fails to block the Azure WireServer ad... |
medium | 5.3 | — | — | 2026-09-02 | 2026-09-10 |
| CVE-2026-85092 LiME through 1.12.0 fails to validate the disk acquisition output path and does... |
medium | 6.6 | — | — | 2026-09-03 | 2026-09-10 |
| CVE-2026-85093 Cheshire Cat AI's GET /memory/collections/{collection_id}/points endpoint fails... |
medium | 6.5 | — | — | 2026-09-03 | 2026-09-10 |
| CVE-2026-85622 AppFlowy-Cloud through 0.9.64 fails to validate workspace membership when establ... |
medium | 5.3 | — | — | 2026-09-04 | 2026-09-10 |
| CVE-2026-85624 Blinko 1.8.7 contains a cross-user private note disclosure vulnerability in the... |
medium | 6.5 | — | — | 2026-09-04 | 2026-09-10 |
| CVE-2026-85692 Nightingale (n9e), as of commit 8362cbe (main branch, confirmed 2026-08-27), con... |
medium | 6.5 | — | — | 2026-09-04 | 2026-09-10 |
| CVE-2026-86777 AlchemyCMS versions before 7.4.16 and 8.x before 8.3.6 fail to authorize access... |
medium | 5.3 | — | — | 2026-09-09 | 2026-09-10 |
| CVE-2026-81330 The C6 ear camera transmits live video to the EarVision Android application over... |
medium | 6.5 | — | — | 2026-09-09 | 2026-09-10 |
| CVE-2026-53956 Rattler is a library that provides common functionality used within the conda ec... |
medium | 5.4 | — | — | 2026-09-09 | 2026-09-10 |
| CVE-2026-73788 A vulnerability in the ClearPass OnGuard agent could allow an authenticated remo... |
medium | 6.5 | — | — | 2026-09-09 | 2026-09-10 |
| CVE-2026-73789 A vulnerability in the web-based management interface of CPPM guest account mana... |
medium | 5.3 | — | — | 2026-09-09 | 2026-09-10 |
| CVE-2026-66632 Unauthenticated Content Injection in Simple Cloudflare Turnstile <= 1.42.1 versi... |
medium | 6.5 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-81788 Subscriber Broken Access Control in IMPress for IDX Broker <= 3.3.0 versions. |
medium | 6.3 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-84698 PX4 Autopilot contains a heap buffer overflow vulnerability in the sd_bench comm... |
medium | 6.5 | — | — | 2026-09-02 | 2026-09-10 |
| CVE-2026-86097 PX4 Autopilot through 1.17.0 contains a null pointer dereference vulnerability i... |
medium | 6.5 | — | — | 2026-09-04 | 2026-09-10 |
| CVE-2026-42808 An issue was discovered in Bosch Sensortec COINES_SDK versions 2.0 through 2.11. |
medium | 6.8 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-80160 Acrobat Reader is affected by an out-of-bounds read vulnerability that could lea... |
medium | 5.5 | — | Adobe / acrobat | 2026-09-08 | 2026-09-10 |
| CVE-2026-87641 Race condition in Browser in Google Chrome prior to 153.0.8010.36 allowed a remo... |
medium | 4.2 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87812 SiYuan before v3.8.2 contains a stored cross-site scripting vulnerability in Baz... |
medium | 6.8 | — | — | 2026-09-09 | 2026-09-10 |
| CVE-2026-80162 Acrobat Reader is affected by a Use After Free vulnerability that could lead to... |
medium | 5.5 | — | Adobe / acrobat | 2026-09-08 | 2026-09-10 |
| CVE-2026-86198 PocketMine-MP versions before 5.44.2 fail to properly validate multiple Resource... |
medium | 4.2 | — | — | 2026-09-09 | 2026-09-10 |
| CVE-2026-85981 The administrative panel of the Auth0 AD/LDAP Connector (versions 6.5.0 and earl... |
medium | 6.7 | — | — | 2026-09-08 | 2026-09-10 |
| CVE-2026-85543 Some Wi-Fi series camera products have insufficient permission validation on cer... |
medium | 4.3 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-84685 The react-native-auth0 SDK's web platform implementation does not scope its in-m... |
medium | 6.5 | — | — | 2026-09-08 | 2026-09-10 |
| CVE-2026-81984 Acrobat Reader is affected by a Use After Free vulnerability that could lead to... |
medium | 5.5 | — | Adobe / acrobat | 2026-09-08 | 2026-09-10 |
| CVE-2026-81994 Acrobat Reader is affected by an Improperly Controlled Modification of Object Pr... |
medium | 6.3 | — | Adobe / acrobat | 2026-09-08 | 2026-09-10 |
| CVE-2026-78635 The Okta Privileged Access client URL handler does not insert an option terminat... |
medium | 5.0 | — | — | 2026-09-08 | 2026-09-10 |
| CVE-2026-78622 The Okta Verify for Windows uninstaller does not verify whether the user data di... |
medium | 6.0 | — | — | 2026-09-08 | 2026-09-10 |
| CVE-2026-61608 SolidInvoice is an open-source invoicing platform. |
medium | 6.8 | — | — | 2026-09-04 | 2026-09-10 |
| CVE-2026-61614 SolidInvoice is an open-source invoicing platform. |
medium | 5.9 | — | — | 2026-09-04 | 2026-09-10 |
| CVE-2026-61688 SolidInvoice is an open-source invoicing platform. |
medium | 6.5 | — | — | 2026-09-04 | 2026-09-10 |
| CVE-2026-19840 The Notiqoo WordPress plugin before 1.4.14 does not have capability checks on se... |
medium | 6.5 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-81635 A cross-site scripting vulnerability exists in SHIRASAGI, which may allow an att... |
medium | 5.4 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-82582 An authorization bypass vulnerability exists in SHIRASAGI through a user-control... |
medium | 4.3 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-88268 GeoVision GV-LPC2211
V1.13 contains an authenticated stack buffer overflow in SS... |
medium | 6.5 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-88269 GeoVision GV-LPC2211 V1.13 allows a Guest user to retrieve persistent device con... |
medium | 6.5 | — | — | 2026-09-10 | 2026-09-10 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.