September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,171
Critical
1,210
High
4,305
Medium
4,059
Low
456
Severity not reported
1,141
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (605), oracle (274), apple (244), adobe (197), dell (137), ibm (104), arubanetworks (101), mongodb (64), apache (53)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-87599 Improper input validation in Interstitials in Google Chrome prior to 153.0.8010.... |
medium | 5.4 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87615 Race condition in Payments in Google Chrome prior to 153.0.8010.36 allowed a rem... |
medium | 5.4 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-81991 Acrobat Reader is affected by an out-of-bounds read vulnerability that could lea... |
medium | 5.5 | — | Adobe / acrobat | 2026-09-08 | 2026-09-10 |
| CVE-2026-87624 UI misrepresentation in Passwords in Google Chrome on on Android prior to 153.0.... |
medium | 4.2 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87630 Integer overflow in WebRTC in Google Chrome prior to 153.0.8010.36 allowed a rem... |
medium | 4.3 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-81993 Acrobat Reader is affected by a Heap-based Buffer Overflow vulnerability that co... |
medium | 5.5 | — | Adobe / acrobat | 2026-09-08 | 2026-09-10 |
| CVE-2026-87747 The Enterprise Cloud Database developed by Ragic has an Arbitrary File Read vuln... |
medium | 4.9 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-81646 Out-of-bounds read vulnerability in the graphics module. |
medium | 5.9 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-81647 Out-of-bounds read vulnerability in the graphics module. |
medium | 5.3 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-81644 DoS vulnerability in the preview service module. |
medium | 4.3 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-41987 Permission control vulnerability in the app management module. |
medium | 6.2 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-49309 Permission control vulnerability in the Settings module. |
medium | 4.8 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-49311 Permission control vulnerability in the event notification module.Impact: Succes... |
medium | 6.2 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-49312 Permission control vulnerability in the window module. |
medium | 4.0 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-49313 Permission control vulnerability in the app lock module. |
medium | 5.5 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-84306 Filament is a collection of full-stack components for accelerated Laravel develo... |
medium | 6.5 | — | — | 2026-09-01 | 2026-09-09 |
| CVE-2026-84308 phpseclib is a PHP secure communications library. |
medium | 6.3 | — | — | 2026-09-01 | 2026-09-09 |
| CVE-2026-63435 Mail is an internet library for Ruby designed to handle email generation, parsin... |
medium | 5.3 | — | — | 2026-09-01 | 2026-09-09 |
| CVE-2026-84363 Hono is a Web application framework that provides support for any JavaScript run... |
medium | 5.9 | — | — | 2026-09-01 | 2026-09-09 |
| CVE-2026-84364 Hono is a Web application framework that provides support for any JavaScript run... |
medium | 5.3 | — | — | 2026-09-01 | 2026-09-09 |
| CVE-2026-84365 Hono is a Web application framework that provides support for any JavaScript run... |
medium | 6.5 | — | — | 2026-09-01 | 2026-09-09 |
| CVE-2026-84369 SVGO, short for SVG Optimizer, is a Node.js library and command-line application... |
medium | 6.1 | — | — | 2026-09-01 | 2026-09-09 |
| CVE-2026-84371 ApostropheCMS is an open-source Node.js content management system, and sanitize-... |
medium | 5.4 | — | — | 2026-09-01 | 2026-09-09 |
| CVE-2026-84373 Vitest is a testing framework powered by Vite. |
medium | 5.9 | — | — | 2026-09-01 | 2026-09-09 |
| CVE-2026-55221 Boruta is a standalone authorization server that aims to implement OAuth 2.0 and... |
medium | 6.5 | — | — | 2026-09-02 | 2026-09-09 |
| CVE-2026-50554 Note Mark is an open-source note-taking application. |
medium | 5.3 | — | — | 2026-09-03 | 2026-09-09 |
| CVE-2026-75602 OpenList a file list program that supports multiple storage. |
medium | 6.5 | — | — | 2026-09-03 | 2026-09-09 |
| CVE-2026-71429 stream-json is a micro-library of stream components for processing JSON and JSON... |
medium | 6.2 | — | — | 2026-09-03 | 2026-09-09 |
| CVE-2026-53760 Admidio is an open-source user management solution. |
medium | 5.2 | — | — | 2026-09-04 | 2026-09-09 |
| CVE-2026-49830 DSpace open source software is a repository application which provides durable a... |
medium | 4.4 | — | — | 2026-09-02 | 2026-09-09 |
| CVE-2026-49831 DSpace open source software is a repository application which provides durable a... |
medium | 5.5 | — | — | 2026-09-02 | 2026-09-09 |
| CVE-2026-49833 DSpace open source software is a repository application which provides durable a... |
medium | 5.5 | — | — | 2026-09-02 | 2026-09-09 |
| CVE-2026-84377 LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) fo... |
medium | 6.5 | — | — | 2026-09-02 | 2026-09-09 |
| CVE-2026-84378 HTTPX2 is a next generation HTTP client for Python. |
medium | 5.9 | — | — | 2026-09-02 | 2026-09-09 |
| CVE-2026-84379 HTTPX2 is a next generation HTTP client for Python. |
medium | 5.3 | — | — | 2026-09-02 | 2026-09-09 |
| CVE-2026-84380 HTTPX2 is a next generation HTTP client for Python. |
medium | 5.6 | — | — | 2026-09-02 | 2026-09-09 |
| CVE-2026-52832 Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. |
medium | 4.9 | — | — | 2026-09-02 | 2026-09-09 |
| CVE-2026-53636 Open edX Platform enables the authoring and delivery of online learning at any s... |
medium | 4.7 | — | — | 2026-09-02 | 2026-09-09 |
| CVE-2026-55421 Open edX Platform enables the authoring and delivery of online learning at any s... |
medium | 6.8 | — | — | 2026-09-02 | 2026-09-09 |
| CVE-2026-53637 Sylius is an Open Source eCommerce Framework on Symfony. |
medium | 6.5 | — | — | 2026-09-08 | 2026-09-09 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.