September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,152
Critical
1,210
High
4,303
Medium
4,042
Low
456
Severity not reported
1,141
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (605), oracle (274), apple (244), adobe (197), dell (137), ibm (104), arubanetworks (101), mongodb (64), apache (53)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-85704 A security flaw has been discovered in ramon-victor freegpt-webui up to 098db3df... |
low | 3.7 | — | — | 2026-09-04 | 2026-09-10 |
| CVE-2026-87539 Observable discrepancy in Network in Google Chrome prior to 153.0.8010.36 allowe... |
low | 3.1 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-17483 IBM Db2 Mirror for i 7.4, 7.5, and 7.6 IBM i could allow a local attacker to del... |
low | 3.3 | — | Ibm / db2 mirror for i | 2026-09-04 | 2026-09-10 |
| CVE-2026-84307 Filament is a collection of full-stack components for accelerated Laravel develo... |
low | 3.7 | — | — | 2026-09-01 | 2026-09-09 |
| CVE-2026-84367 joi is a schema description language and data validator for JavaScript. |
low | 3.7 | — | — | 2026-09-01 | 2026-09-09 |
| CVE-2026-84368 joi is a schema description language and data validator for JavaScript. |
low | 3.7 | — | — | 2026-09-01 | 2026-09-09 |
| CVE-2026-87456 Uninitialized resource in Media in Google Chrome prior to 153.0.8010.36 allowed... |
low | 3.4 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-87434 Missing authorization in CORS in Google Chrome prior to 153.0.8010.36 allowed a... |
low | 3.1 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-87647 Uninitialized resource in GPU in Google Chrome prior to 153.0.8010.36 allowed a... |
low | 3.4 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-87576 Uninitialized resource in GPU in Google Chrome on on Android prior to 153.0.8010... |
low | 3.4 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-87657 Use after free in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote at... |
low | 3.1 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-87614 Incorrect authorization in ServiceWorker in Google Chrome prior to 153.0.8010.36... |
low | 3.1 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-49456 Waku is the minimal React framework. |
low | 3.1 | — | — | 2026-09-03 | 2026-09-09 |
| CVE-2026-79966 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application... |
low | 3.3 | — | Dell / secure connect gateway | 2026-09-09 | 2026-09-09 |
| CVE-2026-80169 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application... |
low | 3.3 | — | Dell / secure connect gateway | 2026-09-09 | 2026-09-09 |
| CVE-2026-79690 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application... |
low | 3.7 | — | Dell / secure connect gateway | 2026-09-09 | 2026-09-09 |
| CVE-2026-79732 Dell Secure Connect Gateway (SCG) 5.0 Appliance, versions prior to 5.36.00.xx, c... |
low | 3.7 | — | Dell / secure connect gateway | 2026-09-09 | 2026-09-09 |
| CVE-2026-79736 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application... |
low | 3.7 | — | Dell / secure connect gateway | 2026-09-09 | 2026-09-09 |
| CVE-2026-79942 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application... |
low | 3.4 | — | Dell / secure connect gateway | 2026-09-09 | 2026-09-09 |
| CVE-2026-79944 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application... |
low | 3.4 | — | Dell / secure connect gateway | 2026-09-09 | 2026-09-09 |
| CVE-2026-80239 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application... |
low | 2.4 | — | Dell / secure connect gateway | 2026-09-09 | 2026-09-09 |
| CVE-2026-79727 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application... |
low | 3.3 | — | Dell / secure connect gateway | 2026-09-09 | 2026-09-09 |
| CVE-2026-87485 Incorrect authorization in CORS in Google Chrome prior to 153.0.8010.36 allowed... |
low | 3.1 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-87498 Missing authorization in WebUI in Google Chrome prior to 153.0.8010.36 allowed a... |
low | 3.1 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-87517 Race condition in Mobile in Google Chrome on on iOS prior to 153.0.8010.36 allow... |
low | 3.1 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-87531 Information leak in CORS in Google Chrome prior to 153.0.8010.36 allowed a remot... |
low | 3.1 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-87652 Incorrect authorization in PushAPI in Google Chrome prior to 153.0.8010.36 allow... |
low | 3.1 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-81168 Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal... |
low | 3.7 | — | Captcha Protected Page Project / captcha protected page | 2026-09-02 | 2026-09-09 |
| CVE-2026-87521 Information leak in WebMCP in Google Chrome prior to 153.0.8010.36 allowed a rem... |
low | 3.1 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-87452 Incorrect authorization in GPU in Google Chrome on on Mac prior to 153.0.8010.36... |
low | 3.1 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-87611 Missing authorization in FileSystem in Google Chrome prior to 153.0.8010.36 allo... |
low | 3.1 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-69904 Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an auth... |
low | 3.5 | — | Microsoft / sharepoint server | 2026-09-08 | 2026-09-09 |
| CVE-2026-87451 Information leak in Downloads in Google Chrome prior to 153.0.8010.36 allowed a... |
low | 3.1 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-13144 The WP Travel WordPress plugin before 12.0.2 does not properly verify that the r... |
low | 3.7 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-13146 The WP Travel WordPress plugin before 12.0.2 does not properly verify that the r... |
low | 3.7 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-81846 An authorization bypass in the runZero Platform MCP service has been resolved in... |
low | 3.5 | — | — | 2026-09-01 | 2026-09-09 |
| CVE-2026-86564 A flaw was found in DPDK lib/vhost. |
low | 3.3 | — | — | 2026-09-08 | 2026-09-09 |
| CVE-2026-86227 A weakness has been identified in valkey-io valkey up to 9.0.5/9.1.1. |
low | 3.1 | — | — | 2026-09-06 | 2026-09-09 |
| CVE-2026-86181 A vulnerability was found in code-projects Task Management System 1.0. |
low | 3.5 | — | — | 2026-09-06 | 2026-09-09 |
| CVE-2026-76961 SAP S/4HANA Finance (Advanced Payment Management) does not perform sufficient Cr... |
low | 3.5 | — | — | 2026-09-08 | 2026-09-09 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.