September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,186
Critical
1,210
High
4,308
Medium
4,071
Low
456
Severity not reported
1,141
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (605), oracle (274), apple (244), adobe (197), dell (137), ibm (104), arubanetworks (101), mongodb (64), apache (53)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-90678 An issue was discovered in HAProxy 3.3.0 through 3.4.4 and in 3.5-dev1 through 3... |
high | 7.5 | — | — | 2026-09-13 | 2026-09-22 |
| CVE-2026-23789 An issue was discovered in MFC in Samsung Mobile Processor and Wearable Processo... |
high | 7.8 | — | — | 2026-09-14 | 2026-09-22 |
| CVE-2026-33963 An issue was discovered in camera in Samsung Mobile Processor Exynos 1330, 1380,... |
high | 7.5 | — | — | 2026-09-14 | 2026-09-22 |
| CVE-2023-28148 A bodyclass XSS issue was discovered in Paessler PRTG before 23.3.86.1520. |
high | 7.2 | — | — | 2026-09-14 | 2026-09-22 |
| CVE-2023-32803 The ca-certificates package before ca-certificates-2021.2.50-72 for Amazon Linux... |
high | 7.5 | — | — | 2026-09-14 | 2026-09-22 |
| CVE-2023-45858 A directory traversal was identified in Paessler PRTG before 23.4.88.1429 that m... |
high | 8.6 | — | — | 2026-09-14 | 2026-09-22 |
| CVE-2026-94488 Telegram Desktop before 6.9.4 allows XSS in the HTML exporter. |
high | 8.2 | — | — | 2026-09-21 | 2026-09-22 |
| CVE-2026-69775 Use after free in Windows DWM Core Library allows an authorized attacker to elev... |
high | 7.5 | — | Microsoft / windows 11 23h2 | 2026-09-08 | 2026-09-22 |
| CVE-2026-71047 Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware... |
high | 8.8 | — | Oracle / identity manager | 2026-09-15 | 2026-09-22 |
| CVE-2026-73942 Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware... |
high | 8.8 | — | Oracle / identity manager | 2026-09-15 | 2026-09-22 |
| CVE-2026-69784 Use after free in Windows Hello allows an authorized attacker to elevate privile... |
high | 8.8 | — | Microsoft / windows 10 21h2 | 2026-09-08 | 2026-09-22 |
| CVE-2026-73943 Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware... |
high | 7.6 | — | Oracle / identity manager | 2026-09-15 | 2026-09-22 |
| CVE-2026-73949 Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware... |
high | 8.8 | — | Oracle / webcenter portal | 2026-09-15 | 2026-09-22 |
| CVE-2026-73951 Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware... |
high | 8.1 | — | Oracle / webcenter portal | 2026-09-15 | 2026-09-22 |
| CVE-2026-83004 Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusio... |
high | 7.2 | — | Oracle / webcenter enterprise capture | 2026-09-15 | 2026-09-22 |
| CVE-2026-69790 Heap-based buffer overflow in Windows Credential Providers allows an authorized... |
high | 7.8 | — | Microsoft / windows 10 1809 | 2026-09-08 | 2026-09-22 |
| CVE-2026-69791 Use after free in Windows Device Association Service allows an authorized attack... |
high | 7.0 | — | Microsoft / windows 10 1809 | 2026-09-08 | 2026-09-22 |
| CVE-2026-87141 Vulnerability in the Oracle Hyperion Data Relationship Management product of Ora... |
high | 7.7 | — | Oracle / hyperion data relationship management | 2026-09-15 | 2026-09-22 |
| CVE-2026-88623 NUUO Network Video Recorder 2.0.0 is vulnerable to arbitrary file read. |
high | 7.5 | — | — | 2026-09-18 | 2026-09-22 |
| CVE-2026-88738 Jazzware RT1000 Edge webUI v. |
high | 8.8 | — | — | 2026-09-21 | 2026-09-22 |
| CVE-2026-87137 Vulnerability in the Oracle Hyperion Data Relationship Management product of Ora... |
high | 7.6 | — | Oracle / hyperion data relationship management | 2026-09-15 | 2026-09-22 |
| CVE-2026-87136 Vulnerability in the Oracle Hyperion Data Relationship Management product of Ora... |
high | 7.5 | — | Oracle / hyperion data relationship management | 2026-09-15 | 2026-09-22 |
| CVE-2026-86553 SmartLife app dynamically generates fresh SmartLife application authentication p... |
high | 8.8 | — | — | 2026-09-20 | 2026-09-22 |
| CVE-2026-91827 The Ninja Forms WordPress plugin 3.15.3 does not prevent user-submitted form fie... |
high | 7.5 | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-92438 The Ninja Forms WordPress plugin 3.15.3 does not escape submitted form field val... |
high | 8.8 | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-87144 Vulnerability in the Oracle Hyperion Data Relationship Management product of Ora... |
high | 7.6 | — | Oracle / hyperion data relationship management | 2026-09-15 | 2026-09-22 |
| CVE-2026-87142 Vulnerability in the Oracle Hyperion Data Relationship Management product of Ora... |
high | 7.1 | — | Oracle / hyperion data relationship management | 2026-09-15 | 2026-09-22 |
| CVE-2026-87146 Vulnerability in the Oracle Hyperion Data Relationship Management product of Ora... |
high | 7.1 | — | Oracle / hyperion data relationship management | 2026-09-15 | 2026-09-22 |
| CVE-2026-87135 Vulnerability in the Oracle Hyperion Data Relationship Management product of Ora... |
high | 7.1 | — | Oracle / hyperion data relationship management | 2026-09-15 | 2026-09-22 |
| CVE-2026-87134 Vulnerability in the Oracle Hyperion Data Relationship Management product of Ora... |
high | 7.7 | — | Oracle / hyperion data relationship management | 2026-09-15 | 2026-09-22 |
| CVE-2026-87133 Vulnerability in the Oracle Hyperion Data Relationship Management product of Ora... |
high | 7.6 | — | Oracle / hyperion data relationship management | 2026-09-15 | 2026-09-22 |
| CVE-2026-88806 A malicious X server could exploit a buffer overflow in libX11 before 1.8.14 dur... |
high | 7.5 | — | — | 2026-09-21 | 2026-09-22 |
| CVE-2026-87132 Vulnerability in the Oracle Hyperion Data Relationship Management product of Ora... |
high | 7.6 | — | Oracle / hyperion data relationship management | 2026-09-15 | 2026-09-22 |
| CVE-2026-87131 Vulnerability in the Oracle Hyperion Data Relationship Management product of Ora... |
high | 7.6 | — | Oracle / hyperion data relationship management | 2026-09-15 | 2026-09-22 |
| CVE-2026-87145 Vulnerability in the Oracle Hyperion Data Relationship Management product of Ora... |
high | 7.3 | — | Oracle / hyperion data relationship management | 2026-09-15 | 2026-09-22 |
| CVE-2026-87147 Vulnerability in the Oracle Hyperion Data Relationship Management product of Ora... |
high | 7.7 | — | Oracle / hyperion data relationship management | 2026-09-15 | 2026-09-22 |
| CVE-2026-94368 A flaw was found in the signature verification logic of noobaa-core, the core co... |
high | 7.1 | — | — | 2026-09-21 | 2026-09-22 |
| CVE-2026-94455 An HTTP endpoint intended for provisioning enterprise and reseller organisations... |
high | 7.1 | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-87143 Vulnerability in the Oracle Hyperion Data Relationship Management product of Ora... |
high | 7.4 | — | Oracle / hyperion data relationship management | 2026-09-15 | 2026-09-22 |
| CVE-2026-25275 Transient DOS when processing authentication frames with invalid FILS informatio... |
high | 7.5 | — | Qualcomm / q-7790 firmware | 2026-09-17 | 2026-09-22 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.