September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,186
Critical
1,210
High
4,308
Medium
4,071
Low
456
Severity not reported
1,141
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (605), oracle (274), apple (244), adobe (197), dell (137), ibm (104), arubanetworks (101), mongodb (64), apache (53)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-87166 Vulnerability in the Oracle Purchasing product of Oracle E-Business Suite (compo... |
high | 8.1 | — | Oracle / purchasing | 2026-09-15 | 2026-09-22 |
| CVE-2026-87167 Vulnerability in the Oracle Purchasing product of Oracle E-Business Suite (compo... |
high | 8.1 | — | Oracle / purchasing | 2026-09-15 | 2026-09-22 |
| CVE-2026-87168 Vulnerability in the Oracle Purchasing product of Oracle E-Business Suite (compo... |
high | 8.1 | — | Oracle / purchasing | 2026-09-15 | 2026-09-22 |
| CVE-2026-25294 Transient DOS while parsing frame during channel usage. |
high | 7.4 | — | Qualcomm / cologne firmware | 2026-09-17 | 2026-09-22 |
| CVE-2026-25290 Memory Corruption when validating large data buffers from external sources using... |
high | 7.8 | — | Qualcomm / cologne firmware | 2026-09-17 | 2026-09-22 |
| CVE-2026-25284 Information Disclosure when a pointer is reused after being deallocated. |
high | 7.3 | — | Qualcomm / cologne firmware | 2026-09-17 | 2026-09-22 |
| CVE-2026-25283 Memory Corruption when copying unverified data from an external source exceeds t... |
high | 8.8 | — | Qualcomm / cologne firmware | 2026-09-17 | 2026-09-22 |
| CVE-2026-25282 Transient DOS when processing unverified data from a neighboring system causes o... |
high | 7.9 | — | Qualcomm / cologne firmware | 2026-09-17 | 2026-09-22 |
| CVE-2026-25281 Transient DOS when processing large or numerous request buffers without sufficie... |
high | 7.4 | — | Qualcomm / cologne firmware | 2026-09-17 | 2026-09-22 |
| CVE-2026-25280 Memory corruption when processing escape handling flow with insufficient user bu... |
high | 7.8 | — | Qualcomm / wsa8845h firmware | 2026-09-17 | 2026-09-22 |
| CVE-2026-87265 Vulnerability in the Oracle Purchasing product of Oracle E-Business Suite (compo... |
high | 8.1 | — | Oracle / purchasing | 2026-09-15 | 2026-09-22 |
| CVE-2026-64195 There is an out-of-bounds write vulnerability in DASYLab due to lack of proper v... |
high | 7.3 | — | Ni / dasylab | 2026-09-03 | 2026-09-22 |
| CVE-2026-64196 There is an out-of-bounds write vulnerability in DASYLab due to improper validat... |
high | 7.3 | — | Ni / dasylab | 2026-09-03 | 2026-09-22 |
| CVE-2026-64197 There is an out-of-bounds write vulnerability in DASYLab due to improper validat... |
high | 7.3 | — | Ni / dasylab | 2026-09-03 | 2026-09-22 |
| CVE-2026-64198 There is an out-of-bounds read vulnerability in DASYLab due to improper validati... |
high | 7.3 | — | Ni / dasylab | 2026-09-03 | 2026-09-22 |
| CVE-2026-64199 There is an out-of-bounds read vulnerability in DASYLab due to improper validati... |
high | 7.3 | — | Ni / dasylab | 2026-09-03 | 2026-09-22 |
| CVE-2026-64200 There is an out-of-bounds read vulnerability in DASYLab due to improper validati... |
high | 7.3 | — | Ni / dasylab | 2026-09-03 | 2026-09-22 |
| CVE-2026-93959 A vulnerability was determined in SourceCodester Online Reviewer Management Syst... |
high | 7.3 | — | — | 2026-09-20 | 2026-09-22 |
| CVE-2026-87207 Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hype... |
high | 7.2 | — | Oracle / hyperion financial management | 2026-09-15 | 2026-09-22 |
| CVE-2026-87238 Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hype... |
high | 8.8 | — | Oracle / hyperion financial management | 2026-09-15 | 2026-09-22 |
| CVE-2026-87202 Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hype... |
high | 8.8 | — | Oracle / hyperion financial management | 2026-09-15 | 2026-09-22 |
| CVE-2026-83210 Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (compone... |
high | 8.8 | — | — | 2026-09-15 | 2026-09-22 |
| CVE-2026-83208 Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (compone... |
high | 8.8 | — | — | 2026-09-15 | 2026-09-22 |
| CVE-2026-19780 Koha Eval Code Injection Remote Code Execution Vulnerability. |
high | 8.8 | — | — | 2026-09-15 | 2026-09-22 |
| CVE-2026-18110 Concrete CMS 9 (9.0.0 through 9.5.2) does not perform an authorization check on... |
high | 7.5 | — | Concretecms / concrete cms | 2026-09-15 | 2026-09-22 |
| CVE-2026-87140 Vulnerability in the Oracle Hyperion Data Relationship Management product of Ora... |
high | 7.5 | — | Oracle / hyperion data relationship management | 2026-09-15 | 2026-09-22 |
| CVE-2026-87139 Vulnerability in the Oracle Hyperion Data Relationship Management product of Ora... |
high | 7.5 | — | Oracle / hyperion data relationship management | 2026-09-15 | 2026-09-22 |
| CVE-2026-87138 Vulnerability in the Oracle Hyperion Data Relationship Management product of Ora... |
high | 7.5 | — | Oracle / hyperion data relationship management | 2026-09-15 | 2026-09-22 |
| CVE-2026-69760 Out-of-bounds read in Windows Kerberos allows an unauthorized attacker to deny s... |
high | 7.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-22 |
| CVE-2026-69744 Null pointer dereference in Windows Kerberos allows an unauthorized attacker to... |
high | 7.5 | — | Microsoft / windows 11 24h2 | 2026-09-08 | 2026-09-22 |
| CVE-2026-87266 Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component:... |
high | 8.2 | — | Oracle / agile product lifecycle management | 2026-09-15 | 2026-09-22 |
| CVE-2026-87130 Vulnerability in the Oracle Hyperion Data Relationship Management product of Ora... |
high | 7.4 | — | Oracle / hyperion data relationship management | 2026-09-15 | 2026-09-22 |
| CVE-2026-77124 In affected versions of Nexus Repository 3, the script execution endpoint (POST... |
high | 7.2 | — | Sonatype / nexus repository manager | 2026-09-02 | 2026-09-22 |
| CVE-2026-87190 Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hype... |
high | 7.5 | — | Oracle / hyperion financial management | 2026-09-15 | 2026-09-22 |
| CVE-2026-87191 Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hype... |
high | 7.1 | — | Oracle / hyperion financial management | 2026-09-15 | 2026-09-22 |
| CVE-2026-87219 Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hype... |
high | 8.4 | — | Oracle / hyperion financial management | 2026-09-15 | 2026-09-22 |
| CVE-2026-87220 Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hype... |
high | 7.1 | — | Oracle / hyperion financial management | 2026-09-15 | 2026-09-22 |
| CVE-2026-77125 A vulnerability was identified in Sonatype Nexus Repository 3 in which two blobs... |
high | 7.1 | — | Sonatype / nexus repository manager | 2026-09-02 | 2026-09-22 |
| CVE-2026-87221 Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hype... |
high | 7.5 | — | Oracle / hyperion financial management | 2026-09-15 | 2026-09-22 |
| CVE-2026-87222 Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hype... |
high | 7.5 | — | Oracle / hyperion financial management | 2026-09-15 | 2026-09-22 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.