September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,186
Critical
1,210
High
4,308
Medium
4,071
Low
456
Severity not reported
1,141
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (605), oracle (274), apple (244), adobe (197), dell (137), ibm (104), arubanetworks (101), mongodb (64), apache (53)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-93962 A weakness has been identified in Kamailio up to 5.8.8/6.0.7/6.1.4/6.2.0-dev1. |
high | 8.3 | — | — | 2026-09-20 | 2026-09-22 |
| CVE-2026-87224 Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hype... |
high | 8.8 | — | Oracle / hyperion financial management | 2026-09-15 | 2026-09-22 |
| CVE-2026-87225 Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hype... |
high | 7.1 | — | Oracle / hyperion financial management | 2026-09-15 | 2026-09-22 |
| CVE-2026-87171 Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hype... |
high | 8.7 | — | Oracle / hyperion financial management | 2026-09-15 | 2026-09-22 |
| CVE-2026-87174 Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hype... |
high | 8.2 | — | Oracle / hyperion financial management | 2026-09-15 | 2026-09-22 |
| CVE-2026-87177 Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hype... |
high | 8.5 | — | Oracle / hyperion financial management | 2026-09-15 | 2026-09-22 |
| CVE-2026-87178 Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hype... |
high | 8.7 | — | Oracle / hyperion financial management | 2026-09-15 | 2026-09-22 |
| CVE-2026-87179 Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hype... |
high | 8.8 | — | Oracle / hyperion financial management | 2026-09-15 | 2026-09-22 |
| CVE-2026-87180 Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hype... |
high | 8.8 | — | Oracle / hyperion financial management | 2026-09-15 | 2026-09-22 |
| CVE-2026-87181 Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hype... |
high | 8.8 | — | Oracle / hyperion financial management | 2026-09-15 | 2026-09-22 |
| CVE-2026-87182 Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hype... |
high | 8.8 | — | Oracle / hyperion financial management | 2026-09-15 | 2026-09-22 |
| CVE-2026-87183 Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hype... |
high | 7.7 | — | Oracle / hyperion financial management | 2026-09-15 | 2026-09-22 |
| CVE-2026-87185 Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hype... |
high | 8.8 | — | Oracle / hyperion financial management | 2026-09-15 | 2026-09-22 |
| CVE-2026-87187 Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hype... |
high | 8.8 | — | Oracle / hyperion financial management | 2026-09-15 | 2026-09-22 |
| CVE-2026-69720 Heap-based buffer overflow in Windows MIDI Service Module allows an authorized a... |
high | 7.8 | — | Microsoft / windows 11 24h2 | 2026-09-08 | 2026-09-22 |
| CVE-2026-72926 Use after free in Windows Internet Connection Sharing (ICS) allows an authorized... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-22 |
| CVE-2026-71221 A stack out-of-bounds write vulnerability was found in gfs2-utils. |
high | 7.0 | — | Redhat / enterprise linux | 2026-09-03 | 2026-09-22 |
| CVE-2026-71220 A stack out-of-bounds write vulnerability was found in gfs2-utils. |
high | 7.0 | — | Redhat / enterprise linux | 2026-09-03 | 2026-09-22 |
| CVE-2026-84964 A double free in the OpenSSL-based TLS certificate revocation checking path of t... |
high | 7.5 | — | Mongodb / c driver | 2026-09-03 | 2026-09-22 |
| CVE-2026-94110 A security vulnerability has been detected in QCMS up to 6.0.6. |
high | 7.3 | — | — | 2026-09-21 | 2026-09-22 |
| CVE-2026-94139 A weakness has been identified in Chengdu Feiyuxing Technology Feiyu Star Router... |
high | 7.4 | — | — | 2026-09-21 | 2026-09-22 |
| CVE-2026-94146 A vulnerability was found in BioStar BIOS Update Utility 1.9.7.3. |
high | 8.8 | — | — | 2026-09-21 | 2026-09-22 |
| CVE-2026-93969 A vulnerability was identified in aiyiyi121 SxDevOps 1.0/1.1. |
high | 7.3 | — | — | 2026-09-20 | 2026-09-22 |
| CVE-2026-93974 A flaw has been found in SourceCodester Online Reviewer Management System 1.0. |
high | 7.3 | — | — | 2026-09-20 | 2026-09-22 |
| CVE-2026-93979 A security flaw has been discovered in code-projects Internship Management Syste... |
high | 7.3 | — | — | 2026-09-20 | 2026-09-22 |
| CVE-2026-94015 A vulnerability was identified in SourceCodester Drug Recommendation System 1.0. |
high | 7.3 | — | — | 2026-09-20 | 2026-09-22 |
| CVE-2026-93922 SiYuan through 3.8.4 renders notebook names as raw HTML in the Daily Note picker... |
high | 8.8 | — | — | 2026-09-19 | 2026-09-22 |
| CVE-2026-93371 A security vulnerability has been detected in marcopiovanello yt-dlp-web-ui up t... |
high | 8.3 | — | — | 2026-09-18 | 2026-09-22 |
| CVE-2026-93559 A vulnerability was identified in Forget-C Jellyfish AI Short Drama Studio 0.1.0... |
high | 7.3 | — | — | 2026-09-18 | 2026-09-22 |
| CVE-2026-81180 SysReptor is a fully customizable pentest reporting platform. |
high | 8.8 | — | — | 2026-09-18 | 2026-09-22 |
| CVE-2026-75607 Frigate is an open source network video recorder. |
high | 8.1 | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-69682 Use after free in Windows Host Guardian Service allows an authorized attacker to... |
high | 7.0 | — | Microsoft / windows 10 1809 | 2026-09-08 | 2026-09-22 |
| CVE-2026-69689 Out-of-bounds read in Windows Win32K allows an authorized attacker to elevate pr... |
high | 8.8 | — | Microsoft / windows 10 1809 | 2026-09-08 | 2026-09-22 |
| CVE-2026-93560 A flaw was found in the Netty STOMP codec. |
high | 7.5 | — | — | 2026-09-18 | 2026-09-22 |
| CVE-2026-93593 ArcadeDB before 26.9.1 fails to enforce security-group types ACL entries for Tim... |
high | 8.1 | — | — | 2026-09-18 | 2026-09-22 |
| CVE-2026-84444 libheif is a HEIF and AVIF file format decoder and encoder. |
high | 7.4 | — | — | 2026-09-18 | 2026-09-22 |
| CVE-2026-83417 Vulnerability in the Oracle Communications Cloud Native Core Security Edge Prote... |
high | 7.1 | — | — | 2026-09-15 | 2026-09-22 |
| CVE-2026-83425 Vulnerability in the Oracle Complex Maintenance, Repair and Overhaul product of... |
high | 8.5 | — | — | 2026-09-15 | 2026-09-22 |
| CVE-2026-83300 Vulnerability in the Oracle XML Gateway product of Oracle E-Business Suite (comp... |
high | 7.1 | — | — | 2026-09-15 | 2026-09-22 |
| CVE-2026-83302 Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component:... |
high | 8.5 | — | — | 2026-09-15 | 2026-09-22 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.