September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,186
Critical
1,210
High
4,308
Medium
4,071
Low
456
Severity not reported
1,141
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (605), oracle (274), apple (244), adobe (197), dell (137), ibm (104), arubanetworks (101), mongodb (64), apache (53)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-83308 Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component:... |
high | 8.1 | — | — | 2026-09-15 | 2026-09-22 |
| CVE-2026-83352 Vulnerability in the Oracle XML Gateway product of Oracle E-Business Suite (comp... |
high | 7.1 | — | — | 2026-09-15 | 2026-09-22 |
| CVE-2026-83356 Vulnerability in the Enterprise Command Center Framework product of Oracle E-Bus... |
high | 7.7 | — | — | 2026-09-15 | 2026-09-22 |
| CVE-2026-83277 Vulnerability in the Oracle Agile PLM MCAD Connector product of Oracle Supply Ch... |
high | 7.3 | — | — | 2026-09-15 | 2026-09-22 |
| CVE-2026-83287 Vulnerability in the Oracle Business Intelligence Enterprise Edition product of... |
high | 7.7 | — | — | 2026-09-15 | 2026-09-22 |
| CVE-2026-69693 Use after free in Windows Device Association Broker service allows an authorized... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-22 |
| CVE-2026-72929 Improper validation of integrity check value in Windows Installer allows an auth... |
high | 7.8 | — | Microsoft / windows 11 23h2 | 2026-09-08 | 2026-09-22 |
| CVE-2026-83115 Vulnerability in the Oracle Applications Manager product of Oracle E-Business Su... |
high | 7.5 | — | — | 2026-09-15 | 2026-09-22 |
| CVE-2026-83303 Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component:... |
high | 8.5 | — | — | 2026-09-15 | 2026-09-22 |
| CVE-2026-83305 Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component:... |
high | 8.6 | — | — | 2026-09-15 | 2026-09-22 |
| CVE-2026-77523 MaxKB is an open-source AI assistant for enterprise. |
high | 7.4 | — | — | 2026-09-21 | 2026-09-22 |
| CVE-2026-69694 Deserialization of untrusted data in Windows IP Address Management (IPAM) Servic... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-22 |
| CVE-2026-72946 Heap-based buffer overflow in Storage Port Driver allows an authorized attacker... |
high | 7.8 | — | Microsoft / windows 11 24h2 | 2026-09-08 | 2026-09-22 |
| CVE-2026-78463 Improper control of generation of code ('code injection') in Remote Desktop Clie... |
high | 8.8 | — | Microsoft / remote desktop client | 2026-09-08 | 2026-09-22 |
| CVE-2026-80074 Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attac... |
high | 8.8 | — | Microsoft / remote desktop client | 2026-09-08 | 2026-09-22 |
| CVE-2026-80077 Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attac... |
high | 8.8 | — | Microsoft / remote desktop client | 2026-09-08 | 2026-09-22 |
| CVE-2026-72936 Use after free in Windows SMB Client allows an unauthorized attacker to execute... |
high | 8.1 | — | Microsoft / windows 11 23h2 | 2026-09-08 | 2026-09-22 |
| CVE-2026-72940 Heap-based buffer overflow in Windows Schannel allows an unauthorized attacker t... |
high | 8.8 | — | Microsoft / windows 11 23h2 | 2026-09-08 | 2026-09-22 |
| CVE-2026-86482 In JetBrains YouTrack before 2026.2.18634, insufficient validation of role assig... |
high | 8.8 | — | — | 2026-09-07 | 2026-09-22 |
| CVE-2026-87288 Vulnerability in the Oracle GraalVM product of Oracle Java SE (component: Compil... |
high | 8.1 | — | — | 2026-09-15 | 2026-09-22 |
| CVE-2026-87286 Vulnerability in the Oracle GraalVM product of Oracle Java SE (component: Compil... |
high | 8.1 | — | — | 2026-09-15 | 2026-09-22 |
| CVE-2026-87287 Vulnerability in the Oracle GraalVM product of Oracle Java SE (component: Compil... |
high | 8.1 | — | — | 2026-09-15 | 2026-09-22 |
| CVE-2026-83357 Vulnerability in the Oracle GraalVM for JDK, Oracle GraalVM product of Oracle Ja... |
high | 8.1 | — | — | 2026-09-15 | 2026-09-22 |
| CVE-2026-83408 Vulnerability in the Oracle GraalVM for JDK, Oracle GraalVM product of Oracle Ja... |
high | 8.1 | — | — | 2026-09-15 | 2026-09-22 |
| CVE-2026-94143 A vulnerability was detected in drogonframework drogon up to 1.9.13. |
high | 7.3 | — | — | 2026-09-21 | 2026-09-21 |
| CVE-2026-93980 A weakness has been identified in code-projects Internship Management System 1.0... |
high | 7.3 | — | — | 2026-09-20 | 2026-09-21 |
| CVE-2026-92961 vm2 before 3.11.6 fails to enforce bufferAllocLimit on ArrayBuffer, SharedArrayB... |
high | 7.5 | — | — | 2026-09-17 | 2026-09-21 |
| CVE-2026-92959 vm2 before 3.11.8 does not fully enforce the allowAsync: false option in VM and... |
high | 7.1 | — | — | 2026-09-17 | 2026-09-21 |
| CVE-2026-84446 libheif is a HEIF and AVIF file format decoder and encoder. |
high | 7.5 | — | — | 2026-09-18 | 2026-09-21 |
| CVE-2026-63459 Vendure is an open-source headless commerce platform. |
high | 8.7 | — | — | 2026-09-17 | 2026-09-21 |
| CVE-2026-94128 A security vulnerability has been detected in BioStar VIVID LED DJ 4.0.2411.1500... |
high | 8.8 | — | — | 2026-09-21 | 2026-09-21 |
| CVE-2026-94142 A security vulnerability has been detected in BioStar Temperature Monitor Utilit... |
high | 8.8 | — | — | 2026-09-21 | 2026-09-21 |
| CVE-2026-87205 Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hype... |
high | 7.5 | — | Oracle / hyperion financial management | 2026-09-15 | 2026-09-21 |
| CVE-2026-94038 A security vulnerability has been detected in NonceGeek dim-sum-app. |
high | 7.3 | — | — | 2026-09-20 | 2026-09-21 |
| CVE-2026-90860 The Canva Mobile App for HarmonyOS before v1.15.1 did not restrict the headers r... |
high | 7.1 | — | — | 2026-09-21 | 2026-09-21 |
| CVE-2026-87149 Vulnerability in the Oracle Contract Lifecycle Management for Public Sector prod... |
high | 7.1 | — | — | 2026-09-15 | 2026-09-21 |
| CVE-2026-87196 Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hype... |
high | 8.2 | — | Oracle / hyperion financial management | 2026-09-15 | 2026-09-21 |
| CVE-2026-87197 Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hype... |
high | 8.2 | — | Oracle / hyperion financial management | 2026-09-15 | 2026-09-21 |
| CVE-2026-87200 Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hype... |
high | 8.2 | — | Oracle / hyperion financial management | 2026-09-15 | 2026-09-21 |
| CVE-2026-83484 Vulnerability in the Oracle US Federal Human Resources product of Oracle E-Busin... |
high | 7.1 | — | — | 2026-09-15 | 2026-09-21 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.