September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,186
Critical
1,210
High
4,308
Medium
4,071
Low
456
Severity not reported
1,141
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (605), oracle (274), apple (244), adobe (197), dell (137), ibm (104), arubanetworks (101), mongodb (64), apache (53)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-84285 An OS Command Injection vulnerability affecting Tuleap Enterprise Edition from 1... |
high | 8.8 | — | — | 2026-09-21 | 2026-09-21 |
| CVE-2026-83436 Vulnerability in the Oracle Depot Repair product of Oracle E-Business Suite (com... |
high | 7.1 | — | — | 2026-09-15 | 2026-09-21 |
| CVE-2026-83324 Vulnerability in the Oracle Business Intelligence Enterprise Edition product of... |
high | 7.1 | — | — | 2026-09-15 | 2026-09-21 |
| CVE-2026-83326 Vulnerability in the Siebel CRM Integration product of Oracle Siebel CRM (compon... |
high | 7.5 | — | — | 2026-09-15 | 2026-09-21 |
| CVE-2026-83332 Vulnerability in the Oracle Applications Framework product of Oracle E-Business... |
high | 7.1 | — | — | 2026-09-15 | 2026-09-21 |
| CVE-2026-83334 Vulnerability in the Oracle Web Services Manager product of Oracle Fusion Middle... |
high | 7.4 | — | — | 2026-09-15 | 2026-09-21 |
| CVE-2026-83341 Vulnerability in the Oracle Applications Manager product of Oracle E-Business Su... |
high | 7.5 | — | — | 2026-09-15 | 2026-09-21 |
| CVE-2026-83343 Vulnerability in the Oracle Utilities Network Management System product of Oracl... |
high | 8.2 | — | — | 2026-09-15 | 2026-09-21 |
| CVE-2026-83345 Vulnerability in the Oracle XML Gateway product of Oracle E-Business Suite (comp... |
high | 7.1 | — | — | 2026-09-15 | 2026-09-21 |
| CVE-2026-83266 Vulnerability in the Oracle JDeveloper product of Oracle Fusion Middleware (comp... |
high | 8.2 | — | — | 2026-09-15 | 2026-09-21 |
| CVE-2026-83267 Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component:... |
high | 8.5 | — | — | 2026-09-15 | 2026-09-21 |
| CVE-2026-83270 Vulnerability in the Oracle Business Intelligence Enterprise Edition product of... |
high | 7.5 | — | — | 2026-09-15 | 2026-09-21 |
| CVE-2026-83309 Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component:... |
high | 8.5 | — | — | 2026-09-15 | 2026-09-21 |
| CVE-2026-83321 Vulnerability in the Oracle Business Intelligence Enterprise Edition product of... |
high | 8.5 | — | — | 2026-09-15 | 2026-09-21 |
| CVE-2026-69648 Use after free in Windows Notification allows an authorized attacker to elevate... |
high | 7.0 | — | Microsoft / windows 10 21h2 | 2026-09-08 | 2026-09-21 |
| CVE-2026-72962 Heap-based buffer overflow in Windows USB Video Driver allows an authorized atta... |
high | 8.2 | — | Microsoft / windows 10 1809 | 2026-09-08 | 2026-09-21 |
| CVE-2026-72953 Heap-based buffer overflow in Windows USB Driver allows an authorized attacker t... |
high | 7.8 | — | Microsoft / windows 10 21h2 | 2026-09-08 | 2026-09-21 |
| CVE-2026-72947 Integer underflow (wrap or wraparound) in Windows File History Service allows an... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-21 |
| CVE-2026-72952 Out-of-bounds read in Windows Spaceport.sys allows an authorized attacker to exe... |
high | 7.0 | — | Microsoft / windows 10 1809 | 2026-09-08 | 2026-09-21 |
| CVE-2026-72949 Null pointer dereference in Windows SMB Server Network Transport Driver (srvnet.... |
high | 7.5 | — | Microsoft / windows 11 23h2 | 2026-09-08 | 2026-09-21 |
| CVE-2026-72960 Heap-based buffer overflow in Windows Media Player allows an unauthorized attack... |
high | 8.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-21 |
| CVE-2026-69575 Use after free in Windows Storage Spaces Controller allows an authorized attacke... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-21 |
| CVE-2026-93973 A vulnerability was detected in SourceCodester Online Reviewer Management System... |
high | 7.3 | — | — | 2026-09-20 | 2026-09-21 |
| CVE-2026-93978 A vulnerability was identified in code-projects Internship Management System 1.0... |
high | 7.3 | — | — | 2026-09-20 | 2026-09-21 |
| CVE-2026-92729 SigNoz versions 0.88.0 through 0.141.0 fail to apply authorization wrappers to t... |
high | 8.2 | — | — | 2026-09-16 | 2026-09-21 |
| CVE-2026-88259 CareCam CM2507 IP cameras do not require authentication for access to its networ... |
high | 7.5 | — | — | 2026-09-18 | 2026-09-21 |
| CVE-2026-76856 Netcore NR255-V firmware version 1.5.130703 contains a cross-site request forger... |
high | 8.1 | — | — | 2026-09-15 | 2026-09-21 |
| CVE-2026-76861 Netcore NR255-V version 1.5.130703 contains a stack-based buffer overflow in nto... |
high | 8.8 | — | — | 2026-09-15 | 2026-09-21 |
| CVE-2026-75894 In osmo-iuh from 0.1.0 through 1.8.0 a reachable assertion was found in the rana... |
high | 7.5 | — | — | 2026-09-18 | 2026-09-21 |
| CVE-2026-75893 In osmo-bsc from 1.0.1 through 1.14.1 a heap based buffer overflow issue was fou... |
high | 7.5 | — | — | 2026-09-18 | 2026-09-21 |
| CVE-2026-47321 The CompressionFilter class uses ZLib to deflate and inflate data sent and recei... |
high | 7.5 | — | — | 2026-09-21 | 2026-09-21 |
| CVE-2026-69597 Use after free in Windows HTTP.sys allows an authorized attacker to elevate priv... |
high | 7.5 | — | Microsoft / windows 11 23h2 | 2026-09-08 | 2026-09-21 |
| CVE-2026-92467 zlt2000 microservices-platform through 6.0.0 contains an unverified password cha... |
high | 8.3 | — | — | 2026-09-16 | 2026-09-21 |
| CVE-2026-92954 vm2 is a sandbox library for running untrusted JavaScript in Node.js. |
high | 8.6 | — | — | 2026-09-17 | 2026-09-21 |
| CVE-2026-85150 A NULL pointer dereference flaw was found in GStreamer's RTSP support library. |
high | 7.5 | — | — | 2026-09-03 | 2026-09-21 |
| CVE-2026-83252 Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience... |
high | 7.0 | — | — | 2026-09-15 | 2026-09-21 |
| CVE-2026-83259 Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience... |
high | 7.1 | — | — | 2026-09-15 | 2026-09-21 |
| CVE-2026-83265 Vulnerability in the Oracle Web Services Manager product of Oracle Fusion Middle... |
high | 8.2 | — | — | 2026-09-15 | 2026-09-21 |
| CVE-2026-76866 Netcore NR255-V firmware version 1.5.130703 builds root-run command lines from u... |
high | 7.2 | — | — | 2026-09-15 | 2026-09-21 |
| CVE-2026-69625 Heap-based buffer overflow in Windows Connected User Experiences and Telemetry a... |
high | 8.8 | — | Microsoft / windows 10 1809 | 2026-09-08 | 2026-09-21 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.