September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,186
Critical
1,210
High
4,308
Medium
4,071
Low
456
Severity not reported
1,141
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (605), oracle (274), apple (244), adobe (197), dell (137), ibm (104), arubanetworks (101), mongodb (64), apache (53)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-68497 jackson-databind binds a JSON string to a javax.xml.datatype.Duration or javax.x... |
high | 7.5 | — | — | 2026-09-11 | 2026-09-18 |
| CVE-2026-19624 A flaw was found in NetworkManager-l2tp. |
high | 7.8 | — | — | 2026-09-14 | 2026-09-18 |
| CVE-2026-19816 A flaw was found in PackageKit. |
high | 7.1 | — | — | 2026-09-14 | 2026-09-18 |
| CVE-2026-40058 CrowdStrike released a security update to address a vulnerability in the Falcon... |
high | 8.8 | — | — | 2026-09-15 | 2026-09-18 |
| CVE-2026-76154 A stored cross-site scripting vulnerability in the Geomap panel's MapLibre base... |
high | 7.3 | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-93652 Integer overflow in µD3TN v0.15.0 TCPCLv3 handshake causes heap overflow, allowi... |
high | 7.5 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-90894 Parallels Desktop runs prl_disp_service as root. |
high | 7.8 | — | — | 2026-09-14 | 2026-09-18 |
| CVE-2026-89212 A flaw resulting in XML external entity (XXE) was found in Akana API Platform in... |
high | 8.6 | — | — | 2026-09-11 | 2026-09-18 |
| CVE-2026-1758 Session fixation vulnerability in Secomea GateManager (webserver module) allows... |
high | 8.3 | — | — | 2026-09-15 | 2026-09-18 |
| CVE-2026-16140 OpenBMC's IPMI implementation, phosphor-net-ipmid, is vulnerable to a logic flaw... |
high | 8.8 | — | — | 2026-09-15 | 2026-09-18 |
| CVE-2026-16141 OpenBMC's IPMI implementation, phosphor-net-ipmid, contains a logic flaw in whic... |
high | 8.1 | — | — | 2026-09-15 | 2026-09-18 |
| CVE-2026-87886 Acronis Backup Incorrect Default Permissions Vulnerability |
high | 7.8 | Listed | Acronis / Backup | 2026-09-17 | 2026-09-18 |
| CVE-2026-80469 An attacker may achieve arbitrary code execution on a target system by uploading... |
high | 8.3 | — | — | 2026-09-11 | 2026-09-18 |
| CVE-2026-28197 An authenticated, low-privileged user with access to the NetBackup Flex
OS mana... |
high | 8.8 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-28198 An authenticated, low-privileged user with access to the NetBackup Flex
OS mana... |
high | 8.8 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-89054 A missing authorization vulnerability in OpenNMS Horizon allows configuration ch... |
high | 8.2 | — | — | 2026-09-10 | 2026-09-18 |
| CVE-2026-86865 Tanium addressed a SQL injection vulnerability in Asset. |
high | 7.2 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-87024 Tanium addressed a SQL injection vulnerability in Asset. |
high | 7.2 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-87105 Tanium addressed a SQL injection vulnerability in Threat Response. |
high | 8.8 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-65359 An out-of-bounds read was addressed with improved bounds checking. |
high | 7.1 | — | Apple / ipados | 2026-09-14 | 2026-09-18 |
| CVE-2026-84858 ScadaLTS 2.8.1-release-candidate build 0 is affected by an Authenticated Remote... |
high | 8.8 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-84860 ScadaLTS 2.8.1-release-candidate build 0 is affected by an Authorization Bypass... |
high | 8.8 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-92625 Control iD iDSecure versions prior to 4.8.3.0 are affected by an unauthenticated... |
high | 7.5 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-92626 Control iD iDSecure versions prior to 4.8.3.0 are affected by an unauthenticated... |
high | 7.5 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-81901 In Concrete CMS 9.2.0 through 9.5.2, the REST API page update endpoint (PUT /ccm... |
high | 8.7 | — | Concretecms / concrete cms | 2026-09-14 | 2026-09-18 |
| CVE-2026-92619 The Booking Calendar plugin for WordPress is vulnerable to Privilege Escalation... |
high | 7.2 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-87125 Vulnerability in the Oracle Financials for Asia/Pacific product of Oracle E-Busi... |
high | 8.3 | — | — | 2026-09-15 | 2026-09-18 |
| CVE-2026-83477 Vulnerability in the Oracle Work in Process product of Oracle E-Business Suite (... |
high | 8.1 | — | — | 2026-09-15 | 2026-09-18 |
| CVE-2026-83446 Vulnerability in the Oracle Financials Common Modules product of Oracle E-Busine... |
high | 8.1 | — | — | 2026-09-15 | 2026-09-18 |
| CVE-2026-83418 Vulnerability in the Oracle Communications Cloud Native Core Security Edge Prote... |
high | 8.2 | — | — | 2026-09-15 | 2026-09-18 |
| CVE-2026-83310 Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component:... |
high | 8.7 | — | — | 2026-09-15 | 2026-09-18 |
| CVE-2026-83304 Vulnerability in the Oracle Business Intelligence Enterprise Edition product of... |
high | 8.9 | — | — | 2026-09-15 | 2026-09-18 |
| CVE-2026-83307 Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component:... |
high | 8.3 | — | — | 2026-09-15 | 2026-09-18 |
| CVE-2026-83285 Vulnerability in the Oracle Business Intelligence Enterprise Edition product of... |
high | 8.3 | — | — | 2026-09-15 | 2026-09-18 |
| CVE-2026-83297 Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component:... |
high | 8.1 | — | — | 2026-09-15 | 2026-09-18 |
| CVE-2026-83264 Vulnerability in the Oracle Product Lifecycle Analytics product of Oracle Supply... |
high | 8.4 | — | — | 2026-09-15 | 2026-09-18 |
| CVE-2026-83220 Vulnerability in the Siebel CRM Integration product of Oracle Siebel CRM (compon... |
high | 8.1 | — | — | 2026-09-15 | 2026-09-18 |
| CVE-2026-83218 Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (compone... |
high | 7.4 | — | — | 2026-09-15 | 2026-09-18 |
| CVE-2026-83219 Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (compone... |
high | 7.1 | — | — | 2026-09-15 | 2026-09-18 |
| CVE-2026-83174 Vulnerability in the Oracle CRM Technical Foundation product of Oracle E-Busines... |
high | 8.1 | — | — | 2026-09-15 | 2026-09-18 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.