September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,186
Critical
1,210
High
4,308
Medium
4,071
Low
456
Severity not reported
1,141
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (605), oracle (274), apple (244), adobe (197), dell (137), ibm (104), arubanetworks (101), mongodb (64), apache (53)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-93597 ArcadeDB versions before 26.9.1 fail to validate IPv6 transition addresses in th... |
high | 7.7 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-92399 A vulnerability was determined in GPAC 26.07.0. |
high | 7.3 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-19499 Calling strfmon and strfmon_l in the GNU C Library version 2.38 to 2.44 can writ... |
high | 7.7 | — | — | 2026-09-14 | 2026-09-18 |
| CVE-2026-10030 IBM MQ Console allows authenticated non-administrative users to create and start... |
high | 7.1 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-88865 AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate... |
high | 8.1 | — | — | 2026-09-10 | 2026-09-18 |
| CVE-2026-88870 WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a c... |
high | 7.1 | — | — | 2026-09-10 | 2026-09-18 |
| CVE-2026-87814 SiYuan before v3.8.2 contains a stored cross-site scripting vulnerability in the... |
high | 7.3 | — | — | 2026-09-09 | 2026-09-18 |
| CVE-2026-87819 GitPython before 3.1.60 contains a regular expression denial of service vulnerab... |
high | 7.5 | — | Gitpython Project / gitpython | 2026-09-09 | 2026-09-18 |
| CVE-2026-87794 bestzip versions 2.2.6 and 3.0.2 contain an argument injection vulnerability in... |
high | 8.4 | — | — | 2026-09-09 | 2026-09-18 |
| CVE-2026-86250 h3 versions before 2.0.1-rc.18 fail to validate the chunk count parsed from user... |
high | 7.5 | — | — | 2026-09-06 | 2026-09-18 |
| CVE-2026-84447 libheif is a HEIF and AVIF file format decoder and encoder. |
high | 7.5 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-83312 Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component:... |
high | 7.7 | — | — | 2026-09-15 | 2026-09-18 |
| CVE-2026-83313 Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component:... |
high | 7.7 | — | — | 2026-09-15 | 2026-09-18 |
| CVE-2026-83314 Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component:... |
high | 8.1 | — | — | 2026-09-15 | 2026-09-18 |
| CVE-2026-84384 libheif is a HEIF and AVIF file format decoder and encoder. |
high | 7.5 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-75584 ION-DTN before 4.2.1-a.1 contains a denial of service vulnerability that allows... |
high | 7.5 | — | — | 2026-09-10 | 2026-09-18 |
| CVE-2026-74909 Keycloak provides a policy enforcer to protect applications by matching incoming... |
high | 8.1 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-56711 VLC media player versions 3.0.0 through 3.0.23 contain a memory-safety vulnerabi... |
high | 7.0 | — | — | 2026-09-09 | 2026-09-18 |
| CVE-2026-27558 A low-privileged remote attacker can exploit a command injection vulnerability i... |
high | 8.8 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-27563 A high-privileged remote attacker can exploit a command injection vulnerability... |
high | 7.2 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-27548 A low-privileged remote attacker can exploit a command injection vulnerability i... |
high | 8.8 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-12645 A Missing Authorization vulnerability in Ivanti Neurons for ITSM before 2026.2 a... |
high | 8.8 | — | Ivanti / neurons for itsm | 2026-09-08 | 2026-09-18 |
| CVE-2026-12646 A Missing Authorization vulnerability in Ivanti Neurons for ITSM before 2026.2 a... |
high | 8.8 | — | Ivanti / neurons for itsm | 2026-09-08 | 2026-09-18 |
| CVE-2026-12647 A Missing Authorization vulnerability in Ivanti Neurons for ITSM before 2026.2 a... |
high | 8.8 | — | Ivanti / neurons for itsm | 2026-09-08 | 2026-09-18 |
| CVE-2026-12650 A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM bef... |
high | 8.8 | — | Ivanti / neurons for itsm | 2026-09-08 | 2026-09-18 |
| CVE-2026-12648 A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM bef... |
high | 8.8 | — | Ivanti / neurons for itsm | 2026-09-08 | 2026-09-18 |
| CVE-2026-12651 A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM bef... |
high | 8.8 | — | Ivanti / neurons for itsm | 2026-09-08 | 2026-09-18 |
| CVE-2026-81546 The Affinity by Canva application before 3.3.0 (September 2026 release) did not... |
high | 7.7 | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2023-5778 Improper handling of length parameter inconsistency vulnerability in ABB Freelan... |
high | 7.5 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-65388 A remote attacker who controls a container registry may be able to direct a clie... |
high | 7.5 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-92230 Apache Karaf's XmlUtils cached XML parser/transformer factories in static Thread... |
high | 7.5 | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-92943 Improper validation of certificate with host mismatch in the MQTT client TLS con... |
high | 8.1 | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-56997 In Av1DecodeFrameTag of vp9hwd_headers.cc, there is a possible out-of-bounds wri... |
high | 8.8 | — | Google / android | 2026-09-15 | 2026-09-18 |
| CVE-2026-57008 In Modem, there is a possible information disclosure due to improper input valid... |
high | 7.5 | — | Google / android | 2026-09-15 | 2026-09-18 |
| CVE-2026-84566 The issue was addressed with improved memory handling. |
high | 7.8 | — | Apple / ipados | 2026-09-14 | 2026-09-18 |
| CVE-2026-58678 In Bootloader, there is a possible permission bypass due to a logic error in the... |
high | 7.8 | — | Google / android | 2026-09-15 | 2026-09-18 |
| CVE-2026-58679 In gf_ta_test_set_config of gf_ta_test.c, there is a possible heap buffer overfl... |
high | 8.4 | — | Google / android | 2026-09-15 | 2026-09-18 |
| CVE-2026-57014 In phNxpNciHal_ext_process_nfc_init_rsp of phNxpNciHal_ext.cc, there is a possib... |
high | 7.8 | — | Google / android | 2026-09-15 | 2026-09-18 |
| CVE-2026-58683 In IP Multimedia Subsystem, there is a possible out-of-bounds write due to impro... |
high | 8.8 | — | Google / android | 2026-09-15 | 2026-09-18 |
| CVE-2026-58691 In FsmReleaseKey of fsm.c, there is a possible permission bypass due to improper... |
high | 8.4 | — | Google / android | 2026-09-15 | 2026-09-18 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.