September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,186
Critical
1,210
High
4,308
Medium
4,071
Low
456
Severity not reported
1,141
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (605), oracle (274), apple (244), adobe (197), dell (137), ibm (104), arubanetworks (101), mongodb (64), apache (53)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-58695 In gmc_phy_lp3_exit_restore_registers of phy_power.c, there is a possible escala... |
high | 7.8 | — | Google / android | 2026-09-15 | 2026-09-18 |
| CVE-2026-83319 Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component:... |
high | 7.7 | — | — | 2026-09-15 | 2026-09-18 |
| CVE-2026-83320 Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component:... |
high | 7.6 | — | — | 2026-09-15 | 2026-09-18 |
| CVE-2026-86901 An out-of-bounds write issue was addressed with improved bounds checking. |
high | 7.1 | — | Apple / macos | 2026-09-14 | 2026-09-18 |
| CVE-2026-69574 Use after free in Windows Device Association Service allows an authorized attack... |
high | 7.0 | — | Microsoft / windows 10 1809 | 2026-09-08 | 2026-09-18 |
| CVE-2026-93594 ArcadeDB (Maven artifact com.arcadedb:arcadedb-engine) through 26.8.1 enforces i... |
high | 8.1 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-89413 The Filter Gallery plugin for WordPress is vulnerable to authorization bypass in... |
high | 8.1 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-87915 The Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimat... |
high | 7.2 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-85705 The Location Manager plugin for WordPress is vulnerable to generic SQL Injection... |
high | 7.5 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-20300 A vulnerability in Cisco ISE could allow an authenticated, remote attacker to co... |
high | 7.1 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-20343 A vulnerability in a critical API for Cisco Secure FMC Software could allow an u... |
high | 7.5 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-20154 A vulnerability in the system rate-limiting process for syslog message 419002 of... |
high | 8.6 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-20249 A vulnerability in the certification authentication feature of Internet Key Exch... |
high | 8.6 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-17086 The ShortPixel Image Optimizer – Optimize Images, Convert WebP & AVIF plugin for... |
high | 8.8 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-18912 ManageEngine DataSecurity Plus versions before 6310 are vulnerable to an authent... |
high | 7.7 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-14323 The Printcart Web to Print Product Designer for WooCommerce plugin for WordPress... |
high | 7.5 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-84572 An out-of-bounds read was addressed with improved bounds checking. |
high | 7.1 | — | Apple / macos | 2026-09-14 | 2026-09-18 |
| CVE-2026-71404 A flaw was found in Rancher Manager. |
high | 8.7 | — | Suse / rancher | 2026-09-03 | 2026-09-18 |
| CVE-2026-75033 A flaw was found in Rancher Manager. |
high | 7.7 | — | Suse / rancher | 2026-09-03 | 2026-09-18 |
| CVE-2026-65375 The issue was addressed with improved authentication. |
high | 7.5 | — | Apple / macos | 2026-09-14 | 2026-09-18 |
| CVE-2026-69587 Null pointer dereference in Windows IKE Extension allows an unauthorized attacke... |
high | 7.5 | — | Microsoft / windows 11 23h2 | 2026-09-08 | 2026-09-18 |
| CVE-2026-65357 The issue was addressed with improved memory handling. |
high | 7.8 | — | Apple / ipados | 2026-09-14 | 2026-09-18 |
| CVE-2026-65354 A permissions issue was addressed with additional restrictions. |
high | 8.2 | — | Apple / ipados | 2026-09-14 | 2026-09-18 |
| CVE-2026-43683 An out-of-bounds read was addressed with improved bounds checking. |
high | 7.1 | — | Apple / macos | 2026-09-14 | 2026-09-18 |
| CVE-2026-74761 Improper input validation in TopicRegion in Apache ActiveMQ, Apache ActiveMQ Bro... |
high | 7.5 | — | Apache / activemq | 2026-09-09 | 2026-09-18 |
| CVE-2026-79993 The `deleteContainer` opcode (0x14/20) is processed without verifying the caller... |
high | 7.5 | — | Apache / zookeeper | 2026-09-16 | 2026-09-18 |
| CVE-2026-59739 Information disclosure via SetWatches reconnect replay in Apache ZooKeeper due t... |
high | 7.5 | — | Apache / zookeeper | 2026-09-16 | 2026-09-18 |
| CVE-2026-69588 Missing release of memory after effective lifetime in Windows TCP/IP allows an u... |
high | 7.5 | — | Microsoft / windows 11 23h2 | 2026-09-08 | 2026-09-18 |
| CVE-2026-59969 Apache ZooKeeper quorum TLS fails to enforce peer hostname verification in FIPS-... |
high | 7.5 | — | Apache / zookeeper | 2026-09-16 | 2026-09-18 |
| CVE-2026-86792 Apache Airflow Apache Kafka provider versions 1.15.0 before 2.0.0 resolve dotted... |
high | 8.8 | — | Apache / apache-airflow-providers-apache-kafka | 2026-09-16 | 2026-09-18 |
| CVE-2026-86466 Apache Airflow FAB provider: the Authentik OAuth path in the FAB auth manager do... |
high | 8.1 | — | Apache / apache-airflow-providers-fab | 2026-09-16 | 2026-09-18 |
| CVE-2026-82310 Apache Airflow FAB provider: deactivating a user account does not stop tokens is... |
high | 7.2 | — | Apache / apache-airflow-providers-fab | 2026-09-16 | 2026-09-18 |
| CVE-2026-76190 ColdFusion is affected by an Improper Neutralization of Directives in Dynamicall... |
high | 8.6 | — | Adobe / coldfusion | 2026-09-08 | 2026-09-18 |
| CVE-2026-75993 ColdFusion is affected by a reflected Cross-Site Scripting (XSS) vulnerability. |
high | 8.5 | — | Adobe / coldfusion | 2026-09-08 | 2026-09-18 |
| CVE-2026-75998 ColdFusion is affected by an Improper Access Control vulnerability that could le... |
high | 7.5 | — | Adobe / coldfusion | 2026-09-08 | 2026-09-18 |
| CVE-2026-75990 Illustrator is affected by an Incorrect Authorization vulnerability that could r... |
high | 8.6 | — | Adobe / illustrator | 2026-09-08 | 2026-09-18 |
| CVE-2026-75991 Illustrator is affected by an Improper Input Validation vulnerability that could... |
high | 8.6 | — | Adobe / illustrator | 2026-09-08 | 2026-09-18 |
| CVE-2026-93604 vm2 through 3.12.0 exposes Node.js's crypto.setFips() function to untrusted gues... |
high | 7.2 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-91732 Missing authorization in AppManifest in Google Chrome prior to 153.0.8010.47 all... |
high | 8.1 | — | Google / chrome | 2026-09-15 | 2026-09-18 |
| CVE-2026-91719 Code injection in XML in Google Chrome prior to 153.0.8010.47 allowed a remote a... |
high | 8.1 | — | Google / chrome | 2026-09-15 | 2026-09-18 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.