September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,186
Critical
1,210
High
4,308
Medium
4,071
Low
456
Severity not reported
1,141
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (605), oracle (274), apple (244), adobe (197), dell (137), ibm (104), arubanetworks (101), mongodb (64), apache (53)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-76409 As part of Cisco's ongoing commitment to proactive security and product quality,... |
high | 8.8 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-75992 Illustrator is affected by an out-of-bounds write vulnerability that could resul... |
high | 7.8 | — | Adobe / illustrator | 2026-09-08 | 2026-09-18 |
| CVE-2026-54510 Speakr is a personal, self-hosted web application designed for transcribing audi... |
high | 7.1 | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-20344 A vulnerability in the web-based management interface of Cisco Secure FMC Softwa... |
high | 8.8 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-75999 ColdFusion is affected by an Improper Input Validation vulnerability that could... |
high | 8.4 | — | Adobe / coldfusion | 2026-09-08 | 2026-09-18 |
| CVE-2026-92134 Jenkins Warnings Plugin 13.10258.va_17d49a_78c3b_ and earlier does not validate... |
high | 8.0 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-92135 Jenkins Coverage Plugin 3.3358.v9487dde48783 and earlier does not validate the c... |
high | 8.0 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-92136 Jenkins OWASP Dependency-Check Plugin 5.6.4 and earlier does not escape CWE valu... |
high | 8.0 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-92137 Jenkins Robot Framework Plugin 6.2.2 and earlier does not check that the archive... |
high | 8.8 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-84620 An integer overflow was addressed with improved input validation. |
high | 7.3 | — | Apple / ipados | 2026-09-14 | 2026-09-18 |
| CVE-2026-20135 A vulnerability in the TLS 1.3 implementation in Cisco Secure Firewall Threat De... |
high | 8.6 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-20222 A vulnerability in the EIGRP implementation in Cisco Secure Firewall Adaptive Se... |
high | 7.4 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-20247 A vulnerability in Cisco ISE could allow an unauthenticated, remote attacker to... |
high | 7.5 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-20250 A vulnerability in Datagram TLS (DTLS) message handling of Cisco Secure Firewall... |
high | 8.6 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-20295 A vulnerability in the sftunnel inter-device communication protocol of Cisco Sec... |
high | 8.6 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-20323 A vulnerability in the sftunnel inter-device communication protocol of Cisco Sec... |
high | 8.3 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-20340 A vulnerability in Cisco Secure FMC Software could allow an authenticated, remot... |
high | 8.8 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-20342 A vulnerability in a specific file download API of Cisco Secure FMC Software cou... |
high | 7.7 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-20352 A vulnerability in the RADIUS feature of Cisco Identity Services Engine (ISE) co... |
high | 8.6 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-20360 As part of Cisco's ongoing commitment to proactive security and product quality,... |
high | 8.8 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-76412 A vulnerability in the remote diagnostics debugger of Cisco Secure FMC Software... |
high | 8.5 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-76413 A vulnerability in Cisco Adaptive Security Device Manager (ASDM) single sign-on... |
high | 8.2 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-83561 The Complianz GDPR/CCPA Cookie Consent Banner plugin for WordPress is vulnerable... |
high | 7.2 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-54671 WeGIA is a web manager for charitable institutions. |
high | 8.8 | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-20280 As part of Cisco's ongoing commitment to proactive security and product quality,... |
high | 8.8 | — | Cisco / ios xr | 2026-09-02 | 2026-09-18 |
| CVE-2026-20276 As part of Cisco's ongoing commitment to proactive security and product quality,... |
high | 8.6 | — | Cisco / ios xr | 2026-09-02 | 2026-09-18 |
| CVE-2026-20277 As part of Cisco's ongoing commitment to proactive security and product quality,... |
high | 8.2 | — | — | 2026-09-02 | 2026-09-18 |
| CVE-2026-20278 As part of Cisco's ongoing commitment to proactive security and product quality,... |
high | 8.8 | — | — | 2026-09-02 | 2026-09-18 |
| CVE-2026-20275 As part of Cisco's ongoing commitment to proactive security and product quality,... |
high | 8.8 | — | — | 2026-09-02 | 2026-09-18 |
| CVE-2026-58699 In Vp9DecEndOfStream of vp9hwd_output.cc, there is a possible out-of-bounds read... |
high | 8.4 | — | Google / android | 2026-09-15 | 2026-09-18 |
| CVE-2026-58701 In trusty_dputc of generic-arm64-smcall.c, there is a possible out-of-bounds wri... |
high | 7.0 | — | Google / android | 2026-09-15 | 2026-09-18 |
| CVE-2026-58710 In DecodeFilmGrainParams of film_grain_dec.cc, there is a possible out-of-bounds... |
high | 8.8 | — | Google / android | 2026-09-15 | 2026-09-18 |
| CVE-2026-58766 In multiple functions of arm-smmu-v3.c, there is a possible escalation of privil... |
high | 7.8 | — | Google / android | 2026-09-15 | 2026-09-18 |
| CVE-2026-58744 In multiple locations, there is a possible escalation of privilege due to improp... |
high | 7.8 | — | Google / android | 2026-09-15 | 2026-09-18 |
| CVE-2026-58734 In google_mba_recv_msg of google_mba_poll.c, there is a possible out-of-bounds w... |
high | 7.0 | — | Google / android | 2026-09-15 | 2026-09-18 |
| CVE-2026-58728 In ARM64_TLBI of mmu.h, there is a possible memory corruption due to a race cond... |
high | 7.0 | — | Google / android | 2026-09-15 | 2026-09-18 |
| CVE-2026-58724 In multiple locations, there is a possible use-after-free due to a race conditio... |
high | 7.0 | — | Google / android | 2026-09-15 | 2026-09-18 |
| CVE-2026-84578 A logic issue was addressed with improved checks. |
high | 8.8 | — | Apple / macos | 2026-09-14 | 2026-09-18 |
| CVE-2026-43815 A buffer overflow was addressed with improved bounds checking. |
high | 8.8 | — | Apple / macos | 2026-09-14 | 2026-09-18 |
| CVE-2026-20361 As part of Cisco's ongoing commitment to proactive security and product quality,... |
high | 8.8 | — | — | 2026-09-16 | 2026-09-18 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.