September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,791
Medium
4,833
Low
527
Severity not reported
2,536
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (328), apple (245), ibm (235), adobe (213), mozilla (191), dell (185), arubanetworks (100), linux (89)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-83097 Vulnerability in the Oracle Forms product of Oracle Fusion Middleware (component... |
medium | 6.5 | — | Oracle / forms | 2026-09-15 | 2026-09-23 |
| CVE-2026-83077 Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM... |
medium | 6.4 | — | Oracle / siebel crm | 2026-09-15 | 2026-09-22 |
| CVE-2026-73965 Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (compone... |
medium | 6.8 | — | Oracle / siebel crm | 2026-09-15 | 2026-09-22 |
| CVE-2026-87284 Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (comp... |
low | 3.2 | — | Oracle / vm virtualbox | 2026-09-15 | 2026-09-23 |
| CVE-2026-87281 Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (comp... |
low | 3.2 | — | Oracle / vm virtualbox | 2026-09-15 | 2026-09-23 |
| CVE-2026-83369 Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (... |
low | 3.1 | — | Oracle / access manager | 2026-09-15 | 2026-09-21 |
| CVE-2026-83413 Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (compo... |
low | 1.9 | — | Oracle / coherence | 2026-09-15 | 2026-09-22 |
| CVE-2026-83414 Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (compo... |
low | 2.5 | — | Oracle / coherence | 2026-09-15 | 2026-09-22 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.