September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,186
Critical
1,210
High
4,308
Medium
4,071
Low
456
Severity not reported
1,141
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (605), oracle (274), apple (244), adobe (197), dell (137), ibm (104), arubanetworks (101), mongodb (64), apache (53)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-77006 The WebTotem Backups WordPress plugin before 1.1.0 does not validate a user-supp... |
critical | 9.6 | — | — | 2026-09-12 | 2026-09-23 |
| CVE-2000-0944 CGI Script Center News Update 1.1 does not properly validate the original news a... |
critical | 9.8 | — | Cgi / script center news update | 2000-12-19 | 2026-09-23 |
| CVE-2026-74849 Zohocorp ManageEngine ADSelfService Plus versions before build 7001 are vulnerab... |
critical | 9.8 | — | — | 2026-09-22 | 2026-09-23 |
| CVE-2026-44756 A memory safety vulnerability exists in the Extended Passport Protocol (EPP) pro... |
critical | 10.0 | — | — | 2026-09-08 | 2026-09-22 |
| CVE-2026-93839 LightLLM through 1.2.0 contains an authentication bypass vulnerability in the /p... |
critical | 9.8 | — | — | 2026-09-18 | 2026-09-22 |
| CVE-2026-73749 Multiple vulnerabilities exist in a daemon of AOS-CX that may allow for improper... |
critical | 9.8 | — | Hpe / arubaos-cx | 2026-09-01 | 2026-09-22 |
| CVE-2023-54399 Hongjing e-HR before 8.2 contains a SQL injection vulnerability in the /servlet/... |
critical | 9.8 | — | — | 2026-09-18 | 2026-09-22 |
| CVE-2026-92805 UVdesk Community Skeleton through 1.1.8 fails to authenticate or validate instal... |
critical | 9.8 | — | — | 2026-09-16 | 2026-09-22 |
| CVE-2026-78623 The Okta Access Gateway does not sanitize SAML assertion values before interpola... |
critical | 9.9 | — | Okta / access gateway | 2026-09-08 | 2026-09-22 |
| CVE-2026-95675 D-Link DAP-1360 firmware version 6.14 and earlier contains an unauthenticated re... |
critical | 9.8 | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-93012 Email::Sender::Transport::Sendmail versions before 2.602 for Perl allow arbitrar... |
critical | 9.8 | — | — | 2026-09-21 | 2026-09-22 |
| CVE-2026-79313 webpy web.py 0.76 is vulnerable to Insufficient Session Expiration. |
critical | 9.8 | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-23813 A vulnerability has been identified in the web-based management interface of AOS... |
critical | 9.8 | — | Hpe / arubaos-cx | 2026-03-11 | 2026-09-22 |
| CVE-2026-89086 In the jose package before 0.11.0 for OCaml, library calls to validate an RSA si... |
critical | 9.1 | — | — | 2026-09-10 | 2026-09-22 |
| CVE-2026-89094 Forgejo before 16.0.4 allows remote code execution via a crafted template reposi... |
critical | 9.9 | — | — | 2026-09-10 | 2026-09-22 |
| CVE-2026-71640 An issue in ZJU-FAST-Lab EGO-Planner-v2 All versions up to commit 5c99a95880401e... |
critical | 9.1 | — | — | 2026-09-10 | 2026-09-22 |
| CVE-2026-71644 An issue in Robotics-STAR-Lab (SYSU STAR Group) RACER Tested affected version: c... |
critical | 9.8 | — | — | 2026-09-11 | 2026-09-22 |
| CVE-2026-79395 An improper authentication vulnerability in the WS-Security (wsse:UsernameToken)... |
critical | 9.8 | — | — | 2026-09-11 | 2026-09-22 |
| CVE-2026-79396 Use of hardcoded default credentials in Xiongmai IP Camera XM530 firmware HMT.CM... |
critical | 9.8 | — | — | 2026-09-11 | 2026-09-22 |
| CVE-2026-52630 SQL Injection vulnerability in Woltlab WCF v.6.2.4 and before allows a remote at... |
critical | 9.8 | — | — | 2026-09-11 | 2026-09-22 |
| CVE-2026-79303 kaiten from 57.192.20 to before 57.214.26 is vulnerable to SQL Injection. |
critical | 9.9 | — | — | 2026-09-15 | 2026-09-22 |
| CVE-2026-88617 SmartAdmin v3.30.0 contains an authorization flaw in the configuration query end... |
critical | 9.8 | — | — | 2026-09-15 | 2026-09-22 |
| CVE-2026-37152 TOTOLINK X5000R V9.1.0cu.2415_B20250515 was discovered to contain a hardcoded pa... |
critical | 9.8 | — | — | 2026-09-15 | 2026-09-22 |
| CVE-2026-51990 An issue in Sogou Sogou Input Method < 16.3.0.3498 (fixed in 16.3.0.3498) allows... |
critical | 9.8 | — | — | 2026-09-16 | 2026-09-22 |
| CVE-2026-88592 kkFileView >= 4.2.0 is vulnerable to Server-Side Request Forgery (SSRF). |
critical | 9.1 | — | — | 2026-09-16 | 2026-09-22 |
| CVE-2026-88402 A SQL injection vulnerability in the checkSQL function of nocobase v2.1.21 allow... |
critical | 9.8 | — | — | 2026-09-21 | 2026-09-22 |
| CVE-2026-88404 A remote code execution (RCE) vulnerability in the UniscriptExecutionService.exe... |
critical | 9.8 | — | — | 2026-09-21 | 2026-09-22 |
| CVE-2026-78847 An issue in gray-matter All versions (verified on 4.0.3) allows the JavaScript e... |
critical | 9.8 | — | — | 2026-09-21 | 2026-09-22 |
| CVE-2024-26305 There is a buffer overflow vulnerability in the underlying Utility daemon that c... |
critical | 9.8 | — | Arubanetworks / sd-wan | 2024-05-01 | 2026-09-22 |
| CVE-2026-73952 Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware... |
critical | 9.1 | — | Oracle / webcenter portal | 2026-09-15 | 2026-09-22 |
| CVE-2026-73953 Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware... |
critical | 9.8 | — | Oracle / webcenter portal | 2026-09-15 | 2026-09-22 |
| CVE-2026-73956 Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware... |
critical | 9.8 | — | Oracle / webcenter portal | 2026-09-15 | 2026-09-22 |
| CVE-2026-73957 Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware... |
critical | 9.3 | — | Oracle / webcenter portal | 2026-09-15 | 2026-09-22 |
| CVE-2026-90817 An unauthenticated Remote Code Execution vulnerability was found in the survey p... |
critical | 9.8 | — | — | 2026-09-20 | 2026-09-22 |
| CVE-2026-94456 Postiz generates security-sensitive credentials using `Math.random()` instead of... |
critical | 9.1 | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-75878 IBM Sterling File Gateway could allow a remote attacker to bypass authentication... |
critical | 9.1 | — | — | 2026-09-18 | 2026-09-22 |
| CVE-2026-93088 SGLang's multimodal generation runtime is vulnerable to unauthenticated arbitrar... |
critical | 9.8 | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-73639 Imager::File::PNG versions from 1.003 before 1.004 for Perl write past the end o... |
critical | 9.1 | — | — | 2026-09-17 | 2026-09-22 |
| CVE-2026-83006 Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusio... |
critical | 9.1 | — | Oracle / webcenter enterprise capture | 2026-09-15 | 2026-09-22 |
| CVE-2026-83027 Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion... |
critical | 9.3 | — | Oracle / identity manager connector | 2026-09-15 | 2026-09-22 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.