September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,186
Critical
1,210
High
4,308
Medium
4,071
Low
456
Severity not reported
1,141
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (605), oracle (274), apple (244), adobe (197), dell (137), ibm (104), arubanetworks (101), mongodb (64), apache (53)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-73771 An authentication vulnerability exists in the AOS-CX management interface and AP... |
high | 7.5 | — | Hpe / arubaos-cx | 2026-09-01 | 2026-09-04 |
| CVE-2026-73770 An authenticated arbitrary file write vulnerability exists in AOS-CX. |
high | 7.3 | — | Hpe / arubaos-cx | 2026-09-01 | 2026-09-04 |
| CVE-2026-73768 A vulnerability exists in the command line interface of AOS-CX that may allow fo... |
high | 7.3 | — | Hpe / arubaos-cx | 2026-09-01 | 2026-09-04 |
| CVE-2026-73767 Authenticated command injection vulnerabilities exist in the command line interf... |
high | 7.2 | — | Hpe / arubaos-cx | 2026-09-01 | 2026-09-04 |
| CVE-2026-73766 Command injection vulnerabilities in the API endpoint of AOS-CX could allow an a... |
high | 7.2 | — | Hpe / arubaos-cx | 2026-09-01 | 2026-09-04 |
| CVE-2026-73765 Authenticated path traversal vulnerabilities exist in API endpoints of AOS-CX. |
high | 7.2 | — | Hpe / arubaos-cx | 2026-09-01 | 2026-09-04 |
| CVE-2026-73773 An unauthenticated Denial-of-Service (DoS) vulnerability exists in the API endpo... |
high | 7.5 | — | Hpe / arubaos-cx | 2026-09-01 | 2026-09-04 |
| CVE-2026-73774 A buffer overflow vulnerability exists in the underlying operating system of AOS... |
high | 7.6 | — | Hpe / arubaos-cx | 2026-09-01 | 2026-09-04 |
| CVE-2026-73775 Vulnerabilities in the API endpoint of AOS-CX could allow a remote attacker auth... |
high | 7.7 | — | Hpe / arubaos-cx | 2026-09-01 | 2026-09-04 |
| CVE-2026-73776 A signature verification bypass vulnerability exists in the command line interfa... |
high | 7.9 | — | Hpe / arubaos-cx | 2026-09-01 | 2026-09-04 |
| CVE-2026-73777 Vulnerabilities have been identified in the API endpoint of AOS-CX switches that... |
high | 8.1 | — | Hpe / arubaos-cx | 2026-09-01 | 2026-09-04 |
| CVE-2026-73779 Vulnerabilities have been identified in the operating system of AOS-CX switches... |
high | 8.2 | — | Hpe / arubaos-cx | 2026-09-01 | 2026-09-04 |
| CVE-2026-73782 A format string vulnerability exists in the command line interface of AOS-CX tha... |
high | 8.8 | — | Hpe / arubaos-cx | 2026-09-01 | 2026-09-04 |
| CVE-2026-73781 A vulnerability in the web-based management interface of AOS-CX could allow an a... |
high | 8.4 | — | Hpe / arubaos-cx | 2026-09-01 | 2026-09-04 |
| CVE-2026-84848 Unauthenticated Cross Site Scripting (XSS) in Quick Event Manager <= 9.17 versio... |
high | 7.1 | — | — | 2026-09-03 | 2026-09-04 |
| CVE-2026-81776 Unauthenticated Cross Site Scripting (XSS) in WP QuickLaTeX <= 3.8.8 versions. |
high | 7.1 | — | — | 2026-09-03 | 2026-09-04 |
| CVE-2026-84761 Unauthenticated Server Side Request Forgery (SSRF) in LiteSpeed Cache <= 7.9 ver... |
high | 7.2 | — | — | 2026-09-03 | 2026-09-04 |
| CVE-2026-84776 Unauthenticated Denial of Service Attack in MalCare Security <= 6.69 versions. |
high | 7.5 | — | — | 2026-09-03 | 2026-09-04 |
| CVE-2026-80751 In the Linux kernel, the following vulnerability has been resolved:
pmdomain: m... |
high | 7.8 | — | — | 2026-09-03 | 2026-09-04 |
| CVE-2026-80752 In the Linux kernel, the following vulnerability has been resolved:
Input: psxp... |
high | 8.4 | — | — | 2026-09-03 | 2026-09-04 |
| CVE-2026-80735 In the Linux kernel, the following vulnerability has been resolved:
ovpn: ensur... |
high | 7.3 | — | — | 2026-09-03 | 2026-09-04 |
| CVE-2026-80736 In the Linux kernel, the following vulnerability has been resolved:
thunderbolt... |
high | 7.8 | — | — | 2026-09-03 | 2026-09-04 |
| CVE-2026-80741 In the Linux kernel, the following vulnerability has been resolved:
drm/log: Fi... |
high | 7.1 | — | — | 2026-09-03 | 2026-09-04 |
| CVE-2026-80745 In the Linux kernel, the following vulnerability has been resolved:
regulator:... |
high | 8.4 | — | — | 2026-09-03 | 2026-09-04 |
| CVE-2026-80748 In the Linux kernel, the following vulnerability has been resolved:
mmc: loongs... |
high | 7.8 | — | — | 2026-09-03 | 2026-09-04 |
| CVE-2026-80749 In the Linux kernel, the following vulnerability has been resolved:
drm/connect... |
high | 7.1 | — | — | 2026-09-03 | 2026-09-04 |
| CVE-2026-80750 In the Linux kernel, the following vulnerability has been resolved:
pmdomain: m... |
high | 8.4 | — | — | 2026-09-03 | 2026-09-04 |
| CVE-2026-80732 In the Linux kernel, the following vulnerability has been resolved:
ata: pata_s... |
high | 7.8 | — | — | 2026-09-03 | 2026-09-04 |
| CVE-2026-84764 Unauthenticated Cross Site Request Forgery (CSRF) in Simply Schedule Appointment... |
high | 8.8 | — | — | 2026-09-02 | 2026-09-04 |
| CVE-2026-84794 Craft CMS versions before 5.10.11 lack authorization checks in the assets/move-a... |
high | 7.1 | — | — | 2026-09-02 | 2026-09-04 |
| CVE-2026-84441 A security vulnerability has been detected in Piwigo up to 16.3.0. |
high | 7.3 | — | — | 2026-09-02 | 2026-09-04 |
| CVE-2026-81769 Incorrect Privilege Assignment vulnerability in LiquidThemes Booking Hub allows... |
high | 8.8 | — | — | 2026-09-02 | 2026-09-04 |
| CVE-2026-81775 Unauthenticated Cross Site Scripting (XSS) in Estatik <= 4.3.4 versions. |
high | 7.1 | — | — | 2026-09-02 | 2026-09-04 |
| CVE-2026-14982 The WP File Download plugin for WordPress is vulnerable to arbitrary file deleti... |
high | 8.1 | — | — | 2026-09-02 | 2026-09-04 |
| CVE-2026-84640 A maliciously constructed mail header could lead to a one byte read past the end... |
high | 7.5 | — | Mozilla / thunderbird | 2026-09-01 | 2026-09-03 |
| CVE-2026-84641 A malicious IMAP server can trigger use-after-free and heap-memory disclosure by... |
high | 7.5 | — | Mozilla / thunderbird | 2026-09-01 | 2026-09-03 |
| CVE-2026-84642 The values of the mail.allowed_attachment_hostnames advanced config setting were... |
high | 7.5 | — | Mozilla / thunderbird | 2026-09-01 | 2026-09-03 |
| CVE-2026-84130 Information disclosure in the Graphics: WebGPU component. |
high | 7.5 | — | Mozilla / firefox | 2026-09-01 | 2026-09-03 |
| CVE-2026-84132 Information disclosure in the Networking: HTTP component. |
high | 7.5 | — | Mozilla / firefox | 2026-09-01 | 2026-09-03 |
| CVE-2026-84836 Subscriber Insecure Direct Object References (IDOR) in WC Ukraine Shipping <= 1.... |
high | 7.1 | — | — | 2026-09-03 | 2026-09-03 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.