September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,186
Critical
1,210
High
4,308
Medium
4,071
Low
456
Severity not reported
1,141
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (605), oracle (274), apple (244), adobe (197), dell (137), ibm (104), arubanetworks (101), mongodb (64), apache (53)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-83042 Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware... |
critical | 9.8 | — | Oracle / identity manager | 2026-09-15 | 2026-09-22 |
| CVE-2026-83054 Vulnerability in the Oracle Internet Directory product of Oracle Fusion Middlewa... |
critical | 9.8 | — | Oracle / internet directory | 2026-09-15 | 2026-09-22 |
| CVE-2026-83059 Vulnerability in the Oracle Internet Directory product of Oracle Fusion Middlewa... |
critical | 10.0 | — | Oracle / internet directory | 2026-09-15 | 2026-09-22 |
| CVE-2026-83060 Vulnerability in the Oracle Internet Directory product of Oracle Fusion Middlewa... |
critical | 9.8 | — | Oracle / internet directory | 2026-09-15 | 2026-09-22 |
| CVE-2026-83061 Vulnerability in the Oracle Internet Directory product of Oracle Fusion Middlewa... |
critical | 9.8 | — | Oracle / internet directory | 2026-09-15 | 2026-09-22 |
| CVE-2026-83062 Vulnerability in the Oracle Internet Directory product of Oracle Fusion Middlewa... |
critical | 9.8 | — | Oracle / internet directory | 2026-09-15 | 2026-09-22 |
| CVE-2026-83066 Vulnerability in the Oracle Internet Directory product of Oracle Fusion Middlewa... |
critical | 9.8 | — | Oracle / internet directory | 2026-09-15 | 2026-09-22 |
| CVE-2026-78030 DBI versions before 1.653 for Perl load arbitrary modules via unvalidated dbm_ty... |
critical | 9.8 | — | — | 2026-09-19 | 2026-09-22 |
| CVE-2016-15059 Net::IDN::Punycode versions before 2.301 for Perl allow a heap buffer overflow v... |
critical | 9.8 | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-87078 Net::IDN::Punycode versions from 2.302 before 2.590 for Perl leak the output buf... |
critical | 9.1 | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-87080 Net::IDN::Punycode::PP versions before 2.590 for Perl decode a truncated label t... |
critical | 9.1 | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-12718 Improper neutralization of special elements used in an SQL command ('SQL injecti... |
critical | 9.8 | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-13355 The Meta Box AIO plugin for WordPress is vulnerable to Privilege Escalation to A... |
critical | 9.8 | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-19658 The Give Tributes plugin for WordPress is vulnerable to PHP Object Injection in... |
critical | 9.8 | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-81642 In NLnet Labs Unbound up to and including 1.26.0, a vulnerability was found in t... |
critical | 9.8 | — | Nlnetlabs / unbound | 2026-09-16 | 2026-09-22 |
| CVE-2026-87184 Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hype... |
critical | 9.8 | — | Oracle / hyperion financial management | 2026-09-15 | 2026-09-22 |
| CVE-2026-86059 Dokploy is a free, self-hostable Platform as a Service (PaaS). |
critical | 9.6 | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-85734 LightRAG provides simple and fast retrieval-augmented generation. |
critical | 9.1 | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-4374 Improper Restriction of XML External Entity Reference vulnerability in RTI Conne... |
critical | 9.1 | — | Rti / connext professional | 2026-04-01 | 2026-09-22 |
| CVE-2026-87129 Vulnerability in the Oracle Hyperion Data Relationship Management product of Ora... |
critical | 9.1 | — | Oracle / hyperion data relationship management | 2026-09-15 | 2026-09-22 |
| CVE-2026-89040 Tencent Mass Service Engine in Cluster (MSEC) allows a remote, unauthenticated a... |
critical | 9.8 | — | — | 2026-09-15 | 2026-09-22 |
| CVE-2026-87223 Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hype... |
critical | 9.1 | — | Oracle / hyperion financial management | 2026-09-15 | 2026-09-22 |
| CVE-2026-87170 Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hype... |
critical | 9.1 | — | Oracle / hyperion financial management | 2026-09-15 | 2026-09-22 |
| CVE-2026-87172 Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hype... |
critical | 9.9 | — | Oracle / hyperion financial management | 2026-09-15 | 2026-09-22 |
| CVE-2026-87173 Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hype... |
critical | 9.1 | — | Oracle / hyperion financial management | 2026-09-15 | 2026-09-22 |
| CVE-2026-87175 Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hype... |
critical | 9.1 | — | Oracle / hyperion financial management | 2026-09-15 | 2026-09-22 |
| CVE-2026-87176 Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hype... |
critical | 9.1 | — | Oracle / hyperion financial management | 2026-09-15 | 2026-09-22 |
| CVE-2026-87186 Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hype... |
critical | 9.6 | — | Oracle / hyperion financial management | 2026-09-15 | 2026-09-22 |
| CVE-2026-87188 Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hype... |
critical | 9.8 | — | Oracle / hyperion financial management | 2026-09-15 | 2026-09-22 |
| CVE-2026-87189 Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hype... |
critical | 9.1 | — | Oracle / hyperion financial management | 2026-09-15 | 2026-09-22 |
| CVE-2026-94099 A security flaw has been discovered in Netcore NBR200V2 1.3.241127.071246. |
critical | 9.9 | — | — | 2026-09-21 | 2026-09-22 |
| CVE-2026-94089 A vulnerability was determined in D-Link DIR-868L 2.01b05. |
critical | 10.0 | — | — | 2026-09-20 | 2026-09-22 |
| CVE-2026-93738 A vulnerability was found in Totolink A3002MU Hh-B20211125.1046. |
critical | 9.9 | — | — | 2026-09-18 | 2026-09-22 |
| CVE-2026-93741 A security flaw has been discovered in Totolink A3002MU Hh-B20211125.1046. |
critical | 10.0 | — | — | 2026-09-19 | 2026-09-22 |
| CVE-2026-79916 MaxKB is an open-source AI assistant for enterprise. |
critical | 9.1 | — | — | 2026-09-21 | 2026-09-22 |
| CVE-2026-93603 vm2 through 3.12.0 (fixed in 3.12.1) does not correctly handle a nullish `this`... |
critical | 10.0 | — | — | 2026-09-18 | 2026-09-22 |
| CVE-2026-77521 MaxKB is an open-source AI assistant for enterprise. |
critical | 10.0 | — | — | 2026-09-21 | 2026-09-22 |
| CVE-2026-69641 Missing authorization in Microsoft Exchange Server allows an authorized attacker... |
critical | 9.1 | — | Microsoft / exchange server | 2026-09-08 | 2026-09-22 |
| CVE-2026-94301 The fix for CVE-2026-47065/ZDRES-232 ("resolveProxyClass Not Overridden - accept... |
critical | 9.8 | — | — | 2026-09-21 | 2026-09-22 |
| CVE-2026-83283 Vulnerability in the Oracle Business Intelligence Enterprise Edition product of... |
critical | 9.8 | — | — | 2026-09-15 | 2026-09-22 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.