September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,186
Critical
1,210
High
4,308
Medium
4,071
Low
456
Severity not reported
1,141
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (605), oracle (274), apple (244), adobe (197), dell (137), ibm (104), arubanetworks (101), mongodb (64), apache (53)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-83269 Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component:... |
critical | 9.8 | — | — | 2026-09-15 | 2026-09-22 |
| CVE-2026-93605 vm2 NodeVM versions before 3.12.1 contain a sandbox escape vulnerability where t... |
critical | 10.0 | — | — | 2026-09-18 | 2026-09-21 |
| CVE-2024-40766 SonicWall SonicOS Improper Access Control Vulnerability |
critical | 9.8 | Listed | SonicWall / SonicOS | 2024-08-23 | 2026-09-21 |
| CVE-2026-94095 A vulnerability has been found in Netcore NBR200V2 1.3.241127.071246. |
critical | 9.9 | — | — | 2026-09-21 | 2026-09-21 |
| CVE-2026-94100 A weakness has been identified in Netcore NBR200V2 1.3.241127.071246. |
critical | 9.9 | — | — | 2026-09-21 | 2026-09-21 |
| CVE-2026-2771 Undefined behavior in the DOM: Core & HTML component. |
critical | 9.8 | — | Mozilla / firefox | 2026-02-24 | 2026-09-21 |
| CVE-2026-93958 A vulnerability was found in D-Link R95 BE9500_1.00.16. |
critical | 9.1 | — | — | 2026-09-20 | 2026-09-21 |
| CVE-2026-93742 A weakness has been identified in Totolink A3002MU Hh-B20211125.1046. |
critical | 9.9 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-85497 CareCam CM2507 IP cameras store the device's root-account password using a fixed... |
critical | 9.8 | — | — | 2026-09-18 | 2026-09-21 |
| CVE-2026-69586 Integer overflow or wraparound in Microsoft Windows PDF allows an unauthorized a... |
critical | 9.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-21 |
| CVE-2026-73947 Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (... |
critical | 9.8 | — | Oracle / access manager | 2026-09-15 | 2026-09-21 |
| CVE-2026-73950 Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (... |
critical | 9.8 | — | Oracle / access manager | 2026-09-15 | 2026-09-21 |
| CVE-2026-73962 Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (... |
critical | 9.6 | — | Oracle / access manager | 2026-09-15 | 2026-09-21 |
| CVE-2026-73963 Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware... |
critical | 9.8 | — | Oracle / webcenter portal | 2026-09-15 | 2026-09-21 |
| CVE-2026-83001 Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (... |
critical | 9.1 | — | Oracle / access manager | 2026-09-15 | 2026-09-21 |
| CVE-2026-83043 Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware... |
critical | 9.6 | — | Oracle / webcenter portal | 2026-09-15 | 2026-09-21 |
| CVE-2026-83339 Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusio... |
critical | 9.8 | — | Oracle / webcenter enterprise capture | 2026-09-15 | 2026-09-21 |
| CVE-2026-87128 Vulnerability in the Oracle Hyperion Data Relationship Management product of Ora... |
critical | 9.1 | — | Oracle / hyperion data relationship management | 2026-09-15 | 2026-09-21 |
| CVE-2026-71133 Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (... |
critical | 10.0 | — | Oracle / access manager | 2026-09-15 | 2026-09-21 |
| CVE-2026-71163 Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (... |
critical | 9.9 | — | Oracle / access manager | 2026-09-15 | 2026-09-21 |
| CVE-2026-73940 Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (... |
critical | 9.8 | — | Oracle / access manager | 2026-09-15 | 2026-09-21 |
| CVE-2026-73944 Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (... |
critical | 9.1 | — | Oracle / access manager | 2026-09-15 | 2026-09-21 |
| CVE-2026-73948 Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware... |
critical | 9.9 | — | Oracle / webcenter portal | 2026-09-15 | 2026-09-21 |
| CVE-2026-73946 Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (... |
critical | 9.1 | — | Oracle / access manager | 2026-09-15 | 2026-09-21 |
| CVE-2026-73945 Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (... |
critical | 9.9 | — | Oracle / access manager | 2026-09-15 | 2026-09-21 |
| CVE-2026-85385 Concrete CMS below 9.5.4 did not validate the user timezone value (uTimezone) on... |
critical | 9.6 | — | Concretecms / concrete cms | 2026-09-16 | 2026-09-21 |
| CVE-2026-81236 Dell Wyse Management Suite, versions prior to 2605.0.3.683, contain an Unrestric... |
critical | 9.8 | — | Dell / wyse management suite | 2026-09-15 | 2026-09-21 |
| CVE-2026-81238 Dell Wyse Management Suite, versions prior to 2605.0.3.683, contain a Missing Au... |
critical | 9.1 | — | Dell / wyse management suite | 2026-09-15 | 2026-09-21 |
| CVE-2026-81239 Dell Wyse Management Suite, versions prior to 2605.0.3.683, contain an Unrestric... |
critical | 9.8 | — | Dell / wyse management suite | 2026-09-15 | 2026-09-21 |
| CVE-2026-81240 Dell Wyse Management Suite, versions prior to 2605.0.3.683, contain an Unrestric... |
critical | 9.8 | — | Dell / wyse management suite | 2026-09-15 | 2026-09-21 |
| CVE-2026-70416 Dell ObjectScale, versions prior to 4.4.0.0, contains a Deserialization of Untru... |
critical | 9.8 | — | Dell / objectscale | 2026-09-16 | 2026-09-21 |
| CVE-2026-91097 HP has identified and remediated multiple externally reported vulnerabilities wi... |
critical | 9.8 | — | Hp / linux imaging and printing | 2026-09-16 | 2026-09-21 |
| CVE-2026-91098 HP has identified and remediated multiple externally reported vulnerabilities wi... |
critical | 9.8 | — | Hp / linux imaging and printing | 2026-09-16 | 2026-09-21 |
| CVE-2026-91099 HP has identified and remediated multiple externally reported vulnerabilities wi... |
critical | 9.8 | — | Hp / linux imaging and printing | 2026-09-16 | 2026-09-21 |
| CVE-2026-91100 HP has identified and remediated multiple externally reported vulnerabilities wi... |
critical | 9.8 | — | Hp / linux imaging and printing | 2026-09-16 | 2026-09-21 |
| CVE-2026-91101 HP has identified and remediated multiple externally reported vulnerabilities wi... |
critical | 9.8 | — | Hp / linux imaging and printing | 2026-09-16 | 2026-09-21 |
| CVE-2026-91102 HP has identified and remediated multiple externally reported vulnerabilities wi... |
critical | 9.8 | — | Hp / linux imaging and printing | 2026-09-16 | 2026-09-21 |
| CVE-2026-91103 HP has identified and remediated multiple externally reported vulnerabilities wi... |
critical | 9.8 | — | Hp / linux imaging and printing | 2026-09-16 | 2026-09-21 |
| CVE-2026-91104 HP has identified and remediated multiple externally reported vulnerabilities wi... |
critical | 9.8 | — | Hp / linux imaging and printing | 2026-09-16 | 2026-09-21 |
| CVE-2026-91105 HP has identified and remediated multiple externally reported vulnerabilities wi... |
critical | 9.8 | — | Hp / linux imaging and printing | 2026-09-16 | 2026-09-21 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.