September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,186
Critical
1,210
High
4,308
Medium
4,071
Low
456
Severity not reported
1,141
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (605), oracle (274), apple (244), adobe (197), dell (137), ibm (104), arubanetworks (101), mongodb (64), apache (53)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2024-23176 An issue was discovered in the MassMessage extension in MediaWiki before 1.40.2. |
medium | 5.4 | — | — | 2026-09-14 | 2026-09-28 |
| CVE-2024-58384 Tornado before 6.4.1 contains a CRLF injection vulnerability in CurlAsyncHTTPCli... |
medium | 5.4 | — | — | 2026-09-15 | 2026-09-28 |
| CVE-2024-38639 An improper authentication vulnerability has been reported to affect product. |
medium | 4.8 | — | — | 2026-09-18 | 2026-09-28 |
| CVE-2024-56344 IBM Cognos Analytics 12.0.4 through 12.0.4 FP2, and 12.1.0 through 12.1.3 FP1 co... |
medium | 5.9 | — | — | 2026-09-18 | 2026-09-28 |
| CVE-2026-76717 A vulnerability exists in the Analytics and Location Engine (ALE) API that may a... |
medium | 5.3 | — | Arubanetworks / analytics and location engine | 2026-09-22 | 2026-09-28 |
| CVE-2026-76716 Multiple vulnerabilities exist in the Analytics and Location Engine (ALE) that m... |
medium | 5.3 | — | Arubanetworks / analytics and location engine | 2026-09-22 | 2026-09-28 |
| CVE-2026-76698 A command injection vulnerability exists in the web-based management interface o... |
medium | 6.5 | — | Arubanetworks / edgeconnect sd-wan orchestrator | 2026-09-15 | 2026-09-28 |
| CVE-2026-76700 Vulnerabilities in HPE Networking EdgeConnect SD-WAN Gateways could allow an una... |
medium | 5.9 | — | Arubanetworks / edgeconnect sd-wan orchestrator | 2026-09-15 | 2026-09-28 |
| CVE-2026-76699 A buffer overflow vulnerability exists in a system service within the underlying... |
medium | 6.4 | — | Arubanetworks / edgeconnect sd-wan orchestrator | 2026-09-15 | 2026-09-28 |
| CVE-2026-76701 A vulnerability in the API endpoint of HPE Networking EdgeConnect SD-WAN Gateway... |
medium | 5.9 | — | Arubanetworks / edgeconnect sd-wan orchestrator | 2026-09-15 | 2026-09-28 |
| CVE-2026-76702 A vulnerability in the operating system of HPE Networking EdgeConnect SD-WAN Gat... |
medium | 5.8 | — | Arubanetworks / edgeconnect sd-wan orchestrator | 2026-09-15 | 2026-09-28 |
| CVE-2026-76703 A buffer overflow vulnerability exists in the web-based management interface of... |
medium | 5.5 | — | Arubanetworks / edgeconnect sd-wan orchestrator | 2026-09-15 | 2026-09-28 |
| CVE-2026-76707 A vulnerability in HPE Networking EdgeConnect SD-WAN Gateways could allow an una... |
medium | 4.3 | — | Arubanetworks / edgeconnect sd-wan orchestrator | 2026-09-15 | 2026-09-28 |
| CVE-2026-76705 A buffer overflow vulnerability exists in the API endpoint of HPE Networking Edg... |
medium | 5.5 | — | Arubanetworks / edgeconnect sd-wan orchestrator | 2026-09-15 | 2026-09-28 |
| CVE-2026-76697 A vulnerability in the web-based management interface of HPE Networking EdgeConn... |
medium | 6.5 | — | Arubanetworks / edgeconnect sd-wan orchestrator | 2026-09-15 | 2026-09-28 |
| CVE-2026-76696 A vulnerability in HPE Networking EdgeConnect SD-WAN Gateways could allow an una... |
medium | 6.5 | — | Arubanetworks / edgeconnect sd-wan orchestrator | 2026-09-15 | 2026-09-28 |
| CVE-2026-76695 Buffer overflow vulnerabilities exist in the underlying operating system of HPE... |
medium | 6.5 | — | Arubanetworks / edgeconnect sd-wan orchestrator | 2026-09-15 | 2026-09-28 |
| CVE-2026-76694 A privilege escalation vulnerability exists in the command line interface of HPE... |
medium | 6.6 | — | Arubanetworks / edgeconnect sd-wan orchestrator | 2026-09-15 | 2026-09-28 |
| CVE-2026-77270 MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (C... |
medium | 6.5 | — | Mcp-atlassian / mcp atlassian | 2026-09-22 | 2026-09-28 |
| CVE-2026-8030 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.0... |
medium | 4.3 | — | Gitlab / gitlab | 2026-09-16 | 2026-09-28 |
| CVE-2026-7514 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.9... |
medium | 4.3 | — | Gitlab / gitlab | 2026-09-16 | 2026-09-28 |
| CVE-2026-3855 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2.... |
medium | 6.8 | — | Gitlab / gitlab | 2026-09-16 | 2026-09-28 |
| CVE-2026-81885 radare2 is a UNIX-like reverse engineering framework and command-line toolset. |
medium | 5.5 | — | Radare / radare2 | 2026-09-22 | 2026-09-28 |
| CVE-2026-78252 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.3... |
medium | 6.1 | — | Gitlab / gitlab | 2026-09-16 | 2026-09-28 |
| CVE-2026-81886 radare2 is a UNIX-like reverse engineering framework and command-line toolset. |
medium | 5.5 | — | Radare / radare2 | 2026-09-22 | 2026-09-28 |
| CVE-2026-77256 MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (C... |
medium | 6.5 | — | Mcp-atlassian / mcp atlassian | 2026-09-22 | 2026-09-28 |
| CVE-2026-76433 A vulnerability in the client provisioning download feature of Cisco ISE and Cis... |
medium | 5.3 | — | Cisco / identity services engine | 2026-09-16 | 2026-09-28 |
| CVE-2026-76432 A vulnerability in the web-based management interface of Cisco ISE and Cisco ISE... |
medium | 4.9 | — | Cisco / identity services engine | 2026-09-16 | 2026-09-28 |
| CVE-2026-76431 A vulnerability in the file management function of the web-based management inte... |
medium | 4.9 | — | Cisco / identity services engine | 2026-09-16 | 2026-09-28 |
| CVE-2026-76434 A vulnerability in the certificate import functionality of the web-based managem... |
medium | 4.9 | — | Cisco / identity services engine | 2026-09-16 | 2026-09-28 |
| CVE-2026-77266 MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (C... |
medium | 6.5 | — | Mcp-atlassian / mcp atlassian | 2026-09-22 | 2026-09-28 |
| CVE-2026-76439 A vulnerability in the endpoint posture status reporting functionality of the gu... |
medium | 5.3 | — | Cisco / identity services engine | 2026-09-16 | 2026-09-28 |
| CVE-2026-76446 A vulnerability in an API of Cisco ISE and Cisco ISE-PIC could allow an authenti... |
medium | 4.9 | — | Cisco / identity services engine | 2026-09-16 | 2026-09-28 |
| CVE-2026-76428 A vulnerability in the REST APIs of Cisco ISE and Cisco ISE-PIC could allow an a... |
medium | 4.9 | — | Cisco / identity services engine | 2026-09-16 | 2026-09-28 |
| CVE-2026-77272 MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (C... |
medium | 6.1 | — | Mcp-atlassian / mcp atlassian | 2026-09-22 | 2026-09-28 |
| CVE-2026-76447 A vulnerability in the Online Certificate Status Protocol (OCSP) responder of Ci... |
medium | 5.3 | — | Cisco / identity services engine passive identity connector | 2026-09-16 | 2026-09-28 |
| CVE-2026-76444 A vulnerability in an internal service of Cisco ISE and Cisco ISE-PIC could allo... |
medium | 5.3 | — | Cisco / identity services engine passive identity connector | 2026-09-16 | 2026-09-28 |
| CVE-2026-76449 A vulnerability in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Id... |
medium | 4.9 | — | Cisco / identity services engine | 2026-09-16 | 2026-09-28 |
| CVE-2026-76450 A vulnerability in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Id... |
medium | 4.9 | — | Cisco / identity services engine | 2026-09-16 | 2026-09-28 |
| CVE-2026-76451 A vulnerability in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Id... |
medium | 4.9 | — | Cisco / identity services engine passive identity connector | 2026-09-16 | 2026-09-28 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.