September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,186
Critical
1,210
High
4,308
Medium
4,071
Low
456
Severity not reported
1,141
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (605), oracle (274), apple (244), adobe (197), dell (137), ibm (104), arubanetworks (101), mongodb (64), apache (53)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-20332 As part of Cisco's ongoing commitment to proactive security and product quality,... |
critical | 9.9 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-20329 As part of Cisco's ongoing commitment to proactive security and product quality,... |
critical | 9.9 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-20330 As part of Cisco's ongoing commitment to proactive security and product quality,... |
critical | 9.9 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-13684 An improper encoding or escaping of output vulnerability in SCGI in Synology Dis... |
critical | 9.8 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-13639 An insufficient entropy vulnerability in login logic in Synology DiskStation Man... |
critical | 9.8 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-66890 The affected products use hard-coded credentials, which could allow remote acces... |
critical | 9.6 | — | — | 2026-09-15 | 2026-09-18 |
| CVE-2026-66887 The affected products are missing authorization on state-changing CGIs and sessi... |
critical | 9.6 | — | — | 2026-09-15 | 2026-09-18 |
| CVE-2026-73807 The mySCADA myPRO Manager command API does not properly enforce authentication f... |
critical | 9.8 | — | — | 2026-09-15 | 2026-09-18 |
| CVE-2026-91843 A stack overflow during the unauthenticated login process may allow an attacker... |
critical | 9.8 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-90898 Bifrost registers MCP clients through its management API. |
critical | 9.8 | — | — | 2026-09-14 | 2026-09-18 |
| CVE-2026-80462 A vulnerability in the Chef Automate API gateway and identity validation path ma... |
critical | 10.0 | — | — | 2026-09-11 | 2026-09-18 |
| CVE-2026-90822 FatPipe MPVPN, WARP, and IPVPN appliances running the end-of-life firmware versi... |
critical | 9.8 | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-90823 FatPipe MPVPN, WARP, and IPVPN appliances running the end-of-life firmware versi... |
critical | 9.8 | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-18119 Concrete CMS below 9.5.3 did not sanitize custom style values in the Block Desig... |
critical | 9.0 | — | Concretecms / concrete cms | 2026-09-14 | 2026-09-18 |
| CVE-2026-93467 The OAKlouds developed by HGiga has a Insecure Deserialization vulnerability. |
critical | 9.8 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-19773 libwebsockets HTTP/2 HPACK Path Header Parsing Out-Of-Bounds Write Remote Code E... |
critical | 9.8 | — | — | 2026-09-15 | 2026-09-18 |
| CVE-2026-86707 The Private Feed Key WordPress plugin through 0.1 does not verify that the key u... |
critical | 9.8 | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-86709 The Pressengine WordPress plugin through 1.0 does not stop its login handler fro... |
critical | 9.8 | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-86710 The Login with QR WordPress plugin through 1.0.0 does not verify that the code u... |
critical | 9.8 | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-88795 The wpShopGermany IT-RECHT KANZLEI WordPress plugin before 2.4 does not generate... |
critical | 9.0 | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-84738 The AF Companion WordPress plugin before 2.2.0 does not validate the type of fil... |
critical | 9.1 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-75031 In the interchange/interchange project, a critical remote code execution (RCE) v... |
critical | 9.8 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-86426 LibreNMS before 26.8.0 contains an authentication bypass vulnerability in the RE... |
critical | 9.8 | — | Librenms / librenms | 2026-09-07 | 2026-09-18 |
| CVE-2026-93606 vm2 (npm) versions 3.12.0 and earlier contain a sandbox escape in `VM` and `Node... |
critical | 10.0 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-93019 Imager versions before 1.036 for Perl exit the process reading a TGA with a colo... |
critical | 9.1 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-86184 Lara Dashboard before 1.3.0 contains an authentication bypass vulnerability in t... |
critical | 9.8 | — | — | 2026-09-05 | 2026-09-18 |
| CVE-2026-86189 WWBN AVideo contains a path traversal vulnerability in notify.ffmpeg.json.php th... |
critical | 9.8 | — | — | 2026-09-05 | 2026-09-18 |
| CVE-2026-12744 A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM bef... |
critical | 9.8 | — | Ivanti / neurons for itsm | 2026-09-08 | 2026-09-18 |
| CVE-2026-12745 A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM bef... |
critical | 9.8 | — | Ivanti / neurons for itsm | 2026-09-08 | 2026-09-18 |
| CVE-2026-90999 Sentry Seer is vulnerable to a multi-stage trust-boundary violation that allows... |
critical | 9.8 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-84383 libheif is a HEIF and AVIF file format decoder and encoder. |
critical | 9.8 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-20325 As part of Cisco's ongoing commitment to proactive security and product quality,... |
critical | 9.9 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-86462 Apache Airflow FAB provider: changing a user's password through the Admin user-e... |
critical | 9.1 | — | Apache / apache-airflow-providers-fab | 2026-09-16 | 2026-09-18 |
| CVE-2026-82311 Apache Airflow FAB provider: resetting a user's password does not delete that us... |
critical | 9.8 | — | Apache / apache-airflow-providers-fab | 2026-09-16 | 2026-09-18 |
| CVE-2026-76187 Apache Airflow Keycloak provider: the unauthenticated token endpoint accepts a c... |
critical | 9.8 | — | Apache / apache-airflow-providers-keycloak | 2026-09-16 | 2026-09-18 |
| CVE-2026-76186 Apache Airflow Keycloak provider: from Airflow 3.3 the Keycloak auth manager tak... |
critical | 9.1 | — | Apache / apache-airflow-providers-keycloak | 2026-09-16 | 2026-09-18 |
| CVE-2026-75156 Apache Airflow FAB provider versions 3.7.3 through 3.8.0 do not validate the iss... |
critical | 9.1 | — | Apache / apache-airflow-providers-fab | 2026-09-08 | 2026-09-18 |
| CVE-2026-75746 ColdFusion is affected by an Improper Neutralization of Special Elements used in... |
critical | 9.1 | — | Adobe / coldfusion | 2026-09-08 | 2026-09-18 |
| CVE-2026-87544 Incorrect authorization in Extensions in Google Chrome prior to 153.0.8010.36 al... |
critical | 9.8 | — | Google / chrome | 2026-09-09 | 2026-09-18 |
| CVE-2026-20237 As part of Cisco's ongoing commitment to proactive security and product quality,... |
critical | 9.1 | — | — | 2026-09-16 | 2026-09-18 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.