September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,186
Critical
1,210
High
4,308
Medium
4,071
Low
456
Severity not reported
1,141
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (605), oracle (274), apple (244), adobe (197), dell (137), ibm (104), arubanetworks (101), mongodb (64), apache (53)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-71324 Traefik is an open source HTTP reverse proxy and load balancer. |
critical | 9.1 | — | Traefik / traefik | 2026-08-06 | 2026-09-16 |
| CVE-2026-78299 In Eclipse Embedded CDT versions 6.0 to 6.7 if the CMSIS-Pack archive extracts a... |
critical | 9.1 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-63695 Dell SmartFabric OS10 Software, versions prior to 10.6.1.3, contains a Session F... |
critical | 9.8 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-63696 Dell SmartFabric OS10 Software, versions prior to 10.6.1.3, contains a Download... |
critical | 9.1 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-86106 An unauthenticated actor with network access to the private HA interconnect may... |
critical | 9.6 | — | — | 2026-09-16 | 2026-09-16 |
| CVE-2026-91939 Cotonti 1.0.0 Comments plugin passes the ci GET parameter to unserialize() witho... |
critical | 9.8 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-45764 Suricata is a network Intrusion Detection System, Intrusion Prevention System an... |
critical | 9.1 | — | Oisf / suricata | 2026-09-10 | 2026-09-16 |
| CVE-2026-92397 A vulnerability has been found in Ruijie RG-EW3000GX EW_3.0(1)B11P380. |
critical | 9.1 | — | — | 2026-09-16 | 2026-09-16 |
| CVE-2023-27172 Xpand IT Write-back Manager v2.3.1 uses weak secret keys to sign JWT tokens. |
critical | 9.1 | — | Xpand-it / write-back manager | 2023-12-20 | 2026-09-16 |
| CVE-2023-27168 An arbitrary file upload vulnerability in Xpand IT Write-back Manager v2.3.1 all... |
critical | 9.8 | — | Xpand-it / write-back manager | 2024-01-19 | 2026-09-16 |
| CVE-2026-73961 Vulnerability in the Oracle JDeveloper product of Oracle Fusion Middleware (comp... |
critical | 9.8 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-82994 Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion... |
critical | 9.8 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-82995 Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion... |
critical | 9.8 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-82997 Vulnerability in the Service Delivery Platform product of Oracle Fusion Middlewa... |
critical | 9.9 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-82998 Vulnerability in the Service Delivery Platform product of Oracle Fusion Middlewa... |
critical | 9.9 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-82999 Vulnerability in the Service Delivery Platform product of Oracle Fusion Middlewa... |
critical | 9.9 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-83000 Vulnerability in the Service Delivery Platform product of Oracle Fusion Middlewa... |
critical | 9.8 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-83029 Vulnerability in the Oracle Managed File Transfer product of Oracle Fusion Middl... |
critical | 9.6 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-83151 Vulnerability in the Service Delivery Platform product of Oracle Fusion Middlewa... |
critical | 9.8 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-83261 Vulnerability in the Oracle Product Lifecycle Analytics product of Oracle Supply... |
critical | 9.8 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-83355 Vulnerability in the Oracle Enterprise Manager for Fusion Middleware product of... |
critical | 9.8 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-90711 proxy-addr is a Node.js module that determines a request's client address behind... |
critical | 9.1 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-82787 Missing authentication for critical function vulnerability exists in CPSL-08P1EN... |
critical | 9.8 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-66302 External control of file name or path in Skype for Business allows an unauthoriz... |
critical | 9.8 | — | Microsoft / skype for business server | 2026-09-08 | 2026-09-16 |
| CVE-2026-12351 IBM MQ 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through... |
critical | 9.8 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-27565 An unauthenticated remote attacker can upload a malicious IODD file that places... |
critical | 9.8 | — | — | 2026-09-16 | 2026-09-16 |
| CVE-2026-27546 An unauthenticated remote attacker can exploit an authentication bypass in the _... |
critical | 9.8 | — | — | 2026-09-16 | 2026-09-16 |
| CVE-2026-14349 The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress i... |
critical | 9.8 | — | — | 2026-09-16 | 2026-09-16 |
| CVE-2026-69910 Stack-based buffer overflow in Windows Hyper-V allows an unauthorized attacker t... |
critical | 9.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-16 |
| CVE-2026-84561 A double free issue was addressed with improved memory management. |
critical | 9.8 | — | Apple / ipados | 2026-09-14 | 2026-09-16 |
| CVE-2026-86881 A certificate validation issue was addressed with improved certificate validatio... |
critical | 9.1 | — | Apple / ipados | 2026-09-14 | 2026-09-16 |
| CVE-2026-92398 A vulnerability was found in Ruijie RG-EW3000GX EW_3.0(1)B11P380. |
critical | 9.1 | — | — | 2026-09-16 | 2026-09-16 |
| CVE-2026-57148 PraisonAI is a multi-agent teams system. |
critical | 9.8 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-20079 Cisco Firewall Management Center Authentication Bypass Using an Alternate Path o... |
critical | 10.0 | Listed | Cisco / Secure Firewall Management Center (FMC) and Security Cloud Control (SCC) Firewall Management | 2026-03-04 | 2026-09-16 |
| CVE-2026-84520 A buffer overflow was addressed with improved size validation. |
critical | 9.8 | — | Apple / macos | 2026-09-14 | 2026-09-16 |
| CVE-2026-90680 A security flaw has been discovered in D-Link DIR-823G 1.0.2B05_20181207. |
critical | 9.9 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-90608 A flaw has been found in Totolink A3002MU Hh-B20211125.1046. |
critical | 9.9 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-82617 The two built-in name-finder patterns exposed by
opennlp.tools.namefind.RegexNam... |
critical | 9.8 | — | Apache / opennlp | 2026-09-11 | 2026-09-16 |
| CVE-2026-57127 PraisonAI is a multi-agent teams system. |
critical | 9.8 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-57131 PraisonAI is a multi-agent teams system. |
critical | 9.8 | — | — | 2026-09-14 | 2026-09-16 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.