September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,186
Critical
1,210
High
4,308
Medium
4,071
Low
456
Severity not reported
1,141
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (605), oracle (274), apple (244), adobe (197), dell (137), ibm (104), arubanetworks (101), mongodb (64), apache (53)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-49364 An unauthenticated network-adjacent attacker can leverage discovery to capture c... |
critical | 9.1 | — | Apache / artemis | 2026-09-10 | 2026-09-16 |
| CVE-2026-67593 A remote attacker can craft an Openwire RemoveSubscriptionInfo command to cause... |
critical | 9.1 | — | Apache / artemis | 2026-09-10 | 2026-09-16 |
| CVE-2026-65414 An out-of-bounds write issue was addressed with improved bounds checking. |
critical | 9.8 | — | Apple / ipados | 2026-09-14 | 2026-09-16 |
| CVE-2026-81204 IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote attacker to execute a... |
critical | 9.8 | — | Langflow / langflow | 2026-09-10 | 2026-09-16 |
| CVE-2026-79724 IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote attacker to execute a... |
critical | 9.8 | — | Langflow / langflow | 2026-09-10 | 2026-09-16 |
| CVE-2026-78573 IBM ContextForge MCP Gateway 1.0.0 through 1.0.7 could allow a remote attacker t... |
critical | 9.8 | — | Ibm / contextforge | 2026-09-10 | 2026-09-16 |
| CVE-2026-80424 IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated a... |
critical | 9.1 | — | Ibm / datastage on cloud pak for data | 2026-09-10 | 2026-09-16 |
| CVE-2026-82107 IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated a... |
critical | 9.6 | — | Ibm / datastage on cloud pak for data | 2026-09-10 | 2026-09-16 |
| CVE-2026-85184 @fastify/middie versions >= 9.1.0 and before 9.3.4 decide whether to run path-sc... |
critical | 9.1 | — | Fastify / fastify\/middie | 2026-09-04 | 2026-09-15 |
| CVE-2026-90606 A security vulnerability has been detected in Totolink A3002MU Hh-B20211125.1046... |
critical | 9.9 | — | — | 2026-09-14 | 2026-09-15 |
| CVE-2026-90847 A vulnerability was determined in EFM ipTIME C200E 1.094. |
critical | 9.1 | — | — | 2026-09-15 | 2026-09-15 |
| CVE-2026-52098 An issue in Flowise 3.1.2 allows a remote attacker to execute arbitrary code via... |
critical | 9.8 | — | Flowiseai / flowise | 2026-09-10 | 2026-09-15 |
| CVE-2026-90703 A vulnerability has been found in D-Link DWR-M921 1.1.52. |
critical | 9.1 | — | — | 2026-09-14 | 2026-09-15 |
| CVE-2026-76441 As part of Cisco's ongoing commitment to proactive security and product quality,... |
critical | 9.8 | — | — | 2026-09-14 | 2026-09-15 |
| CVE-2026-76443 As part of Cisco's ongoing commitment to proactive security and product quality,... |
critical | 9.8 | — | — | 2026-09-14 | 2026-09-15 |
| CVE-2026-76440 As part of Cisco's ongoing commitment to proactive security and product quality,... |
critical | 9.8 | — | — | 2026-09-14 | 2026-09-15 |
| CVE-2026-20353 As part of Cisco's ongoing commitment to proactive security and product quality,... |
critical | 9.8 | — | — | 2026-09-14 | 2026-09-15 |
| CVE-2026-85025 IBM Langflow OSS 1.0.0 through 1.11.5 Langflow could allow an unauthenticated at... |
critical | 9.8 | — | Langflow / langflow | 2026-09-10 | 2026-09-15 |
| CVE-2026-90693 A flaw has been found in D-Link DIR-878 120B05. |
critical | 9.9 | — | — | 2026-09-14 | 2026-09-15 |
| CVE-2019-7105 Adobe XD versions 16.0 and earlier have a path traversal vulnerability. |
critical | 9.8 | — | Adobe / xd | 2019-05-23 | 2026-09-15 |
| CVE-2019-7106 Adobe XD versions 16.0 and earlier have a path traversal vulnerability. |
critical | 9.8 | — | Adobe / xd | 2019-05-23 | 2026-09-15 |
| CVE-2026-91003 A flaw has been found in D-Link DI-8300 16.07. |
critical | 9.1 | — | — | 2026-09-15 | 2026-09-15 |
| CVE-2026-91001 A security flaw has been discovered in D-Link DI-8400 16.07. |
critical | 9.9 | — | — | 2026-09-15 | 2026-09-15 |
| CVE-2026-77822 IBM ContextForge MCP Gateway could allow a remote authenticated attacker to obta... |
critical | 9.6 | — | Ibm / contextforge | 2026-09-04 | 2026-09-15 |
| CVE-2026-57123 PraisonAI is a multi-agent teams system. |
critical | 9.8 | — | — | 2026-09-14 | 2026-09-15 |
| CVE-2026-57125 PraisonAI is a multi-agent teams system. |
critical | 9.8 | — | — | 2026-09-14 | 2026-09-15 |
| CVE-2026-57124 PraisonAI is a multi-agent teams system. |
critical | 9.8 | — | — | 2026-09-14 | 2026-09-15 |
| CVE-2026-57145 PraisonAI is a multi-agent teams system. |
critical | 9.1 | — | — | 2026-09-14 | 2026-09-15 |
| CVE-2026-57140 PraisonAI is a multi-agent teams system. |
critical | 9.4 | — | — | 2026-09-15 | 2026-09-15 |
| CVE-2026-57141 PraisonAI is a multi-agent teams system. |
critical | 9.8 | — | — | 2026-09-15 | 2026-09-15 |
| CVE-2026-84961 undici's BalancedPool constructor passes its entire options object through an in... |
critical | 9.1 | — | Nodejs / undici | 2026-09-04 | 2026-09-15 |
| CVE-2026-28606 In handleBondStateChanged of AdapterService.java, there is a possible way to ski... |
critical | 9.8 | — | Google / android | 2026-09-08 | 2026-09-15 |
| CVE-2026-90702 A flaw has been found in D-Link DWR-M921 1.1.52. |
critical | 9.1 | — | — | 2026-09-14 | 2026-09-15 |
| CVE-2026-90692 A vulnerability was detected in D-Link DIR-878 120B05. |
critical | 9.9 | — | — | 2026-09-14 | 2026-09-15 |
| CVE-2026-90605 A weakness has been identified in Totolink A3002MU Hh-B20211125.1046. |
critical | 9.9 | — | — | 2026-09-14 | 2026-09-15 |
| CVE-2026-76461 Cisco Secure Email Gateway SQL Injection Vulnerability |
critical | 9.8 | Listed | Cisco / Secure Email Gateway | 2026-09-14 | 2026-09-15 |
| CVE-2026-18924 A flaw in libcurl's handling of HTTP/2 Server Push streams, when the parent
hand... |
critical | 9.1 | — | Haxx / curl | 2026-09-06 | 2026-09-15 |
| CVE-2026-19931 A flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given
ho... |
critical | 9.8 | — | Haxx / curl | 2026-09-06 | 2026-09-15 |
| CVE-2026-72709 SPIP before version 4.4.18 contains a missing authorization vulnerability in sen... |
critical | 9.8 | — | — | 2026-09-11 | 2026-09-15 |
| CVE-2026-72710 SPIP before 4.4.18 contains a mass assignment vulnerability in the editer_objet... |
critical | 9.8 | — | — | 2026-09-11 | 2026-09-15 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.