September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,186
Critical
1,210
High
4,308
Medium
4,071
Low
456
Severity not reported
1,141
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (605), oracle (274), apple (244), adobe (197), dell (137), ibm (104), arubanetworks (101), mongodb (64), apache (53)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-75171 An issue in HubCore v.14.1.1 allows a remote attacker to escalate privileges via... |
critical | 9.8 | — | — | 2026-09-04 | 2026-09-14 |
| CVE-2026-75429 PowerJob versions 4.x through 5.1.2 contain an unauthenticated remote code execu... |
critical | 9.8 | — | — | 2026-09-04 | 2026-09-14 |
| CVE-2026-48273 ColdFusion is affected by an Improper Neutralization of Directives in Dynamicall... |
critical | 9.9 | — | Adobe / coldfusion | 2026-09-08 | 2026-09-14 |
| CVE-2026-71801 An issue was discovered in s-pms SPMS-Server through v1.0. |
critical | 9.8 | — | — | 2026-09-09 | 2026-09-14 |
| CVE-2026-82078 PaperCut NG/MF Unsafe Reflection Vulnerability |
critical | 9.1 | Listed | PaperCut / NG/MF | 2026-08-28 | 2026-09-14 |
| CVE-2026-81578 PaperCut NG/MF Missing Authentication for Critical Function Vulnerability |
critical | 9.8 | Listed | PaperCut / NG/MF | 2026-08-28 | 2026-09-14 |
| CVE-2026-84869 ConnectWise ScreenConnect Improper Privilege Management and Missing Authorizatio... |
critical | 9.9 | Listed | ConnectWise / ScreenConnect | 2026-09-08 | 2026-09-12 |
| CVE-2026-61410 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application... |
critical | 9.4 | — | Dell / secure connect gateway | 2026-09-07 | 2026-09-11 |
| CVE-2026-80238 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application... |
critical | 9.3 | — | Dell / secure connect gateway | 2026-09-07 | 2026-09-11 |
| CVE-2026-8778 The MIPL Grouped Checkout Fields for WooCommerce – Customize & Organize Checkout... |
critical | 9.8 | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-89042 passport-saml-encrypted through 0.1.13 makes SAML signature verification conditi... |
critical | 9.1 | — | — | 2026-09-10 | 2026-09-11 |
| CVE-2026-88899 knowns versions before 0.31.0 fail to properly validate the x-opencode-directory... |
critical | 9.8 | — | — | 2026-09-10 | 2026-09-11 |
| CVE-2026-86509 A flaw has been found in D-Link DIR-895L A1_102b07. |
critical | 9.6 | — | — | 2026-09-08 | 2026-09-11 |
| CVE-2026-86299 A vulnerability was detected in Linksys RE7000 2.0.15. |
critical | 9.9 | — | — | 2026-09-07 | 2026-09-11 |
| CVE-2026-86151 A vulnerability was detected in Tenda CP3 27.5.57.101. |
critical | 9.1 | — | — | 2026-09-06 | 2026-09-11 |
| CVE-2026-82004 Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Specia... |
critical | 10.0 | — | Adobe / campaign | 2026-09-08 | 2026-09-11 |
| CVE-2026-81800 Unauthenticated SQL Injection in Verified Reviews (Avis Vérifiés) <= 2.4.6 versi... |
critical | 9.3 | — | — | 2026-09-10 | 2026-09-11 |
| CVE-2026-79698 A vulnerability was identified in Advantech WISE-6610-NB, WISE-6610-EB, WISE-661... |
critical | 9.9 | — | — | 2026-09-07 | 2026-09-11 |
| CVE-2026-62103 Unauthenticated PHP Object Injection in Everest Forms <= 3.6.0 versions. |
critical | 9.8 | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-62105 Unauthenticated PHP Object Injection in ThemeREX Addons < 2.45.0 versions. |
critical | 9.8 | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-81376 Incomplete comparison with missing factors in Visual Studio Code allows an unaut... |
critical | 9.6 | — | Microsoft / visual studio code | 2026-09-08 | 2026-09-11 |
| CVE-2026-73309 XenForo before 2.3.13 contains an authentication bypass vulnerability in the OAu... |
critical | 9.1 | — | Xenforo / xenforo | 2026-09-08 | 2026-09-11 |
| CVE-2026-84390 A inclusion of sensitive information in source code vulnerability in Fortinet Fo... |
critical | 9.8 | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-19646 IBM Common Licensing Agent 9.0, Agent 9.0.0.1, Agent 9.0.0.2, ART 9.0, ART 9.0.0... |
critical | 9.1 | — | — | 2026-09-10 | 2026-09-11 |
| CVE-2026-14559 The teddy-bear-customize-addon WordPress plugin through 1.0.5 does not verify a... |
critical | 9.8 | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-14560 The teddy-bear-customize-addon WordPress plugin through 1.0.5 does not properly... |
critical | 10.0 | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-14563 The advanced-customized-prompts WordPress plugin through 1.0.1 does not verify t... |
critical | 9.8 | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-57163 PJSIP is a free and open source multimedia communication library written in C. |
critical | 9.1 | — | Teluu / pjsip | 2026-09-04 | 2026-09-11 |
| CVE-2026-57162 PJSIP is a free and open source multimedia communication library written in C. |
critical | 9.1 | — | Teluu / pjsip | 2026-09-04 | 2026-09-11 |
| CVE-2026-75940 A vulnerability was reported in Lenovo Health Android Application, distributed e... |
critical | 9.1 | — | — | 2026-09-10 | 2026-09-11 |
| CVE-2026-77089 Command Center API contained an authentication bypass issue affecting privilege... |
critical | 9.8 | — | Commvault / commvault | 2026-09-08 | 2026-09-11 |
| CVE-2026-77092 Content Extractor contained a deserialization of untrusted data issue affecting... |
critical | 9.8 | — | Commvault / commvault | 2026-09-08 | 2026-09-11 |
| CVE-2026-77098 Private Metrics Server contained an SQL injection condition affecting database o... |
critical | 9.8 | — | Commvault / commvault | 2026-09-08 | 2026-09-11 |
| CVE-2026-19232 Adobe Experience Manager is affected by an Incorrect Authorization vulnerability... |
critical | 9.9 | — | Adobe / experience manager | 2026-09-08 | 2026-09-11 |
| CVE-2026-79941 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application... |
critical | 9.8 | — | Dell / secure connect gateway | 2026-09-09 | 2026-09-11 |
| CVE-2026-79689 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application... |
critical | 9.8 | — | Dell / secure connect gateway | 2026-09-09 | 2026-09-11 |
| CVE-2026-42264 Axios is a promise based HTTP client for the browser and Node.js. |
critical | 9.1 | — | Axios / axios | 2026-05-08 | 2026-09-11 |
| CVE-2026-21095 Heap-based buffer overflow in DNG decoder of libimagecodec.quram.so prior to SMR... |
critical | 9.8 | — | Samsung / android | 2026-09-09 | 2026-09-11 |
| CVE-2026-21096 Heap-based buffer overflow in JPEG decoder of libimagecodec.quram.so prior to SM... |
critical | 9.8 | — | Samsung / android | 2026-09-09 | 2026-09-11 |
| CVE-2026-84939 Path traversal vulnerability in Apache FreeMarker template loading mechanism, if... |
critical | 9.1 | — | Apache / freemarker | 2026-09-10 | 2026-09-11 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.