September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,186
Critical
1,210
High
4,308
Medium
4,071
Low
456
Severity not reported
1,141
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (605), oracle (274), apple (244), adobe (197), dell (137), ibm (104), arubanetworks (101), mongodb (64), apache (53)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-86060 MikroTik RouterOS Improper Neutralization of Argument Delimiters in a Command Vu... |
critical | 9.8 | Listed | MikroTik / RouterOS | 2026-09-05 | 2026-09-11 |
| CVE-2026-80172 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application... |
critical | 9.8 | — | Dell / secure connect gateway | 2026-09-09 | 2026-09-11 |
| CVE-2026-19583 Velociraptor allows some sensitive artifacts to be gated by additional permissio... |
critical | 9.9 | — | — | 2026-09-10 | 2026-09-11 |
| CVE-2026-18658 IBM Operational Decision Manager 9.6.0.0, 9.5.0.0, 8.11.1.0, 8.11.0.1, 8.12.0.1,... |
critical | 9.8 | — | — | 2026-09-04 | 2026-09-10 |
| CVE-2026-41869 Missing Authorization, Improper Resource Shutdown and Job Interruption vulnerabi... |
critical | 9.1 | — | Apache / nutch | 2026-09-09 | 2026-09-10 |
| CVE-2026-41871 Missing Authorization, Use of Externally-Controlled Input to Select Classes or C... |
critical | 9.8 | — | Apache / nutch | 2026-09-09 | 2026-09-10 |
| CVE-2026-56207 Signature of Bearer token is not verified in last step of SAML2 authentication f... |
critical | 9.8 | — | Apache / impala | 2026-09-09 | 2026-09-10 |
| CVE-2026-53939 OpenIDC/cjose is a C library implementing the Javascript Object Signing and Encr... |
critical | 9.1 | — | — | 2026-09-09 | 2026-09-10 |
| CVE-2026-68487 Path traversal in Plesk's Backup Manager causes arbitrary file write as root by... |
critical | 9.9 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-68488 A Time-of-check Time-of-use (TOCTOU) race condition leading to insecure symlink... |
critical | 9.9 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-85228 An integer overflow in the tensor buffer validation component in Amazon Deep Jav... |
critical | 9.1 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-88044 rclone is a command-line program to sync files and directories to and from diffe... |
critical | 9.1 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-89049 A server-side request forgery issue due to improper validation of equivalent add... |
critical | 9.9 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-85216 MISP contains an authentication bypass vulnerability in its LDAP and LinOTP auth... |
critical | 9.8 | — | Misp-project / misp | 2026-09-03 | 2026-09-10 |
| CVE-2026-85221 MISP contains an improper TLS certificate validation vulnerability in CurlClient... |
critical | 9.1 | — | Misp-project / misp | 2026-09-03 | 2026-09-10 |
| CVE-2026-75003 In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, an unclosed url() in... |
critical | 9.8 | — | Roundcube / webmail | 2026-08-17 | 2026-09-10 |
| CVE-2026-87534 Missing authorization in WebView in Google Chrome on on Android prior to 153.0.8... |
critical | 9.8 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-86152 A flaw has been found in Tenda CP3 27.5.57.101. |
critical | 10.0 | — | — | 2026-09-06 | 2026-09-10 |
| CVE-2026-86840 The `vtoken-minting` and `slpx` pallets in Bifrost contain an improper authoriza... |
critical | 9.1 | — | — | 2026-09-08 | 2026-09-10 |
| CVE-2026-44950 fs_read_glyphs() in the libXfont2 font-server client (src/fc/fserve.c) copies ea... |
critical | 9.0 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2020-14498 HMS Industrial Networks AB eCatcher all versions prior to 6.5.5 is vulnerable to... |
critical | 10.0 | — | Hms-networks / ecatcher | 2020-08-26 | 2026-09-10 |
| CVE-2026-87464 Use after free in WebGL in Google Chrome prior to 153.0.8010.36 allowed a remote... |
critical | 9.6 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-73778 A vulnerability exists in the Credential Manager component that may allow for un... |
critical | 9.8 | — | Hpe / arubaos-cx | 2026-09-01 | 2026-09-10 |
| CVE-2026-8323 URL redirection to untrusted site ('open redirect') vulnerability in Armiya Info... |
critical | 9.3 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-88285 GeoVision GV-LPC2211 V1.13 exposes a network-accessible PTZ control service with... |
critical | 9.4 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-88869 AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored... |
critical | 9.3 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-88278 GeoVision GV-LPC2211 V1.13 fails to enforce WS-Security UsernameToken freshness... |
critical | 9.8 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-85696 SadTalker contains an OS command injection vulnerability in the video muxing pro... |
critical | 9.8 | — | — | 2026-09-04 | 2026-09-10 |
| CVE-2026-71805 An arbitrary file upload and path traversal vulnerability exists in LZ-litchi 1.... |
critical | 9.8 | — | — | 2026-09-09 | 2026-09-10 |
| CVE-2026-54694 SkillTree is a micro-learning gamification platform. |
critical | 9.6 | — | — | 2026-09-09 | 2026-09-10 |
| CVE-2026-36433 An issue in Actions Semiconductor Co. |
critical | 9.8 | — | — | 2026-09-09 | 2026-09-10 |
| CVE-2026-85183 Taipy configures its socket.io server with wildcard CORS origin and credential f... |
critical | 9.3 | — | — | 2026-09-03 | 2026-09-10 |
| CVE-2026-85663 Aim 3.29.1 remote tracking server fails to authenticate requests and dispatches... |
critical | 9.8 | — | — | 2026-09-04 | 2026-09-10 |
| CVE-2026-85667 xiaobei through 5.5.2 fails to implement authentication or signature validation... |
critical | 9.1 | — | — | 2026-09-04 | 2026-09-10 |
| CVE-2026-85695 FastChat contains an authentication bypass vulnerability in the /register_worker... |
critical | 9.4 | — | — | 2026-09-04 | 2026-09-10 |
| CVE-2026-44402 Voltronic Power SNMP Web Pro 1.1 contains an unauthenticated remote code executi... |
critical | 9.8 | — | — | 2026-09-04 | 2026-09-10 |
| CVE-2026-87911 An OS command injection weakness in the read-only enforcement of the SQL validat... |
critical | 9.6 | — | — | 2026-09-09 | 2026-09-10 |
| CVE-2026-84200 Kyverno versions v1.9.0 through v1.12.7 contain a policy exception handling flaw... |
critical | 9.0 | — | — | 2026-09-01 | 2026-09-10 |
| CVE-2026-59679 fs_read_glyphs() in the libXfont2 font-server client (src/fc/fserve.c) indexes t... |
critical | 9.0 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-85982 The Auth0 AD/LDAP Connector is vulnerable to stored Cross-Site Scripting (XSS) i... |
critical | 9.0 | — | — | 2026-09-08 | 2026-09-10 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.