September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,186
Critical
1,210
High
4,308
Medium
4,071
Low
456
Severity not reported
1,141
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (605), oracle (274), apple (244), adobe (197), dell (137), ibm (104), arubanetworks (101), mongodb (64), apache (53)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-87474 Use after free in Payments in Google Chrome prior to 153.0.8010.36 allowed a rem... |
critical | 9.6 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87448 Use after free in DevTools in Google Chrome prior to 153.0.8010.36 allowed a rem... |
critical | 9.6 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87455 Use after free in Aura in Google Chrome prior to 153.0.8010.36 allowed a remote... |
critical | 9.6 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87438 Out of bounds write in WebGL in Google Chrome on on Android prior to 153.0.8010.... |
critical | 9.6 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-85103 A heap-based buffer overflow in VPN certificate ASN.1 decoding may allow an unau... |
critical | 9.8 | — | — | 2026-09-09 | 2026-09-10 |
| CVE-2026-67401 A vulnerability in cPanel allows a mail-enabled account to achieve remote code e... |
critical | 9.9 | — | — | 2026-09-09 | 2026-09-10 |
| CVE-2022-41352 Synacor Zimbra Collaboration Suite (ZCS) Arbitrary File Upload Vulnerability |
critical | 9.8 | Listed | Synacor / Zimbra Collaboration Suite (ZCS) | 2022-09-26 | 2026-09-10 |
| CVE-2016-4117 Adobe Flash Player Arbitrary Code Execution Vulnerability |
critical | 9.8 | Listed | Adobe / Flash Player | 2016-05-11 | 2026-09-10 |
| CVE-2026-75604 Next.js is a React framework for building full-stack web applications. |
critical | 9.0 | — | — | 2026-09-01 | 2026-09-09 |
| CVE-2026-84372 Predis is a flexible and feature-complete Redis and Valkey client for PHP. |
critical | 9.8 | — | — | 2026-09-01 | 2026-09-09 |
| CVE-2026-53611 Looking Glass is a modern, stateless network-diagnostic platform — a single self... |
critical | 9.8 | — | — | 2026-09-02 | 2026-09-09 |
| CVE-2026-53649 Joro is a web exploitation framework. |
critical | 9.6 | — | — | 2026-09-02 | 2026-09-09 |
| CVE-2026-58400 GeoNetwork is a catalog application to manage spatially referenced resources. |
critical | 9.1 | — | — | 2026-09-03 | 2026-09-09 |
| CVE-2026-85061 MapLibre GL JS is an interactive vector tile map library for web browsers. |
critical | 10.0 | — | — | 2026-09-03 | 2026-09-09 |
| CVE-2026-85506 ipmi-oem in FreeIPMI before 1.6.19 has a stack-based buffer overflow in _get_del... |
critical | 9.8 | — | — | 2026-09-04 | 2026-09-09 |
| CVE-2026-71625 An issue in slimkit plus ThinkSNS+ v.2.4 allows a remote attacker to escalate pr... |
critical | 9.8 | — | — | 2026-09-04 | 2026-09-09 |
| CVE-2026-85391 Peppermint through 0.5.5 contains a hardcoded JWT signing secret in docker-compo... |
critical | 9.8 | — | — | 2026-09-03 | 2026-09-09 |
| CVE-2026-50894 easyadmin v2.0.2.2 is vulnerable to Unrestricted Upload of File with Dangerous T... |
critical | 9.8 | — | — | 2026-09-04 | 2026-09-09 |
| CVE-2026-22590 eprosima Fast DDS is a C++ implementation of the DDS (Data Distribution Service)... |
critical | 9.1 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-79571 Incorrect access control in the SellerAuthorizeAspect component of springboot-pr... |
critical | 9.1 | — | — | 2026-09-08 | 2026-09-09 |
| CVE-2026-79574 An issue in the gateway server of mpush v0.8.1 allows attackers to execute arbit... |
critical | 9.8 | — | — | 2026-09-08 | 2026-09-09 |
| CVE-2026-78997 UC Browser for Android (package com.UCMobile.intl, version 13.7.8.1314) contains... |
critical | 9.3 | — | — | 2026-09-08 | 2026-09-09 |
| CVE-2026-80129 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application... |
critical | 9.8 | — | Dell / secure connect gateway | 2026-09-07 | 2026-09-09 |
| CVE-2026-80131 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application... |
critical | 9.8 | — | Dell / secure connect gateway | 2026-09-07 | 2026-09-09 |
| CVE-2026-80164 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application... |
critical | 9.1 | — | Dell / secure connect gateway | 2026-09-07 | 2026-09-09 |
| CVE-2026-87494 Use after free in Browser in Google Chrome on on Windows prior to 153.0.8010.36... |
critical | 9.6 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-52766 YesWiki is a wiki system written in PHP. |
critical | 9.1 | — | — | 2026-09-05 | 2026-09-09 |
| CVE-2026-79570 mfish-nocode-pro v1.0.0 was discovered to contain a SQL injection vulnerability... |
critical | 9.8 | — | — | 2026-09-08 | 2026-09-09 |
| CVE-2026-78745 An issue in HiDPT/ Weyon HiDPTAndroid Hi3751V350 Hi3751V352E_DMO allows a remote... |
critical | 9.8 | — | — | 2026-09-04 | 2026-09-09 |
| CVE-2026-71624 An issue in esoTalk v.1.0.0g4 allows a remote attacker to execute arbitrary code... |
critical | 9.8 | — | — | 2026-09-04 | 2026-09-09 |
| CVE-2026-79391 No authentication exists in the MQTT service of Trueview 6.0.23.4. |
critical | 9.8 | — | — | 2026-09-04 | 2026-09-09 |
| CVE-2026-79576 An issue in the Single-Sign On (SSO) component of Digital-Infrastructure v9.6.7... |
critical | 9.8 | — | — | 2026-09-08 | 2026-09-09 |
| CVE-2026-79569 Movie_Recommend v1.0.0 was discovered to contain a SQL injection vulnerability i... |
critical | 9.8 | — | — | 2026-09-08 | 2026-09-09 |
| CVE-2026-85978 An unauthenticated remote code execution vulnerability exists in the Policy Mana... |
critical | 9.8 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-86419 Affected versions of MISP contain insufficient validation of server-side outboun... |
critical | 9.1 | — | Misp-project / misp | 2026-09-07 | 2026-09-09 |
| CVE-2026-76201 Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability... |
critical | 9.3 | — | Adobe / commerce | 2026-09-08 | 2026-09-09 |
| CVE-2026-76200 Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability... |
critical | 9.3 | — | Adobe / magento | 2026-09-08 | 2026-09-09 |
| CVE-2026-7861 Deserialization of untrusted data vulnerability in Next4Biz Information Technolo... |
critical | 9.8 | — | — | 2026-09-07 | 2026-09-09 |
| CVE-2026-86218 N-able N-central Static Code Injection Vulnerability |
critical | 9.8 | Listed | N-able / N-central | 2026-09-06 | 2026-09-09 |
| CVE-2026-86478 In JetBrains YouTrack before 2025.3.161254,
2026.1.14042 improper authenticatio... |
critical | 9.8 | — | — | 2026-09-07 | 2026-09-09 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.