September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,141
Critical
1,210
High
4,303
Medium
4,031
Low
456
Severity not reported
1,141
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (605), oracle (274), apple (244), adobe (197), dell (137), ibm (104), arubanetworks (101), mongodb (64), apache (53)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-68491 An insufficient check allowed for the overwrite of arbitrary files via a symlink... |
not reported | — | — | — | 2026-09-15 | 2026-09-18 |
| CVE-2026-68489 Static Code Injection in Plesk extensions "Ruby" before 1.6.6 and "Node.js Toolk... |
not reported | — | — | — | 2026-09-14 | 2026-09-18 |
| CVE-2026-15638 An unauthenticated user with access to Secret Server could leverage a padding or... |
not reported | — | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-15639 An attacker can craft a malicious link that, if used by a legitimate user, may c... |
not reported | — | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-15640 Under certain conditions a valid SAML IdP response may be used to impersonate an... |
not reported | — | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-92627 A heap-use-after-free vulnerability exists in H5T__conv_f_f() in src/H5Tconv.c i... |
not reported | — | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-89082 HP has identified potential security vulnerabilities in the HP Advance software... |
not reported | — | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-89083 HP
has identified potential security vulnerabilities in the HP Advance software... |
not reported | — | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-89084 HP
has identified potential security vulnerabilities in the HP Advance software... |
not reported | — | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-92611 In Eclipse Ankaios versions 0.6.0 to before 1.0.4, `LogRule::matches` in the age... |
not reported | — | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-92082 By default, Payara Server does not limit the number of failed login attempts, wh... |
not reported | — | — | — | 2026-09-15 | 2026-09-18 |
| CVE-2026-85104 In Sooma 2GEN brain stimulator, an attacker within Bluetooth range can make unau... |
not reported | — | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-16172 Netskope was notified of an out-of-bounds heap read affecting the Endpoint DLP (... |
not reported | — | — | — | 2026-09-10 | 2026-09-18 |
| CVE-2026-16174 Netskope was notified about a potential gap in Netskope Endpoint DLP (EPDLP) run... |
not reported | — | — | — | 2026-09-10 | 2026-09-18 |
| CVE-2026-15710 An information leakage vulnerability exists in the Endpoint DLP component (epdlp... |
not reported | — | — | — | 2026-09-11 | 2026-09-18 |
| CVE-2026-12518 A local privilege escalation vulnerability in the Logitech Logi Options+ updater... |
not reported | — | — | — | 2026-09-14 | 2026-09-18 |
| CVE-2026-85979 Affected versions of Puppet Enterprise contain a command injection vulnerability... |
not reported | — | — | — | 2026-09-11 | 2026-09-18 |
| CVE-2026-3869 CWE-303 : Incorrect Implementation of Authentication Algorithm vulnerability exi... |
not reported | — | — | — | 2026-09-11 | 2026-09-18 |
| CVE-2026-81861 CWE-522: Insufficiently Protected Credentials vulnerability that could result in... |
not reported | — | — | — | 2026-09-11 | 2026-09-18 |
| CVE-2026-20773 A role-based access control issue was identified in the administrative expressio... |
not reported | — | — | — | 2026-09-14 | 2026-09-18 |
| CVE-2026-21391 An improper validation vulnerability exists within PingAM where a well-crafted r... |
not reported | — | — | — | 2026-09-14 | 2026-09-18 |
| CVE-2026-16726 Buffer overflow vulnerability in Panasonic Industry USB Driver for MINAS A5/A6 a... |
not reported | — | — | — | 2026-09-14 | 2026-09-18 |
| CVE-2026-90896 Missing Authentication for Critical Function (CWE-306) in the checkout session l... |
not reported | — | — | — | 2026-09-14 | 2026-09-18 |
| CVE-2026-89308 An unauthenticated OS command injection vulnerability exists in the ping.php end... |
not reported | — | — | — | 2026-09-15 | 2026-09-18 |
| CVE-2026-87791 A path traversal vulnerability exists in the reserved_file_check function of the... |
not reported | — | — | — | 2026-09-15 | 2026-09-18 |
| CVE-2026-87792 The "Design Scuole Italia" WordPress theme is affected by multiple Authorization... |
not reported | — | — | — | 2026-09-15 | 2026-09-18 |
| CVE-2026-87793 The "Design Scuole Italia" WordPress theme is affected by a Reflected XSS vulner... |
not reported | — | — | — | 2026-09-15 | 2026-09-18 |
| CVE-2026-89307 The "Firma Circolare" feature in the "Design Scuole Italia" WordPress theme allo... |
not reported | — | — | — | 2026-09-15 | 2026-09-18 |
| CVE-2026-12258 Inadequate access control in Hiperdino’s REST v1.0 API. |
not reported | — | — | — | 2026-09-14 | 2026-09-18 |
| CVE-2026-14850 The password reset funcionality is vulnerable to unauthorized account modificati... |
not reported | — | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-92976 A stored Cross-Site Scripting (XSS) vulnerability in the profile management func... |
not reported | — | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-13326 An out-of-bounds read in Qt NFC's language code length parsing allows a physical... |
not reported | — | — | — | 2026-09-11 | 2026-09-18 |
| CVE-2026-47839 A vulnerability allows users authenticating through a federated OIDC provider to... |
not reported | — | — | — | 2026-09-11 | 2026-09-18 |
| CVE-2026-19248 QDomDocument XML parsing is vulnerable to a remotely-triggerable denial-of-servi... |
not reported | — | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-76151 Out-of-bounds read (buffer over-read) in the HTTP Cache-Control response header... |
not reported | — | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-14917 A SAML authentication bypass vulnerability affects the Kong SAML plugin when the... |
not reported | — | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-14916 A JWT signature verification vulnerability affects Kong components that perform... |
not reported | — | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-8462 SQL injection in ClickHouse-backed meter definitions in OpenMeter OpenMeter befo... |
not reported | — | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-15579 An out-of-bounds write vulnerability exists in some of the Ethernet switches bec... |
not reported | — | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-67399 Deserialization of untrusted data in WHMCS 9.0.0 before 9.0.8 and 8.0.0 before 8... |
not reported | — | — | — | 2026-09-14 | 2026-09-18 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.