September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,186
Critical
1,210
High
4,308
Medium
4,071
Low
456
Severity not reported
1,141
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (605), oracle (274), apple (244), adobe (197), dell (137), ibm (104), arubanetworks (101), mongodb (64), apache (53)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-86480 In JetBrains Hub before 2026.2.52442 an unauthenticated attacker could register... |
critical | 9.8 | — | — | 2026-09-07 | 2026-09-09 |
| CVE-2026-75650 Adobe Commerce and Magento Improper Neutralization of Special Elements Used in a... |
critical | 10.0 | Listed | Adobe / Commerce and Magento | 2026-09-07 | 2026-09-09 |
| CVE-2026-66768 SAP GUI for Java does not correctly enforce the trust level policy for certain f... |
critical | 9.0 | — | — | 2026-09-08 | 2026-09-09 |
| CVE-2026-58240 SAP NetWeaver Message Server does not sufficiently validate the authenticity of... |
critical | 9.8 | — | — | 2026-09-08 | 2026-09-09 |
| CVE-2025-14733 WatchGuard Firebox Out of Bounds Write Vulnerability |
critical | 9.8 | Listed | WatchGuard / Firebox | 2025-12-19 | 2026-09-09 |
| CVE-2026-8376 Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 befo... |
critical | 9.8 | — | Perl / perl | 2026-05-26 | 2026-09-08 |
| CVE-2023-54391 Proxmox Virtual Environment (VE) 7.0 through 8.0 contains an authentication bypa... |
critical | 9.8 | — | — | 2026-09-01 | 2026-09-08 |
| CVE-2026-84479 WWBN AVideo (current e01e41ecc and earlier) makes three login-time security cont... |
critical | 9.1 | — | — | 2026-09-01 | 2026-09-08 |
| CVE-2026-84480 WWBN AVideo fails to validate password recovery token expiration in userRecoverP... |
critical | 9.8 | — | — | 2026-09-01 | 2026-09-08 |
| CVE-2026-85154 WWBN AVideo contains an authentication failure vulnerability where the video_id_... |
critical | 9.8 | — | — | 2026-09-03 | 2026-09-08 |
| CVE-2026-82526 R2R through 3.6.6 contains a stacked SQL injection vulnerability that allows una... |
critical | 9.8 | — | — | 2026-09-03 | 2026-09-08 |
| CVE-2026-85426 MOOS-IvP uMemWatch through 24.8.1 constructs shell commands from attacker-chosen... |
critical | 9.8 | — | — | 2026-09-03 | 2026-09-08 |
| CVE-2026-86190 WWBN AVideo contains a broken access control vulnerability in videoViewsInfo end... |
critical | 9.1 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-18664 When ranges are used for access control (i.e. |
critical | 9.1 | — | Nlnetlabs / nsd | 2026-08-26 | 2026-09-08 |
| CVE-2026-86542 knowns before 0.30.0 fails to validate import names in the import routes, allowi... |
critical | 9.1 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-52111 An issue in fast-note-sync-service <=2.13.7 allows a remote attacker to escalate... |
critical | 9.8 | — | — | 2026-09-01 | 2026-09-08 |
| CVE-2026-85504 FreeIPMI before 1.6.19 has a stack-based buffer overflow in _ipmi_sel_oem_fujits... |
critical | 9.8 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-85508 ipmi-oem in FreeIPMI before 1.6.19 has a stack-based buffer overflow in _output_... |
critical | 9.8 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-85509 FreeIPMI before 1.6.19 has a stack-based buffer overflow in _read_fru_data in li... |
critical | 9.8 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-75160 An issue in X-Serie Gateway Firmware V6_00_05 allows a remote attacker to escala... |
critical | 9.1 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-75431 PowerJob Server version 5.1.2 (and likely earlier) uses a predictable JWT signin... |
critical | 9.1 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-31020 In DocsGPT 0.15.0 and below, the application provides a custom prompt feature th... |
critical | 9.8 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-75430 PowerJob Worker version 5.1.2 (and likely earlier versions) exposes the /worker/... |
critical | 9.8 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-18221 IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to gain unauthorized... |
critical | 9.8 | — | Ibm / i | 2026-09-04 | 2026-09-08 |
| CVE-2026-86304 MojoX::Authentication versions before 0.006 for Perl allow SAML authentication b... |
critical | 9.8 | — | — | 2026-09-06 | 2026-09-08 |
| CVE-2026-86219 Authen::SASL::Perl::DIGEST_MD5 versions before 2.2100 for Perl accept replayed a... |
critical | 9.8 | — | — | 2026-09-06 | 2026-09-08 |
| CVE-2026-86149 A weakness has been identified in Tenda CP3 27.5.57.101. |
critical | 9.1 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-80181 Apache Allura's webhooks are vulnerable to Server-Side Request Forgery (SSRF). |
critical | 9.1 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-78327 An Improper Neutralization of Special Elements used in an OS Command ('OS Comman... |
critical | 9.1 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-78328 A missing authorization vulnerability in the SonicWall Network Security Manager... |
critical | 9.1 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-81939 A Zip Slip vulnerability in the SonicWall Network Security Manager (NSM) On-Prem... |
critical | 9.1 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-76969 @sap/cds-mtxs NPM library does not perform sufficient checks on certain function... |
critical | 9.4 | — | — | 2026-09-08 | 2026-09-08 |
| CVE-2026-85146 SmartIT Desktop Manager developed by Lightstar has a Use of Hard-coded Credentia... |
critical | 9.8 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-85148 SmartIT Desktop Manager developed by Lightstar has a Use of Hard-coded Credentia... |
critical | 9.8 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-82923 The AI Website Builder WordPress plugin (GitHub build) 1.0.0 does not perform an... |
critical | 9.8 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-78362 The SEO Flow by LupsOnline WordPress plugin before 3.0.3 does not correctly vali... |
critical | 9.8 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-78234 A flaw was found in hawtio-operator. |
critical | 9.9 | — | — | 2026-09-08 | 2026-09-08 |
| CVE-2025-67038 Lantronix EDS5000 Code Injection Vulnerability |
critical | 9.8 | Listed | Lantronix / EDS5000 | 2026-03-11 | 2026-09-08 |
| CVE-2026-50093 A vulnerability has been identified in Siveillance Control Pro V3.0 (All version... |
critical | 9.0 | — | — | 2026-09-08 | 2026-09-08 |
| CVE-2026-62645 A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). |
critical | 9.8 | — | — | 2026-09-08 | 2026-09-08 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.