September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,186
Critical
1,210
High
4,308
Medium
4,071
Low
456
Severity not reported
1,141
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (605), oracle (274), apple (244), adobe (197), dell (137), ibm (104), arubanetworks (101), mongodb (64), apache (53)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-88921 MISP contains an HTML injection vulnerability in the MISPElementHTMLFormatterToo... |
not reported | — | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-85586 phpMyFAQ versions before 4.1.8 fail to validate CAPTCHA when the store parameter... |
not reported | — | — | — | 2026-09-04 | 2026-09-10 |
| CVE-2026-85591 phpMyFAQ versions before 4.1.8 contain an authentication bypass vulnerability in... |
not reported | — | — | — | 2026-09-04 | 2026-09-10 |
| CVE-2026-47156 MantisBT is an open source bug tracker. |
not reported | — | — | — | 2026-09-09 | 2026-09-10 |
| CVE-2026-88069 Pandora contains a path traversal vulnerability in its archive extraction worker... |
not reported | — | — | — | 2026-09-09 | 2026-09-10 |
| CVE-2026-81904 Concrete CMS below 9.5.3 registered view assets for every sub-block of a Stack,... |
not reported | — | — | — | 2026-09-08 | 2026-09-10 |
| CVE-2026-21111 Out-of-bounds write in libsthmbc.so prior to One UI 8.5 allows local attackers t... |
not reported | — | — | — | 2026-09-09 | 2026-09-10 |
| CVE-2026-21106 Improper verification of intent by broadcast receiver in Samsung Cloud Assistant... |
not reported | — | — | — | 2026-09-09 | 2026-09-10 |
| CVE-2026-21109 Improper access control in Watch Plugin prior to Android Watch 17 allows local a... |
not reported | — | — | — | 2026-09-09 | 2026-09-10 |
| CVE-2026-21110 Out-of-bounds write in libsavscmn.so prior to One UI 8.5 allows local attackers... |
not reported | — | — | — | 2026-09-09 | 2026-09-10 |
| CVE-2026-78082 Joomla Extension - joomshaper.com - Unauthenticated SQL Injection in Property Se... |
not reported | — | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-78083 Joomla Extension - joomshaper.com - Missing CSRF Token Verification in Property... |
not reported | — | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-78084 Joomla Extension - joomshaper.com - Missing Access Control in Gallery Image Mana... |
not reported | — | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-78302 Joomla Extension - joomshaper.com - Unauthenticated Stored Cross-Site Scripting... |
not reported | — | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-78303 Joomla Extension - joomshaper.com - Unvalidated Email Destination & Form Manipul... |
not reported | — | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-78374 Joomla Extension - joomlart.com - Open mail relay via contact AJAX endpoint in T... |
not reported | — | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-78085 Joomla Extension - joomshaper.com - Path Traversal in Gallery Image Management i... |
not reported | — | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-0305 An information disclosure vulnerability in the Palo Alto Networks Prisma® Access... |
not reported | — | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-0306 A vulnerability in the EndPoint Data Loss Prevention (DLP) enforcement of Palo A... |
not reported | — | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-0302 An OS command injection vulnerability in Palo Alto Networks Checkov by Prisma® C... |
not reported | — | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-0303 A code execution vulnerability in Palo Alto Networks Checkov by Prisma® Cloud ca... |
not reported | — | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-85546 MISP contains a cross-site request forgery (CSRF) vulnerability in the sharing g... |
not reported | — | — | — | 2026-09-04 | 2026-09-10 |
| CVE-2026-87804 Rejected reason: no security impact |
not reported | — | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-85384 A stack-based buffer overflow vulnerability exists in the httpd component of RE2... |
not reported | — | — | — | 2026-09-08 | 2026-09-10 |
| CVE-2026-8044 CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument I... |
not reported | — | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-84197 In Eclipse Ditto's Node.js JavaScript client, all released versions of @eclipse-... |
not reported | — | — | — | 2026-09-08 | 2026-09-09 |
| CVE-2026-86464 In the current development version of Eclipse aeriOS, for which no official rele... |
not reported | — | — | — | 2026-09-08 | 2026-09-09 |
| CVE-2026-79696 A Code Injection vulnerability in adk web in Google Cloud Agent Development Kit... |
not reported | — | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-77120 CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS C... |
not reported | — | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-19233 CWE-918: Server-Side Request Forgery (SSRF) vulnerability exists that could caus... |
not reported | — | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-84303 gRPC-Go is the Go language implementation of gRPC. |
not reported | — | — | — | 2026-09-01 | 2026-09-09 |
| CVE-2026-84304 gRPC-Go is the Go language implementation of gRPC. |
not reported | — | — | — | 2026-09-01 | 2026-09-09 |
| CVE-2026-84305 sqlparse is a non-validating SQL parser module for Python. |
not reported | — | — | — | 2026-09-01 | 2026-09-09 |
| CVE-2026-84361 Composer is a dependency Manager for the PHP language. |
not reported | — | — | — | 2026-09-01 | 2026-09-09 |
| CVE-2026-53600 async-tar is a tar archive reading/writing library for async Rust. |
not reported | — | — | — | 2026-09-02 | 2026-09-09 |
| CVE-2026-53720 pymonocypher uses cython to wrap the Monocypher C library. |
not reported | — | — | — | 2026-09-03 | 2026-09-09 |
| CVE-2026-85062 Colord is a tiny yet powerful tool for high-performance color manipulations and... |
not reported | — | — | — | 2026-09-03 | 2026-09-09 |
| CVE-2026-85063 node-csv is a full-featured CSV parser with a simple API that is tested against... |
not reported | — | — | — | 2026-09-03 | 2026-09-09 |
| CVE-2026-85730 smol-toml is a small, fast, and correct TOML parser and serializer. |
not reported | — | — | — | 2026-09-04 | 2026-09-09 |
| CVE-2026-50553 Note Mark is an open-source note-taking application. |
not reported | — | — | — | 2026-09-04 | 2026-09-09 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.