September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,186
Critical
1,210
High
4,308
Medium
4,071
Low
456
Severity not reported
1,141
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (605), oracle (274), apple (244), adobe (197), dell (137), ibm (104), arubanetworks (101), mongodb (64), apache (53)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-83613 xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser... |
not reported | — | — | — | 2026-09-01 | 2026-09-08 |
| CVE-2026-83614 xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser... |
not reported | — | — | — | 2026-09-01 | 2026-09-08 |
| CVE-2026-83615 xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser... |
not reported | — | — | — | 2026-09-01 | 2026-09-08 |
| CVE-2026-83616 xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser... |
not reported | — | — | — | 2026-09-01 | 2026-09-08 |
| CVE-2026-83617 xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser... |
not reported | — | — | — | 2026-09-01 | 2026-09-08 |
| CVE-2026-83618 xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser... |
not reported | — | — | — | 2026-09-01 | 2026-09-08 |
| CVE-2026-83619 xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser... |
not reported | — | — | — | 2026-09-01 | 2026-09-08 |
| CVE-2026-53757 Emlog is an open source website building system. |
not reported | — | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-73848 Emlog is an open source website building system. |
not reported | — | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-53602 nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. |
not reported | — | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-53603 nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. |
not reported | — | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-53604 nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. |
not reported | — | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-52762 YesWiki is a wiki system written in PHP. |
not reported | — | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-52777 YesWiki is a wiki system written in PHP. |
not reported | — | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-84193 LibreNMS through 26.2.0 contains a stored cross-site scripting vulnerability in... |
not reported | — | — | — | 2026-09-01 | 2026-09-08 |
| CVE-2026-84194 LibreNMS versions >= 23.10.0 and < 26.2.0 (fixed in 26.4.0) contain an authentic... |
not reported | — | — | — | 2026-09-01 | 2026-09-08 |
| CVE-2026-84481 WWBN AVideo through 30.0 contains an information disclosure vulnerability in the... |
not reported | — | — | — | 2026-09-01 | 2026-09-08 |
| CVE-2026-85587 phpMyFAQ before 4.1.8 enforces incorrect permission checks on admin content page... |
not reported | — | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-85589 phpMyFAQ before 4.2.0-alpha.2 contains a missing authorization vulnerability in... |
not reported | — | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-85590 phpMyFAQ before 4.1.8 contains an authentication bypass vulnerability in its two... |
not reported | — | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-86193 grav-plugin-api before 1.0.20 fails to validate group-inherited super permission... |
not reported | — | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-86195 grav-plugin-api versions before 1.0.20 contain a privilege escalation vulnerabil... |
not reported | — | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-86196 Grav API plugin versions before 1.0.20 build password reset links from the untru... |
not reported | — | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-67397 Path traversal in Plesk 18.0.79.9 and earlier and 18.0.80 through 18.0.80.5 allo... |
not reported | — | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-85458 Divide-by-zero in Xpdf 4.06 (and earlier), when a glyph in a Type 3 font has a z... |
not reported | — | — | — | 2026-09-03 | 2026-09-08 |
| CVE-2026-78216 AshLua exposes Ash read actions to Lua scripts run through an eval action. |
not reported | — | — | — | 2026-09-08 | 2026-09-08 |
| CVE-2026-78230 AshAi exposes Ash read actions to language-model tool calls. |
not reported | — | — | — | 2026-09-08 | 2026-09-08 |
| CVE-2026-86477 Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. |
not reported | — | — | — | 2026-09-08 | 2026-09-08 |
| CVE-2026-86283 MISP's UiBeta theme collection view (app/View/Themed/UiBeta/Collections/view.ctp... |
not reported | — | — | — | 2026-09-06 | 2026-09-08 |
| CVE-2026-82752 Improper Validation of Specified Quantity in Input vulnerability in ash-project... |
not reported | — | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-82750 Improper Validation of Specified Quantity in Input in ZenHive mpp allows an unau... |
not reported | — | — | — | 2026-09-06 | 2026-09-08 |
| CVE-2026-82751 Improper Validation of Specified Quantity in Input in ZenHive mpp allows an unau... |
not reported | — | — | — | 2026-09-06 | 2026-09-08 |
| CVE-2026-16769 An unencrypted 'pause encryption request' message causes a denial of service in... |
not reported | — | — | — | 2026-09-08 | 2026-09-08 |
| CVE-2026-86207 An authentication bypass in N-central < 2026.3 HF 3 leads to authentication bypa... |
not reported | — | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-86206 A vulnerability in the N-central internal API access control filter allows unaut... |
not reported | — | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-18167 A
stack-based buffer overflow vulnerability exists in the EasyMesh module of
TP-... |
not reported | — | — | — | 2026-09-03 | 2026-09-08 |
| CVE-2026-84186 Vulnerability involving incorrect access control in the Tools::getRemoteAddr() f... |
not reported | — | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-77132 It has been discovered that several AJAX routes used for the backend localizatio... |
not reported | — | — | — | 2026-09-08 | 2026-09-08 |
| CVE-2026-85400 Backend administrators without system maintainer privileges were able to schedul... |
not reported | — | — | — | 2026-09-08 | 2026-09-08 |
| CVE-2026-86135 A Cross-Site Request Forgery (CSRF) vulnerability in WatchGuard Dimension's data... |
not reported | — | — | — | 2026-09-08 | 2026-09-08 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.