September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,186
Critical
1,210
High
4,308
Medium
4,071
Low
456
Severity not reported
1,141
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (605), oracle (274), apple (244), adobe (197), dell (137), ibm (104), arubanetworks (101), mongodb (64), apache (53)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-62928 XING CPTrans-ME-X contains an OS Command Injection (CWE-78). |
critical | 9.8 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-69657 XING CPTrans-ME-X contains a Use of Default Password (CWE-1393). |
critical | 9.8 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-70403 XING CPTrans-ME-X contains a Use of Hard-coded Password (CWE-259). |
critical | 9.8 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-26084 A improper access control vulnerability in Fortinet FortiSandbox 5.0.0 through 5... |
critical | 9.9 | — | — | 2026-09-08 | 2026-09-08 |
| CVE-2026-86148 A security flaw has been discovered in Tenda CP3 27.5.57.101. |
critical | 9.1 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-86153 A vulnerability has been found in Tenda CP3 27.5.57.101. |
critical | 9.1 | — | — | 2026-09-06 | 2026-09-08 |
| CVE-2026-86167 A vulnerability was identified in Tenda HG10 300001138. |
critical | 9.9 | — | — | 2026-09-06 | 2026-09-08 |
| CVE-2026-17057 IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of... |
critical | 9.1 | — | Ibm / i | 2026-09-04 | 2026-09-08 |
| CVE-2026-80098 Improper verification of cryptographic signature in Copilot Studio allows an una... |
critical | 10.0 | — | Microsoft / copilot studio | 2026-09-03 | 2026-09-08 |
| CVE-2026-84333 Use after free in Dawn in Google Chrome on on Android prior to 152.0.7977.75 all... |
critical | 9.6 | — | Google / chrome | 2026-09-02 | 2026-09-08 |
| CVE-2026-65818 Server-side request forgery (ssrf) in Power Automate allows an authorized attack... |
critical | 9.9 | — | Microsoft / power platform | 2026-09-03 | 2026-09-08 |
| CVE-2026-84352 Use after free in WebGL in Google Chrome on on Android prior to 152.0.7977.75 al... |
critical | 9.6 | — | Google / chrome | 2026-09-02 | 2026-09-08 |
| CVE-2026-84353 Use after free in Shared Tab Groups in Google Chrome on on Android prior to 152.... |
critical | 9.6 | — | Google / chrome | 2026-09-02 | 2026-09-08 |
| CVE-2026-17207 IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of... |
critical | 9.1 | — | Ibm / i | 2026-09-04 | 2026-09-08 |
| CVE-2026-86296 A vulnerability was determined in D-Link DIR-822A A_101. |
critical | 10.0 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-86510 A vulnerability has been found in D-Link DIR-822A A_101. |
critical | 9.9 | — | — | 2026-09-08 | 2026-09-08 |
| CVE-2026-62916 Authentication bypass using an alternate path or channel in Microsoft Entra ID a... |
critical | 9.8 | — | Microsoft / entra id | 2026-09-03 | 2026-09-08 |
| CVE-2026-85042 Use after free in DevTools in Google Chrome prior to 152.0.7977.82 allowed a rem... |
critical | 9.6 | — | Google / chrome | 2026-09-03 | 2026-09-08 |
| CVE-2026-85043 Incomplete cleanup in Network in Google Chrome prior to 152.0.7977.82 allowed a... |
critical | 9.1 | — | Google / chrome | 2026-09-03 | 2026-09-08 |
| CVE-2026-85047 Improper input validation in Transactions Platform in Google Chrome on on iOS pr... |
critical | 9.6 | — | Google / chrome | 2026-09-03 | 2026-09-08 |
| CVE-2026-85050 Out of bounds write in WebGL in Google Chrome on on Android prior to 152.0.7977.... |
critical | 9.6 | — | Google / chrome | 2026-09-03 | 2026-09-08 |
| CVE-2026-78012 An issue in the NetStaX EtherNet/IP Stack prior to v5.6.1 could allow a large Cl... |
critical | 9.8 | — | — | 2026-09-01 | 2026-09-08 |
| CVE-2026-75925 Improper neutralization of CRLF sequences in IXON VPN Client before version 1.4.... |
critical | 9.6 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-73475 Incorrect Authorization vulnerability in Drupal Commerce PayPal allows Forceful... |
critical | 9.1 | — | Centarro / commerce paypal | 2026-09-02 | 2026-09-08 |
| CVE-2026-71374 Deserialization of untrusted data vulnerability in Cosminexus Component Containe... |
critical | 9.8 | — | — | 2026-09-08 | 2026-09-08 |
| CVE-2026-71376 OS command injection vulnerability in Cosminexus Component Container. |
critical | 9.8 | — | — | 2026-09-08 | 2026-09-08 |
| CVE-2026-71377 Command Argument Injection Vulnerability in Cosminexus Component Container. |
critical | 9.8 | — | — | 2026-09-08 | 2026-09-08 |
| CVE-2026-86165 A vulnerability was found in Tenda HG10 300001138. |
critical | 9.8 | — | — | 2026-09-06 | 2026-09-08 |
| CVE-2026-79697 A vulnerability was determined in Advantech WISE-6610-NB, WISE-6610-EB, WISE-661... |
critical | 9.9 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-19274 IBM Observability with Instana (Agent) Build 1.0.303 through 1.0.323 IBM Instana... |
critical | 9.6 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-85085 The Canva Android App before 2.376.0 allowed an external origin to be loaded in... |
critical | 9.6 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-13447 The Mstore Api plugin for WordPress is vulnerable to Authentication Bypass via J... |
critical | 9.8 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-83627 The Hummingbird – Speed Optimization, Caching, Minify, Compress & CDN plugin for... |
critical | 9.8 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-10196 The Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emai... |
critical | 9.8 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-16310 The MemberDash plugin for WordPress is vulnerable to Insecure Direct Object Refe... |
critical | 9.8 | — | — | 2026-09-06 | 2026-09-08 |
| CVE-2026-75816 The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Authentic... |
critical | 9.8 | — | — | 2026-09-06 | 2026-09-08 |
| CVE-2026-33211 Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style... |
critical | 9.6 | — | Linuxfoundation / tekton pipelines | 2026-03-24 | 2026-09-07 |
| CVE-2026-84238 Unauthenticated Broken Access Control in YITH Request a Quote for WooCommerce Pr... |
critical | 9.8 | — | — | 2026-09-03 | 2026-09-07 |
| CVE-2026-84834 Unauthenticated PHP Object Injection in JobSearch <= 3.2.0 versions. |
critical | 9.8 | — | — | 2026-09-03 | 2026-09-07 |
| CVE-2026-11613 The Divi Ajax Filter plugin for WordPress is vulnerable to Local File Inclusion... |
critical | 9.8 | — | — | 2026-09-04 | 2026-09-07 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.