September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,186
Critical
1,210
High
4,308
Medium
4,071
Low
456
Severity not reported
1,141
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (605), oracle (274), apple (244), adobe (197), dell (137), ibm (104), arubanetworks (101), mongodb (64), apache (53)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-84753 Unauthenticated PHP Object Injection in Mail Mint <= 1.31.0 versions. |
critical | 9.8 | — | — | 2026-09-03 | 2026-09-05 |
| CVE-2026-72676 Improper Control of Generation of Code ('Code Injection') (CWE-94) in Fleet Serv... |
critical | 9.1 | — | Elastic / kibana | 2026-08-13 | 2026-09-04 |
| CVE-2026-19766 An authentication bypass vulnerability exists in the underlying operating system... |
critical | 9.6 | — | Arubanetworks / fabric composer | 2026-09-01 | 2026-09-04 |
| CVE-2025-15379 A command injection vulnerability exists in MLflow's model serving container ini... |
critical | 10.0 | — | Lfprojects / mlflow | 2026-03-30 | 2026-09-04 |
| CVE-2026-47837 Missing Authentication for Critical Function vulnerability in Spring Spring Clou... |
critical | 9.8 | — | Vmware / spring cloud config | 2026-08-26 | 2026-09-04 |
| CVE-2026-85224 A vulnerability was determined in D-Link DNS-320 ShareCenter 2.06B01. |
critical | 9.1 | — | — | 2026-09-03 | 2026-09-04 |
| CVE-2026-85223 A vulnerability was found in D-Link DNS-340L 1.01B04. |
critical | 9.9 | — | — | 2026-09-03 | 2026-09-04 |
| CVE-2026-84813 Unauthenticated SQL Injection in GeoDirectory <= 2.8.174 versions. |
critical | 9.3 | — | — | 2026-09-03 | 2026-09-04 |
| CVE-2026-85222 A vulnerability has been found in D-Link DNS-340L 1.01B04. |
critical | 9.1 | — | — | 2026-09-03 | 2026-09-04 |
| CVE-2019-3773 Spring Web Services, versions 2.4.3, 3.0.4, and older unsupported versions of al... |
critical | 9.8 | — | Broadcom / spring web services | 2019-01-18 | 2026-09-04 |
| CVE-2026-33228 flatted is a circular JSON parser. |
critical | 9.8 | — | Webreflection / flatted | 2026-03-20 | 2026-09-04 |
| CVE-2026-81286 Unauthenticated SQL Injection in WCFM Marketplace <= 3.8.1 versions. |
critical | 9.3 | — | — | 2026-09-02 | 2026-09-04 |
| CVE-2026-84637 Malicious calendar invitations could use file URI attachments to launch local or... |
critical | 9.8 | — | Mozilla / thunderbird | 2026-09-01 | 2026-09-03 |
| CVE-2026-84639 Triggering an error condition in certain MIME bodies would cause uninitialized m... |
critical | 9.1 | — | Mozilla / thunderbird | 2026-09-01 | 2026-09-03 |
| CVE-2026-84133 Site isolation issue in the DOM: Push Subscriptions component. |
critical | 9.8 | — | Mozilla / firefox | 2026-09-01 | 2026-09-03 |
| CVE-2026-84134 Other issue in the Profile Backup component. |
critical | 9.8 | — | Mozilla / firefox | 2026-09-01 | 2026-09-03 |
| CVE-2026-84814 Subscriber Privilege Escalation in Bricksforge <= 3.1.8.8 versions. |
critical | 9.8 | — | — | 2026-09-03 | 2026-09-03 |
| CVE-2026-84768 Unauthenticated SQL Injection in VikAppointments Services Booking Calendar <= 1.... |
critical | 9.3 | — | — | 2026-09-03 | 2026-09-03 |
| CVE-2026-84143 Internally found bugs present in Thunderbird 154, Thunderbird ESR 153.1 and Thun... |
critical | 9.8 | — | Mozilla / firefox | 2026-09-01 | 2026-09-03 |
| CVE-2026-84140 Site isolation issue in the DOM: Navigation component. |
critical | 9.8 | — | Mozilla / firefox | 2026-09-01 | 2026-09-03 |
| CVE-2026-84141 Integer overflow in the Graphics: ImageLib component. |
critical | 9.8 | — | Mozilla / firefox | 2026-09-01 | 2026-09-03 |
| CVE-2026-84142 Internally found bugs present in Thunderbird 154. |
critical | 9.8 | — | Mozilla / firefox | 2026-09-01 | 2026-09-03 |
| CVE-2026-84135 Other issue in Firefox Focus for Android. |
critical | 9.8 | — | Mozilla / firefox mobile | 2026-09-01 | 2026-09-03 |
| CVE-2026-51754 Incorrect access control in the updateSlaveIpList function of TOTOLINK T6 4.1.5c... |
critical | 9.8 | — | — | 2026-09-01 | 2026-09-03 |
| CVE-2026-51762 Incorrect access control in the meshInfoKick function of TOTOLINK T6 4.1.5cu.748... |
critical | 9.8 | — | — | 2026-09-01 | 2026-09-03 |
| CVE-2026-51767 Incorrect access control in the recvClearPairCfg function of TOTOLINK T6 4.1.5cu... |
critical | 9.8 | — | — | 2026-09-01 | 2026-09-03 |
| CVE-2026-51741 Incorrect access control in the clearDiagnosisLog function of TOTOLINK T6 4.1.5c... |
critical | 9.8 | — | — | 2026-09-01 | 2026-09-03 |
| CVE-2026-51747 Incorrect access control in the keepAlive function of TOTOLINK T6 4.1.5cu.748_B2... |
critical | 9.8 | — | — | 2026-09-01 | 2026-09-03 |
| CVE-2026-4357 The Embed HTML5 Game WordPress plugin through 1.3 does not properly restrict who... |
critical | 10.0 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-77009 The WatchMan-Site7 WordPress plugin through 4.2.0 does not restrict access to it... |
critical | 9.9 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-84354 Incorrect authorization in FileSystem in Google Chrome prior to 152.0.7977.75 al... |
critical | 9.6 | — | Google / chrome | 2026-09-02 | 2026-09-03 |
| CVE-2026-85031 A vulnerability was found in TOTOLINK CP450 4.1.0. |
critical | 9.9 | — | — | 2026-09-03 | 2026-09-03 |
| CVE-2026-85109 A vulnerability was determined in Tenda HG10 300001138. |
critical | 9.8 | — | — | 2026-09-03 | 2026-09-03 |
| CVE-2026-51744 Incorrect access control in the recv_mesh_info_sync function of TOTOLINK T6 4.1.... |
critical | 9.8 | — | — | 2026-09-01 | 2026-09-03 |
| CVE-2026-51750 Incorrect access control in the updatePriChannel function of TOTOLINK T6 4.1.5cu... |
critical | 9.8 | — | — | 2026-09-01 | 2026-09-03 |
| CVE-2026-51751 Incorrect access control in the delSlaveDevice function of TOTOLINK T6 4.1.5cu.7... |
critical | 9.8 | — | — | 2026-09-01 | 2026-09-03 |
| CVE-2026-51757 Incorrect access control in the meshSlaveUpdate function of TOTOLINK T6 4.1.5cu.... |
critical | 9.8 | — | — | 2026-09-01 | 2026-09-03 |
| CVE-2026-51760 Incorrect access control in the informSyncUpgfw function of TOTOLINK T6 4.1.5cu.... |
critical | 9.8 | — | — | 2026-09-01 | 2026-09-03 |
| CVE-2026-51763 Incorrect access control in the freeStaClient function of TOTOLINK T6 4.1.5cu.74... |
critical | 9.8 | — | — | 2026-09-01 | 2026-09-03 |
| CVE-2026-51764 Incorrect access control in the recvSlaveCloudCheckStatus function of TOTOLINK T... |
critical | 9.8 | — | — | 2026-09-01 | 2026-09-03 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.