September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,186
Critical
1,210
High
4,308
Medium
4,071
Low
456
Severity not reported
1,141
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (605), oracle (274), apple (244), adobe (197), dell (137), ibm (104), arubanetworks (101), mongodb (64), apache (53)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-84324 Use after free in Proxy in Google Chrome prior to 152.0.7977.75 allowed a remote... |
critical | 9.0 | — | Google / chrome | 2026-09-02 | 2026-09-03 |
| CVE-2026-84325 Improper input validation in DataTransfer in Google Chrome prior to 152.0.7977.7... |
critical | 9.8 | — | Google / chrome | 2026-09-02 | 2026-09-03 |
| CVE-2026-19117 Under specific conditions, an attacker can register an attacker-controlled FIDO2... |
critical | 9.8 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-9698 DBI versions before 1.648 for Perl saved errors in a limited-sized buffer. |
critical | 9.8 | — | Perl / dbi | 2026-06-09 | 2026-09-03 |
| CVE-2026-83548 SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability |
critical | 10.0 | Listed | SonicWall / SMA1000 Appliances | 2026-09-01 | 2026-09-03 |
| CVE-2026-82329 JFrog Artifactory Improper Authentication Vulnerability |
critical | 9.8 | Listed | JFrog / Artifactory | 2026-08-28 | 2026-09-03 |
| CVE-2026-20212 A vulnerability in the Silicon One integration for Cisco Nexus 9000 Series Switc... |
critical | 9.8 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-84129 Site isolation issue in the DOM: Navigation component. |
critical | 9.8 | — | Mozilla / firefox | 2026-09-01 | 2026-09-03 |
| CVE-2023-7299 A vulnerability was found in DataGear up to 4.60. |
critical | 9.8 | — | Datagear / datagear | 2024-11-23 | 2026-09-03 |
| CVE-2023-7249 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') v... |
critical | 9.8 | — | Opentext / directory services | 2024-08-12 | 2026-09-03 |
| CVE-2026-51769 Incorrect access control in the remoteCloudUpdateCheck function of TOTOLINK T6 4... |
critical | 9.8 | — | — | 2026-09-01 | 2026-09-02 |
| CVE-2026-51765 Incorrect access control in the recvIndirectMeshInfo function of TOTOLINK T6 4.1... |
critical | 9.8 | — | — | 2026-09-01 | 2026-09-02 |
| CVE-2026-51770 Incorrect access control in the sendToMasterQosConfig function of TOTOLINK T6 4.... |
critical | 9.8 | — | — | 2026-09-01 | 2026-09-02 |
| CVE-2026-18550 The Nokri - Job Board WordPress Theme for WordPress is vulnerable to Privilege E... |
critical | 9.8 | — | — | 2026-09-01 | 2026-09-02 |
| CVE-2026-84119 Sandbox escape due to use-after-free in the DOM: Navigation component. |
critical | 9.6 | — | Mozilla / firefox | 2026-09-01 | 2026-09-02 |
| CVE-2026-84121 Sandbox escape due to use-after-free in the DOM: Security component. |
critical | 9.6 | — | Mozilla / firefox | 2026-09-01 | 2026-09-02 |
| CVE-2026-73700 A vulnerability in the web-based management interface of HPE Networking Fabric C... |
critical | 9.0 | — | Arubanetworks / fabric composer | 2026-09-01 | 2026-09-02 |
| CVE-2026-73701 An unauthenticated remote code execution vulnerability exists in the underlying... |
critical | 9.0 | — | Arubanetworks / fabric composer | 2026-09-01 | 2026-09-02 |
| CVE-2026-51934 Buffer Overflow vulnerability in Shenzhen Jixiang Tengda Technology Co., Ltd. |
critical | 9.8 | — | — | 2026-09-01 | 2026-09-02 |
| CVE-2026-47864 SerializingHttpMessageConverter deserializes the body of incoming HTTP requests... |
critical | 9.8 | — | Vmware / spring integration | 2026-08-27 | 2026-09-02 |
| CVE-2026-47875 Applications that deserialize execution contexts with Jackson2ExecutionContextSt... |
critical | 9.8 | — | Broadcom / spring batch | 2026-08-27 | 2026-09-02 |
| CVE-2026-76657 Vulnerabilities have been identified in the API of HPE Networking Fabric Compose... |
critical | 10.0 | — | Arubanetworks / fabric composer | 2026-09-01 | 2026-09-02 |
| CVE-2026-76658 A vulnerability has been identified in the SSH daemon of HPE Networking Fabric C... |
critical | 10.0 | — | Arubanetworks / fabric composer | 2026-09-01 | 2026-09-02 |
| CVE-2026-58062 In Bouncy Castle for Java before 1.85, Stapled OCSP response accepted without bi... |
critical | 9.1 | — | Bouncycastle / bc-java | 2026-08-03 | 2026-09-02 |
| CVE-2026-8763 In Bouncy Castle for Java before 1.85, Name Constraints bypass via trailing dot... |
critical | 9.1 | — | Bouncycastle / bc-java | 2026-08-03 | 2026-09-02 |
| CVE-2026-84795 Craft CMS before 5.10.11 fails to validate the admin flag during user registrati... |
critical | 9.8 | — | — | 2026-09-02 | 2026-09-02 |
| CVE-2026-84803 SiYuan before v3.8.2 contains a stored cross-site scripting vulnerability in ass... |
critical | 9.0 | — | — | 2026-09-02 | 2026-09-02 |
| CVE-2026-9055 The Booking for Appointments and Events Calendar – Amelia (Premium) plugin for W... |
critical | 9.8 | — | — | 2026-09-02 | 2026-09-02 |
| CVE-2026-78657 The SigmaForms Pro – AI Generated Forms plugin for WordPress is vulnerable to ar... |
critical | 9.8 | — | — | 2026-09-02 | 2026-09-02 |
| CVE-2026-81294 Unauthenticated Privilege Escalation in Authorizer <= 3.15.1 versions. |
critical | 9.8 | — | — | 2026-09-02 | 2026-09-02 |
| CVE-2026-53622 Traefik is an HTTP reverse proxy and load balancer. |
critical | 10.0 | — | Traefik / traefik | 2026-06-23 | 2026-09-02 |
| CVE-2026-48491 Traefik is an HTTP reverse proxy and load balancer. |
critical | 10.0 | — | Traefik / traefik | 2026-06-23 | 2026-09-02 |
| CVE-2026-48020 Traefik is an HTTP reverse proxy and load balancer. |
critical | 10.0 | — | Traefik / traefik | 2026-06-23 | 2026-09-02 |
| CVE-2026-19478 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2... |
critical | 9.1 | — | Gitlab / gitlab | 2026-08-17 | 2026-09-02 |
| CVE-2026-18931 Use of Hard-coded Credentials vulnerability in TMT Machine Industry and Trade Lt... |
critical | 9.1 | — | — | 2026-09-01 | 2026-09-01 |
| CVE-2026-51743 Incorrect access control in the guest_wifi_sync function of TOTOLINK T6 4.1.5cu.... |
critical | 9.1 | — | — | 2026-09-01 | 2026-09-01 |
| CVE-2026-75865 The WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Go... |
critical | 9.8 | — | — | 2026-09-01 | 2026-09-01 |
| CVE-2026-83772 A vulnerability was detected in Cobham SATCOM VSAT7090 Maritime Satellite Router... |
critical | 9.9 | — | — | 2026-09-01 | 2026-09-01 |
| CVE-2026-59270 Spring Security's embedded UnboundID LDAP server (UnboundIdContainer) unconditio... |
critical | 9.1 | — | Vmware / spring security | 2026-08-27 | 2026-09-01 |
| CVE-2026-75871 GitLab has remediated a vulnerability in the GitLab AI Gateway component affecti... |
critical | 9.6 | — | Gitlab / gitlab | 2026-08-27 | 2026-09-01 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.