September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,186
Critical
1,210
High
4,308
Medium
4,071
Low
456
Severity not reported
1,141
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (605), oracle (274), apple (244), adobe (197), dell (137), ibm (104), arubanetworks (101), mongodb (64), apache (53)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-69472 Use after free in Windows Devices Human Interface allows an authorized attacker... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-28 |
| CVE-2026-76713 A vulnerability exists in the maintenance restore functionality of Analytics and... |
high | 7.2 | — | Arubanetworks / analytics and location engine | 2026-09-22 | 2026-09-28 |
| CVE-2026-76712 A vulnerability exists in the Analytics and Location Engine (ALE) that may allow... |
high | 7.3 | — | Arubanetworks / analytics and location engine | 2026-09-22 | 2026-09-28 |
| CVE-2026-76710 A vulnerability exists in the Analytics and Location Engine (ALE) management int... |
high | 7.5 | — | Arubanetworks / analytics and location engine | 2026-09-22 | 2026-09-28 |
| CVE-2026-76711 A vulnerability exists in an Analytics and Location Engine (ALE) component where... |
high | 7.5 | — | Arubanetworks / analytics and location engine | 2026-09-22 | 2026-09-28 |
| CVE-2026-69478 Heap-based buffer overflow in Windows Device Association Service allows an autho... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-28 |
| CVE-2026-76685 A vulnerability exists in the proxy packet processing logic of the affected comp... |
high | 8.1 | — | Arubanetworks / edgeconnect sd-wan orchestrator | 2026-09-15 | 2026-09-28 |
| CVE-2026-76689 A vulnerability exists in the configuration processing logic of the affected com... |
high | 7.2 | — | Arubanetworks / edgeconnect sd-wan orchestrator | 2026-09-15 | 2026-09-28 |
| CVE-2026-76682 A vulnerability in the network security monitoring component of intrusion detect... |
high | 8.2 | — | Arubanetworks / edgeconnect sd-wan orchestrator | 2026-09-15 | 2026-09-28 |
| CVE-2026-76686 A vulnerability exists in the underlying operating system of HPE Networking Edge... |
high | 7.5 | — | Arubanetworks / edgeconnect sd-wan orchestrator | 2026-09-15 | 2026-09-28 |
| CVE-2026-76690 A vulnerability exists in a component of the HPE Networking EdgeConnect SD-WAN G... |
high | 7.2 | — | Arubanetworks / edgeconnect sd-wan orchestrator | 2026-09-15 | 2026-09-28 |
| CVE-2026-76691 Buffer overflow vulnerabilities exist in the API endpoint of HPE Networking Edge... |
high | 7.2 | — | Arubanetworks / edgeconnect sd-wan orchestrator | 2026-09-15 | 2026-09-28 |
| CVE-2026-69480 Heap-based buffer overflow in Windows Partition Management Driver allows an auth... |
high | 7.8 | — | Microsoft / windows 10 21h2 | 2026-09-08 | 2026-09-28 |
| CVE-2026-76683 Buffer overflow vulnerabilities exist in the API endpoint of HPE Networking Edge... |
high | 8.1 | — | Arubanetworks / edgeconnect sd-wan orchestrator | 2026-09-15 | 2026-09-28 |
| CVE-2026-69481 Heap-based buffer overflow in Windows Enterprise App Management allows an author... |
high | 8.0 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-28 |
| CVE-2026-76679 Vulnerabilities in HPE Networking EdgeConnect SD-WAN Gateways could allow an una... |
high | 8.6 | — | Arubanetworks / edgeconnect sd-wan orchestrator | 2026-09-15 | 2026-09-28 |
| CVE-2026-76678 A vulnerability in the API endpoint of HPE Networking EdgeConnect SD-WAN Gateway... |
high | 8.8 | — | Arubanetworks / edgeconnect sd-wan orchestrator | 2026-09-15 | 2026-09-28 |
| CVE-2026-76677 A privilege escalation vulnerability exists in the API of EdgeConnect SD-WAN Gat... |
high | 8.8 | — | Arubanetworks / edgeconnect sd-wan orchestrator | 2026-09-15 | 2026-09-28 |
| CVE-2026-76676 Buffer overflow vulnerabilities exist in the underlying operating system of Edge... |
high | 8.8 | — | Arubanetworks / edgeconnect sd-wan orchestrator | 2026-09-15 | 2026-09-28 |
| CVE-2026-69482 Creation of temporary file in directory with insecure permissions in Windows Err... |
high | 7.1 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-28 |
| CVE-2026-76693 A vulnerability in HPE Networking EdgeConnect SD-WAN Gateways could allow an una... |
high | 7.0 | — | Arubanetworks / edgeconnect sd-wan orchestrator | 2026-09-15 | 2026-09-28 |
| CVE-2026-76692 A vulnerability in HPE Networking EdgeConnect SD-WAN Gateways could allow an una... |
high | 7.1 | — | Arubanetworks / edgeconnect sd-wan orchestrator | 2026-09-15 | 2026-09-28 |
| CVE-2026-77271 MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (C... |
high | 8.8 | — | Mcp-atlassian / mcp atlassian | 2026-09-22 | 2026-09-28 |
| CVE-2026-69488 Use after free in Windows Device Association Service allows an authorized attack... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-28 |
| CVE-2026-69492 Heap-based buffer overflow in Windows Partition Management Driver allows an auth... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-28 |
| CVE-2026-77274 MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (C... |
high | 8.2 | — | Mcp-atlassian / mcp atlassian | 2026-09-22 | 2026-09-28 |
| CVE-2026-69494 Out-of-bounds read in Windows Event Logging Service allows an unauthorized attac... |
high | 8.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-28 |
| CVE-2026-69495 Heap-based buffer overflow in Windows Event Logging Service allows an unauthoriz... |
high | 8.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-28 |
| CVE-2026-77248 MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (C... |
high | 8.6 | — | Mcp-atlassian / mcp atlassian | 2026-09-22 | 2026-09-28 |
| CVE-2026-79708 GitLab has remediated an issue in GitLab EE affecting all versions from 19.0 bef... |
high | 8.5 | — | Gitlab / gitlab | 2026-09-16 | 2026-09-28 |
| CVE-2026-1168 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.4.... |
high | 7.5 | — | Gitlab / gitlab | 2026-09-16 | 2026-09-28 |
| CVE-2026-77253 MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (C... |
high | 7.1 | — | Mcp-atlassian / mcp atlassian | 2026-09-22 | 2026-09-28 |
| CVE-2026-101066 A vulnerability was determined in dbgate up to 7.3.1. |
high | 7.3 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-101052 A security vulnerability has been detected in refly-ai refly up to 1.1.0. |
high | 7.3 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-76425 A vulnerability in the APIs of Cisco ISE could allow an authenticated, remote at... |
high | 7.6 | — | Cisco / identity services engine | 2026-09-16 | 2026-09-28 |
| CVE-2026-76424 A vulnerability in the REST API of Cisco ISE could allow an authenticated, remot... |
high | 7.2 | — | Cisco / identity services engine | 2026-09-16 | 2026-09-28 |
| CVE-2026-88772 Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memor... |
high | 8.1 | Listed | Citrix / NetScaler | 2026-09-27 | 2026-09-28 |
| CVE-2026-87902 WordPress Core Remote File Inclusion Vulnerability |
high | 8.1 | Listed | WordPress / Core | 2026-09-22 | 2026-09-28 |
| CVE-2026-97520 In the Linux kernel, the following vulnerability has been resolved:
gfs2: move... |
high | 7.1 | — | — | 2026-09-24 | 2026-09-28 |
| CVE-2026-97474 In the Linux kernel, the following vulnerability has been resolved:
wifi: iwlwi... |
high | 7.4 | — | — | 2026-09-24 | 2026-09-28 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.