September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,186
Critical
1,210
High
4,308
Medium
4,071
Low
456
Severity not reported
1,141
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (605), oracle (274), apple (244), adobe (197), dell (137), ibm (104), arubanetworks (101), mongodb (64), apache (53)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-84549 An out-of-bounds read was addressed with improved bounds checking. |
high | 7.5 | — | Apple / macos | 2026-09-14 | 2026-09-27 |
| CVE-2026-92126 Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier does not reject... |
high | 8.5 | — | Jenkins / script security | 2026-09-16 | 2026-09-27 |
| CVE-2026-83311 Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component:... |
high | 8.5 | — | — | 2026-09-15 | 2026-09-27 |
| CVE-2026-83964 Adobe Connect is affected by an Improper Certificate Validation vulnerability th... |
high | 7.5 | — | Adobe / connect | 2026-09-22 | 2026-09-26 |
| CVE-2026-84499 A flaw was found in Red Hat Ansible Automation Platform's automation-
controller... |
high | 7.7 | — | — | 2026-09-23 | 2026-09-26 |
| CVE-2026-82003 Adobe Campaign Classic (ACC) is affected by an Improper Input Validation vulnera... |
high | 8.5 | — | Adobe / campaign | 2026-09-22 | 2026-09-26 |
| CVE-2026-16591 The WP Directory Kit WordPress plugin before 1.5.8 does not sanitize and escape... |
high | 7.2 | — | — | 2026-09-26 | 2026-09-26 |
| CVE-2026-100713 Froxlor 2.3.10 and earlier contain a time-of-check time-of-use (TOCTOU) race con... |
high | 7.8 | — | — | 2026-09-26 | 2026-09-26 |
| CVE-2026-100718 Froxlor through 2.3.10 does not enforce the mail.allow_external_domains policy i... |
high | 7.1 | — | — | 2026-09-26 | 2026-09-26 |
| CVE-2026-100720 Froxlor 2.0.0 through 2.3.10 is vulnerable to stored cross-site scripting. |
high | 8.7 | — | — | 2026-09-26 | 2026-09-26 |
| CVE-2026-80149 Lantronix SLC8000 before firmware v9.7.0.3, SLC9000 before firmware v9.7.0.2, EM... |
high | 8.6 | — | — | 2026-09-22 | 2026-09-26 |
| CVE-2026-80150 Lantronix SLC8000 before firmware v9.7.0.3, SLC9000 before firmware v9.7.0.2, EM... |
high | 7.5 | — | — | 2026-09-22 | 2026-09-26 |
| CVE-2026-80148 Lantronix SLC8000 before firmware v9.7.0.3, SLC9000 before firmware v9.7.0.2, EM... |
high | 8.6 | — | — | 2026-09-22 | 2026-09-26 |
| CVE-2026-94367 OpenEye Apex Network Video Recorder (NVR) firmware 3.2.9.376 contains an OS comm... |
high | 7.2 | — | — | 2026-09-23 | 2026-09-26 |
| CVE-2026-96749 An integer overflow in the BSON document encoding component of the MongoDB Pytho... |
high | 8.4 | — | — | 2026-09-24 | 2026-09-26 |
| CVE-2026-89325 An uncontrolled search path element in InsightVM assessment content in Rapid7 In... |
high | 7.8 | — | — | 2026-09-24 | 2026-09-26 |
| CVE-2026-82164 Dell Trusted Device Client, versions prior to 8.1.359.0, contain an Incorrect Pe... |
high | 7.1 | — | — | 2026-09-24 | 2026-09-26 |
| CVE-2026-95924 A vulnerability has been found in SourceCodester Online Reviewer Management Syst... |
high | 7.3 | — | — | 2026-09-23 | 2026-09-26 |
| CVE-2026-96272 ClipBucket v5 before 5.5.3-#182 contains a blind SQL injection vulnerability in... |
high | 7.5 | — | — | 2026-09-23 | 2026-09-26 |
| CVE-2026-62985 request-filtering-agent is an http(s).Agent implementation that blocks requests... |
high | 7.5 | — | — | 2026-09-22 | 2026-09-26 |
| CVE-2026-95653 Concrete CMS Community Store before 2.7.8 derives digital product download token... |
high | 7.5 | — | — | 2026-09-22 | 2026-09-26 |
| CVE-2026-88418 CMSimple 5.24 ships with CSRF protection disabled by default, which turns csrfPr... |
high | 8.8 | — | — | 2026-09-22 | 2026-09-26 |
| CVE-2026-79314 A horizontal privilege escalation vulnerability exists in x-ui 0.3.2. |
high | 8.8 | — | — | 2026-09-22 | 2026-09-26 |
| CVE-2026-77633 Cloudreve is a self-hosted file management and sharing system. |
high | 7.1 | — | — | 2026-09-22 | 2026-09-26 |
| CVE-2026-43642 Softaculous Virtualizor before 3.2.9 (Patch 9) and 3.0.0 contains a PHP object i... |
high | 8.1 | — | — | 2026-09-22 | 2026-09-26 |
| CVE-2025-20352 Cisco IOS and IOS XE Software SNMP Denial of Service and Remote Code Execution V... |
high | 7.7 | Listed | Cisco / IOS and IOS XE | 2025-09-24 | 2026-09-26 |
| CVE-2026-88832 BusyBox romfs volume ID parsing uses unbounded strlen on attacker-controlled met... |
high | 7.3 | — | — | 2026-09-23 | 2026-09-25 |
| CVE-2025-62221 Microsoft Windows Use After Free Vulnerability |
high | 7.8 | Listed | Microsoft / Windows | 2025-12-09 | 2026-09-25 |
| CVE-2026-78510 Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker t... |
high | 8.4 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-25 |
| CVE-2026-85892 Concurrent execution using shared resource with improper synchronization ('race... |
high | 7.8 | — | Microsoft / edge chromium | 2026-09-14 | 2026-09-25 |
| CVE-2026-88340 An invalid pointer release vulnerability exists in YARA 4.5.8 during deserializa... |
high | 7.6 | — | — | 2026-09-22 | 2026-09-25 |
| CVE-2026-68791 Incorrect authorization in Azure Machine Learning allows an unauthorized attacke... |
high | 7.5 | — | Microsoft / azure machine learning | 2026-09-17 | 2026-09-25 |
| CVE-2026-77903 Authentication bypass by spoofing in Microsoft Dataverse allows an unauthorized... |
high | 8.1 | — | Microsoft / dataverse | 2026-09-17 | 2026-09-25 |
| CVE-2026-85885 Improper neutralization of special elements used in a command ('command injectio... |
high | 8.8 | — | Microsoft / 365 copilot | 2026-09-17 | 2026-09-25 |
| CVE-2026-85917 Server-side request forgery (ssrf) in Azure AI Foundry allows an unauthorized at... |
high | 7.5 | — | Microsoft / foundry | 2026-09-17 | 2026-09-25 |
| CVE-2026-69486 Heap-based buffer overflow in Microsoft Edge (Chromium-based) allows an unauthor... |
high | 8.8 | — | Microsoft / edge chromium | 2026-09-15 | 2026-09-25 |
| CVE-2026-87289 Vulnerability in the Helidon product of Oracle Fusion Middleware (component: hel... |
high | 7.5 | — | Oracle / helidon | 2026-09-15 | 2026-09-25 |
| CVE-2026-75655 Bridge is affected by an Uncontrolled Recursion vulnerability that could result... |
high | 7.8 | — | Adobe / bridge | 2026-09-22 | 2026-09-25 |
| CVE-2026-75658 Bridge is affected by an out-of-bounds write vulnerability that could result in... |
high | 7.8 | — | Adobe / bridge | 2026-09-22 | 2026-09-25 |
| CVE-2026-75663 Bridge is affected by an out-of-bounds write vulnerability that could result in... |
high | 7.8 | — | Adobe / bridge | 2026-09-22 | 2026-09-25 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.