September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,186
Critical
1,210
High
4,308
Medium
4,071
Low
456
Severity not reported
1,141
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (605), oracle (274), apple (244), adobe (197), dell (137), ibm (104), arubanetworks (101), mongodb (64), apache (53)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-88410 The graph.UDF in FalkorDB (Redis module) v4.20.1 to v4.20.4 is not registered as... |
high | 7.1 | — | — | 2026-09-21 | 2026-09-24 |
| CVE-2025-48384 Git Link Following Vulnerability |
high | 8.0 | Listed | Git / Git | 2025-07-08 | 2026-09-24 |
| CVE-2025-8875 N-able N-Central Insecure Deserialization Vulnerability |
high | 7.8 | Listed | N-able / N-Central | 2025-08-14 | 2026-09-24 |
| CVE-2024-48248 NAKIVO Backup and Replication Absolute Path Traversal Vulnerability |
high | 8.6 | Listed | NAKIVO / Backup and Replication | 2025-03-04 | 2026-09-24 |
| CVE-2025-30066 tj-actions/changed-files GitHub Action Embedded Malicious Code Vulnerability |
high | 8.6 | Listed | Tj-actions / changed-files GitHub Action | 2025-03-15 | 2026-09-24 |
| CVE-2025-24993 Microsoft Windows NTFS Heap-Based Buffer Overflow Vulnerability |
high | 7.8 | Listed | Microsoft / Windows | 2025-03-11 | 2026-09-24 |
| CVE-2025-26633 Microsoft Windows Management Console (MMC) Improper Neutralization Vulnerability |
high | 7.0 | Listed | Microsoft / Windows | 2025-03-11 | 2026-09-24 |
| CVE-2025-21391 Microsoft Windows Storage Link Following Vulnerability |
high | 7.1 | Listed | Microsoft / Windows | 2025-02-11 | 2026-09-24 |
| CVE-2025-21335 Microsoft Windows Hyper-V NT Kernel Integration VSP Use-After-Free Vulnerability |
high | 7.8 | Listed | Microsoft / Windows | 2025-01-14 | 2026-09-24 |
| CVE-2026-80097 Improper authentication in Microsoft Authenticator allows an unauthorized attack... |
high | 8.6 | — | Microsoft / authenticator | 2026-09-08 | 2026-09-24 |
| CVE-2026-69299 Use after free in Microsoft COM for Windows allows an authorized attacker to ele... |
high | 7.0 | — | Microsoft / windows 10 21h2 | 2026-09-08 | 2026-09-24 |
| CVE-2008-4128 Cisco IOS Cross-Site Request Forgery Vulnerability |
high | 8.1 | Listed | Cisco / IOS | 2008-09-18 | 2026-09-24 |
| CVE-2026-93972 A security vulnerability has been detected in SourceCodester Online Reviewer Man... |
high | 7.3 | — | — | 2026-09-20 | 2026-09-24 |
| CVE-2026-94104 NivoCart through 2.4.0 contains an arbitrary file upload vulnerability in the Fi... |
high | 8.8 | — | — | 2026-09-20 | 2026-09-24 |
| CVE-2026-91955 FreeRDP before 3.31.0 fails to validate client-supplied DesktopWidth and Desktop... |
high | 7.5 | — | Freerdp / freerdp | 2026-09-15 | 2026-09-24 |
| CVE-2026-96804 MLflow's statsmodel flavor, versions 2.1.0 to 3.14.0, omits the MLFLOW_ALLOW_PIC... |
high | 8.8 | — | — | 2026-09-23 | 2026-09-24 |
| CVE-2026-86677 ZohoCorp ManageEngine Applications Manager versions 182000 and below allowed a l... |
high | 8.8 | — | — | 2026-09-23 | 2026-09-24 |
| CVE-2026-86678 ZohoCorp ManageEngine Applications Manager versions 182000 and below allowed a l... |
high | 8.8 | — | — | 2026-09-23 | 2026-09-24 |
| CVE-2026-86683 ZohoCorp ManageEngine Applications Manager versions 182000 and below allowed a l... |
high | 8.1 | — | — | 2026-09-23 | 2026-09-24 |
| CVE-2026-84787 ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.710 and belo... |
high | 8.1 | — | — | 2026-09-23 | 2026-09-24 |
| CVE-2026-76978 ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.709 and belo... |
high | 8.8 | — | — | 2026-09-23 | 2026-09-24 |
| CVE-2026-75825 ZohoCorp ManageEngine OpManager versions 12.8.710 and below with the Application... |
high | 8.8 | — | — | 2026-09-23 | 2026-09-24 |
| CVE-2026-49810 Dell Command Powershell Provider (DCPP), versions prior to 2.10.2 contain an Ins... |
high | 7.8 | — | — | 2026-09-21 | 2026-09-24 |
| CVE-2026-14913 ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.669 and belo... |
high | 8.8 | — | — | 2026-09-23 | 2026-09-24 |
| CVE-2026-70915 Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware... |
high | 8.8 | — | Oracle / identity manager | 2026-09-15 | 2026-09-23 |
| CVE-2026-96756 orval versions before 8.30.0 contain a code injection vulnerability in the @orva... |
high | 8.1 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-96514 A weakness has been identified in Neethuharii CafeManagement. |
high | 7.3 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-95603 Shop manager PHP Object Injection in Reycob Product Import Export <= 2.3.0 versi... |
high | 7.2 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-95513 Unauthenticated Broken Access Control in Online Booking & Scheduling Calendar fo... |
high | 7.5 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-95522 Shop manager SQL Injection in Easy Digital Downloads <= 3.7.0 versions. |
high | 7.6 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-95528 Unauthenticated Cross Site Scripting (XSS) in Core Web Vitals & PageSpeed Booste... |
high | 7.1 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-93774 Unauthenticated Cross Site Scripting (XSS) in WP Photo Album Plus <= 9.3.02.002... |
high | 7.1 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-94179 Unauthenticated Cross Site Scripting (XSS) in Razorpay Payment Button <= 2.4.9 v... |
high | 7.1 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-92708 Svelte devalue is a JavaScript library that serializes values into strings when... |
high | 7.5 | — | — | 2026-09-18 | 2026-09-23 |
| CVE-2026-93526 Unauthenticated Cross Site Scripting (XSS) in Event Tickets <= 5.29.4 versions. |
high | 7.1 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-88830 A unit confusion in BusyBox TLS Montgomery reduction buffer allocation causes a... |
high | 7.5 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-86064 Klever-Go is the Go implementation of the Klever blockchain protocol. |
high | 8.6 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-77601 OpenC3 COSMOS provides the functionality needed to send commands to and receive... |
high | 8.8 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-77394 OpenC3 COSMOS provides the functionality needed to send commands to and receive... |
high | 7.6 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-54506 Vvveb is a powerful and easy to use CMS with page builder to build websites, blo... |
high | 7.6 | — | — | 2026-09-17 | 2026-09-23 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.