September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,186
Critical
1,210
High
4,308
Medium
4,071
Low
456
Severity not reported
1,141
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (605), oracle (274), apple (244), adobe (197), dell (137), ibm (104), arubanetworks (101), mongodb (64), apache (53)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-93368 The Rename wp-login.php to anything you want plugin for WordPress is vulnerable... |
high | 7.5 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-93337 NetworkManager-l2tp through 1.52.4, fixed in 1.52.6, contains an improper input... |
high | 7.8 | — | — | 2026-09-17 | 2026-09-23 |
| CVE-2026-89412 The TranslatePress – Translate Multilingual sites with AI Translation plugin for... |
high | 7.2 | — | — | 2026-09-22 | 2026-09-23 |
| CVE-2026-87022 Improper handling of length parameter inconsistency vulnerability in Apache Tomc... |
high | 7.5 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-79677 Missing release of resource after effective lifetime, Comparison using wrong fac... |
high | 7.5 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-78383 Allocation of resources without limits or throttling vulnerability in Apache Tom... |
high | 7.5 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-78437 Incomplete cleanup vulnerability in Apache Tomcat allows a malformed request to... |
high | 7.3 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-77791 Uncontrolled Resource Consumption vulnerability in Apache Tomcat during sending... |
high | 7.5 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-75973 Improper Authentication vulnerability in Apache Tomcat. |
high | 7.3 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-69443 Out-of-bounds read in Microsoft Azure Attestation service and Device Health Atte... |
high | 7.5 | — | Microsoft / windows 10 1809 | 2026-09-08 | 2026-09-23 |
| CVE-2026-85501 Novel vulnerabilities to launch algorithmic complexity attacks on DNSSEC have be... |
high | 7.5 | — | Nlnetlabs / unbound | 2026-09-16 | 2026-09-23 |
| CVE-2026-84623 An authorization issue was addressed with improved state management. |
high | 7.5 | — | Apple / ipados | 2026-09-14 | 2026-09-23 |
| CVE-2026-49887 In maybeRemoveInvalidInstallerPackageName of InstallRepository.kt, there is a po... |
high | 7.8 | — | Google / android | 2026-09-08 | 2026-09-23 |
| CVE-2026-10575 IBM MQ could allow an authenticated attacker to cause a denial of service or pot... |
high | 8.8 | — | Ibm / mq | 2026-09-18 | 2026-09-23 |
| CVE-2026-49450 Joplin is an open source note-taking and to-do application that organises notes... |
high | 7.1 | — | — | 2026-09-21 | 2026-09-23 |
| CVE-2026-49453 Joplin is an open source note-taking and to-do application that organises notes... |
high | 7.0 | — | — | 2026-09-21 | 2026-09-23 |
| CVE-2026-55210 Joplin is an open source note-taking and to-do application that organises notes... |
high | 7.4 | — | — | 2026-09-21 | 2026-09-23 |
| CVE-2026-59814 Joplin is an open source note-taking and to-do application that organises notes... |
high | 7.6 | — | — | 2026-09-21 | 2026-09-23 |
| CVE-2026-61820 pg_partman is a PostgreSQL extension that manages partitioned tables by time or... |
high | 8.5 | — | — | 2026-09-18 | 2026-09-23 |
| CVE-2026-83598 Netdata is an open source observability tool. |
high | 7.8 | — | — | 2026-09-22 | 2026-09-23 |
| CVE-2026-83599 Netdata is an open source observability tool. |
high | 7.5 | — | — | 2026-09-22 | 2026-09-23 |
| CVE-2026-83603 Netdata is an open source observability tool. |
high | 8.4 | — | — | 2026-09-22 | 2026-09-23 |
| CVE-2026-83597 Netdata is an open source observability tool. |
high | 7.0 | — | — | 2026-09-22 | 2026-09-23 |
| CVE-2026-85279 Notepad++ is a free and open-source source code editor. |
high | 8.6 | — | — | 2026-09-22 | 2026-09-23 |
| CVE-2026-85995 Notepad++ is a free and open-source source code editor. |
high | 7.3 | — | — | 2026-09-22 | 2026-09-23 |
| CVE-2026-10853 IBM MQ could allow an authenticated attacker with cluster access to cause a deni... |
high | 8.8 | — | Ibm / mq | 2026-09-18 | 2026-09-23 |
| CVE-2026-48826 HomeBox is a home inventory and organization system. |
high | 8.1 | — | — | 2026-09-21 | 2026-09-23 |
| CVE-2026-48975 HomeBox is a home inventory and organization system. |
high | 8.1 | — | — | 2026-09-21 | 2026-09-23 |
| CVE-2026-48976 HomeBox is a home inventory and organization system. |
high | 8.1 | — | — | 2026-09-21 | 2026-09-23 |
| CVE-2026-61628 nginx ignition is a user interface for the nginx web server. |
high | 8.1 | — | — | 2026-09-21 | 2026-09-23 |
| CVE-2026-11375 IBM MQ could allow an authenticated attacker to cause a denial of service or pot... |
high | 8.8 | — | Ibm / mq | 2026-09-18 | 2026-09-23 |
| CVE-2026-11378 IBM MQ could allow an authenticated attacker to cause a denial of service or pot... |
high | 8.8 | — | Ibm / mq | 2026-09-18 | 2026-09-23 |
| CVE-2026-45048 Open Access Management (OpenAM) is an access management solution. |
high | 8.5 | — | — | 2026-09-15 | 2026-09-23 |
| CVE-2026-15358 ZohoCorp ManageEngine OpManager and Network Configuration Manager versions befor... |
high | 7.5 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-84789 ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.710 and belo... |
high | 7.1 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-84791 ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.710 and belo... |
high | 7.1 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-76979 ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.709 and belo... |
high | 7.7 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-76980 ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.709 and belo... |
high | 7.4 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-86679 ZohoCorp ManageEngine Applications Manager versions 182000 and below were vulner... |
high | 7.1 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-86681 ZohoCorp ManageEngine Applications Manager versions 182200 and below were vulner... |
high | 7.6 | — | — | 2026-09-23 | 2026-09-23 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.