September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,186
Critical
1,210
High
4,308
Medium
4,071
Low
456
Severity not reported
1,141
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (605), oracle (274), apple (244), adobe (197), dell (137), ibm (104), arubanetworks (101), mongodb (64), apache (53)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-82009 Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Specia... |
critical | 9.1 | — | Adobe / campaign | 2026-09-22 | 2026-09-26 |
| CVE-2026-75721 Adobe Campaign Classic (ACC) is affected by an Improper Control of Generation of... |
critical | 10.0 | — | Adobe / campaign | 2026-09-22 | 2026-09-26 |
| CVE-2025-57819 Sangoma FreePBX Authentication Bypass Vulnerability |
critical | 9.8 | Listed | Sangoma / FreePBX | 2025-08-28 | 2026-09-26 |
| CVE-2025-34520 An authentication bypass vulnerability in Arcserve Unified Data Protection (UDP)... |
critical | 9.8 | — | Arcserve / udp | 2025-08-27 | 2026-09-26 |
| CVE-2025-34523 A heap-based buffer overflow vulnerability exists in the network-facing input ha... |
critical | 9.8 | — | Arcserve / udp | 2025-08-27 | 2026-09-26 |
| CVE-2025-9581 A vulnerability was detected in Comfast CF-N1 2.6.0. |
critical | 9.8 | — | Comfast / cf-n1 firmware | 2025-08-28 | 2026-09-26 |
| CVE-2025-9582 A flaw has been found in Comfast CF-N1 2.6.0. |
critical | 9.8 | — | Comfast / cf-n1 firmware | 2025-08-28 | 2026-09-26 |
| CVE-2025-9592 A vulnerability was detected in itsourcecode Apartment Management System 1.0. |
critical | 9.8 | — | Admerc / apartment management system | 2025-08-28 | 2026-09-26 |
| CVE-2025-9593 A flaw has been found in itsourcecode Apartment Management System 1.0. |
critical | 9.8 | — | Admerc / apartment management system | 2025-08-28 | 2026-09-26 |
| CVE-2025-9594 A vulnerability has been found in itsourcecode Apartment Management System 1.0. |
critical | 9.8 | — | Admerc / apartment management system | 2025-08-28 | 2026-09-26 |
| CVE-2025-9765 A vulnerability has been found in itsourcecode Sports Management System 1.0. |
critical | 9.8 | — | Angeljudesuarez / sports management system | 2025-09-01 | 2026-09-26 |
| CVE-2025-9766 A vulnerability was found in itsourcecode Sports Management System 1.0. |
critical | 9.8 | — | Angeljudesuarez / sports management system | 2025-09-01 | 2026-09-26 |
| CVE-2025-9767 A vulnerability was determined in itsourcecode Sports Management System 1.0. |
critical | 9.8 | — | Angeljudesuarez / sports management system | 2025-09-01 | 2026-09-26 |
| CVE-2025-9770 A weakness has been identified in Campcodes Hospital Management System 1.0. |
critical | 9.8 | — | Campcodes / hospital management system | 2025-09-01 | 2026-09-26 |
| CVE-2025-9791 A weakness has been identified in Tenda AC20 16.03.08.05. |
critical | 9.8 | — | Tenda / ac20 firmware | 2025-09-01 | 2026-09-26 |
| CVE-2025-10156 An Improper Handling of Exceptional Conditions vulnerability in the ZIP archive... |
critical | 9.8 | — | Mmaitre314 / picklescan | 2025-09-17 | 2026-09-26 |
| CVE-2025-10596 A vulnerability was found in SourceCodester Online Exam Form Submission 1.0. |
critical | 9.8 | — | Janobe / online exam form submission | 2025-09-17 | 2026-09-26 |
| CVE-2025-10597 A vulnerability was determined in kidaze CourseSelectionSystem up to 42cd892b40a... |
critical | 9.8 | — | Kidaze / courseselectionsystem | 2025-09-17 | 2026-09-26 |
| CVE-2025-10598 A vulnerability was identified in SourceCodester Pet Grooming Management Softwar... |
critical | 9.8 | — | Mayurik / pet grooming management software | 2025-09-17 | 2026-09-26 |
| CVE-2025-10599 A security flaw has been discovered in itsourcecode Web-Based Internet Laborator... |
critical | 9.8 | — | Itsourcecode / web-based internet laboratory management system | 2025-09-17 | 2026-09-26 |
| CVE-2025-10600 A flaw has been found in SourceCodester Online Exam Form Submission 1.0. |
critical | 9.8 | — | Janobe / online exam form submission | 2025-09-17 | 2026-09-26 |
| CVE-2025-10601 A vulnerability has been found in SourceCodester Online Exam Form Submission 1.0... |
critical | 9.8 | — | Janobe / online exam form submission | 2025-09-17 | 2026-09-26 |
| CVE-2025-10604 A vulnerability was identified in PHPGurukul Online Discussion Forum 1.0. |
critical | 9.8 | — | Emiloi / online discussion forum | 2025-09-17 | 2026-09-26 |
| CVE-2025-10621 A vulnerability was determined in SourceCodester Hotel Reservation System 1.0. |
critical | 9.8 | — | Fabian / hotel reservation system | 2025-09-17 | 2026-09-26 |
| CVE-2025-10623 A vulnerability was identified in SourceCodester Hotel Reservation System 1.0. |
critical | 9.8 | — | Fabian / hotel reservation system | 2025-09-17 | 2026-09-26 |
| CVE-2025-10624 A security flaw has been discovered in PHPGurukul User Management System 1.0. |
critical | 9.8 | — | Phpgurukul / user management system | 2025-09-17 | 2026-09-26 |
| CVE-2025-13806 A security vulnerability has been detected in nutzam NutzBoot up to 2.6.0-SNAPSH... |
critical | 9.8 | — | Nutzam / nutzboot | 2025-12-01 | 2026-09-26 |
| CVE-2025-13814 A security flaw has been discovered in moxi159753 Mogu Blog v2 up to 5.2. |
critical | 9.8 | — | Mogublog Project / mogublog | 2025-12-01 | 2026-09-26 |
| CVE-2025-13815 A weakness has been identified in moxi159753 Mogu Blog v2 up to 5.2. |
critical | 9.8 | — | Mogublog Project / mogublog | 2025-12-01 | 2026-09-26 |
| CVE-2025-3500 Integer Overflow or Wraparound vulnerability in Avast Antivirus (25.1.981.6) on... |
critical | 9.8 | — | Avast / antivirus | 2025-12-01 | 2026-09-26 |
| CVE-2025-66301 Grav is a file-based Web platform. |
critical | 9.6 | — | Getgrav / grav | 2025-12-01 | 2026-09-26 |
| CVE-2025-13872 Blind Server-Side Request Forgery (SSRF) in the survey-import feature of
Objec... |
critical | 9.1 | — | Objectplanet / opinio | 2025-12-02 | 2026-09-26 |
| CVE-2025-11779 Stack-based buffer overflow vulnerability in CircutorSGE-PLC1000/SGE-PLC50 v9.0.... |
critical | 9.8 | — | Circutor / sge-plc1000 firmware | 2025-12-02 | 2026-09-26 |
| CVE-2025-11782 Stack-based buffer overflow vulnerability in Circutor SGE-PLC1000/SGE-PLC50 v9.0... |
critical | 9.8 | — | Circutor / sge-plc1000 firmware | 2025-12-02 | 2026-09-26 |
| CVE-2025-11783 Stack-based buffer overflow vulnerability in Circutor SGE-PLC1000/SGE-PLC50 v9.0... |
critical | 9.8 | — | Circutor / sge-plc1000 firmware | 2025-12-02 | 2026-09-26 |
| CVE-2025-11784 Stack-based buffer overflow vulnerability in Circutor SGE-PLC1000/SGE-PLC50 v9.0... |
critical | 9.8 | — | Circutor / sge-plc1000 firmware | 2025-12-02 | 2026-09-26 |
| CVE-2025-11786 Stack-based buffer overflow vulnerability in Circutor SGE-PLC1000/SGE-PLC50 v9.0... |
critical | 9.8 | — | Circutor / sge-plc1000 firmware | 2025-12-02 | 2026-09-26 |
| CVE-2025-11788 Heap-based buffer overflow vulnerability in Circutor SGE-PLC1000/SGE-PLC50 v9.0.... |
critical | 9.8 | — | Circutor / sge-plc1000 firmware | 2025-12-02 | 2026-09-26 |
| CVE-2025-59374 ASUS Live Update Embedded Malicious Code Vulnerability |
critical | 9.8 | Listed | ASUS / Live Update | 2025-12-17 | 2026-09-25 |
| CVE-2025-41013 SQL injection vulnerability in TCMAN GIM v11 in version 20250304. |
critical | 9.8 | — | Tcman / gim | 2025-12-02 | 2026-09-25 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.