September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,186
Critical
1,210
High
4,308
Medium
4,071
Low
456
Severity not reported
1,141
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (605), oracle (274), apple (244), adobe (197), dell (137), ibm (104), arubanetworks (101), mongodb (64), apache (53)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-91924 pgweb through 0.17.0 leaves the POST /api/connect endpoint unguarded when connec... |
high | 8.5 | — | — | 2026-09-15 | 2026-09-23 |
| CVE-2026-84484 ION-DTN versions before 4.2.0 contain an out-of-bounds read vulnerability in the... |
high | 7.5 | — | — | 2026-09-02 | 2026-09-23 |
| CVE-2026-84485 APITable through 1.13.0-beta.1 exposes the internal organization loadOrSearch en... |
high | 7.5 | — | — | 2026-09-02 | 2026-09-23 |
| CVE-2026-85176 DbGate fails to validate jslid parameters in the jsldata controller, allowing au... |
high | 8.8 | — | — | 2026-09-03 | 2026-09-23 |
| CVE-2026-85651 Trigger.dev versions before 4.5.2 fail to validate environment membership during... |
high | 8.5 | — | — | 2026-09-04 | 2026-09-23 |
| CVE-2026-89146 libp2p-rendezvous through 0.17.1 fails to validate registration TTL values in di... |
high | 7.5 | — | — | 2026-09-11 | 2026-09-23 |
| CVE-2026-95831 Crypt::SelfCertificate versions from 1.01 through 1.05 for Perl contains malware... |
high | 7.8 | — | — | 2026-09-22 | 2026-09-23 |
| CVE-2026-78442 Heap-based buffer overflow in Windows OLE DB allows an unauthorized attacker to... |
high | 8.8 | — | Microsoft / sql server 2017 | 2026-09-08 | 2026-09-23 |
| CVE-2026-83093 Vulnerability in the Oracle Forms product of Oracle Fusion Middleware (component... |
high | 8.6 | — | Oracle / forms | 2026-09-15 | 2026-09-23 |
| CVE-2026-83041 Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware... |
high | 7.7 | — | Oracle / webcenter portal | 2026-09-15 | 2026-09-23 |
| CVE-2026-83034 Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware... |
high | 7.5 | — | Oracle / webcenter portal | 2026-09-15 | 2026-09-23 |
| CVE-2026-83033 Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware... |
high | 8.8 | — | Oracle / webcenter portal | 2026-09-15 | 2026-09-23 |
| CVE-2026-83032 Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware... |
high | 8.8 | — | Oracle / webcenter portal | 2026-09-15 | 2026-09-23 |
| CVE-2026-95925 A vulnerability was found in SourceCodester Online Reviewer Management System 1.... |
high | 7.3 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-95926 A vulnerability was determined in SourceCodester Online Reviewer Management Syst... |
high | 7.3 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-95819 A vulnerability has been found in anirbandutta9 College-Notes-Gallery up to 8c1c... |
high | 7.3 | — | — | 2026-09-22 | 2026-09-23 |
| CVE-2026-88415 MCMS 6.1.1 through 6.2.1 is vulnerable to stored Cross-Site Scripting (XSS). |
high | 8.7 | — | — | 2026-09-22 | 2026-09-23 |
| CVE-2026-70584 Access of resource using incompatible type ('type confusion') in Windows Core Me... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-23 |
| CVE-2026-87268 Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (comp... |
high | 7.8 | — | Oracle / vm virtualbox | 2026-09-15 | 2026-09-23 |
| CVE-2026-87269 Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (comp... |
high | 7.8 | — | Oracle / vm virtualbox | 2026-09-15 | 2026-09-23 |
| CVE-2026-87270 Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (comp... |
high | 7.8 | — | Oracle / vm virtualbox | 2026-09-15 | 2026-09-23 |
| CVE-2026-87271 Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (comp... |
high | 7.8 | — | Oracle / vm virtualbox | 2026-09-15 | 2026-09-23 |
| CVE-2026-87272 Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (comp... |
high | 7.8 | — | Oracle / vm virtualbox | 2026-09-15 | 2026-09-23 |
| CVE-2026-87273 Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (comp... |
high | 8.6 | — | Oracle / vm virtualbox | 2026-09-15 | 2026-09-23 |
| CVE-2026-87276 Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (comp... |
high | 7.5 | — | Oracle / vm virtualbox | 2026-09-15 | 2026-09-23 |
| CVE-2026-87277 Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (comp... |
high | 7.5 | — | Oracle / vm virtualbox | 2026-09-15 | 2026-09-23 |
| CVE-2026-73014 Missing authorization in Data Sharing Service Client allows an authorized attack... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-23 |
| CVE-2026-92456 yshop-crm through 2.1.3 fails to enforce authorization on the saveRedisSet and g... |
high | 7.1 | — | — | 2026-09-16 | 2026-09-23 |
| CVE-2026-92465 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
high | 7.6 | — | — | 2026-09-16 | 2026-09-23 |
| CVE-2026-6285 Weak Password Recovery Mechanism for Forgotten Password vulnerability in Ankaref... |
high | 7.5 | — | — | 2026-09-10 | 2026-09-23 |
| CVE-2026-84395 Premiere Pro is affected by a Server-Side Request Forgery (SSRF) vulnerability t... |
high | 7.1 | — | — | 2026-09-22 | 2026-09-23 |
| CVE-2026-81999 Adobe Experience Manager Forms JEE is affected by a Server-Side Request Forgery... |
high | 8.7 | — | — | 2026-09-22 | 2026-09-23 |
| CVE-2026-18730 A server-side request forgery (SSRF) vulnerability was identified in GitHub Ente... |
high | 7.4 | — | Github / enterprise server | 2026-09-01 | 2026-09-22 |
| CVE-2026-73750 Vulnerabilities exist in the authentication module that may improperly process m... |
high | 8.8 | — | Hpe / arubaos-cx | 2026-09-01 | 2026-09-22 |
| CVE-2026-73751 An authenticated user with low-privileged access could submit crafted input thro... |
high | 8.8 | — | Hpe / arubaos-cx | 2026-09-01 | 2026-09-22 |
| CVE-2026-73752 An unauthenticated arbitrary file write vulnerability exists in an API endpoint... |
high | 8.8 | — | Hpe / arubaos-cx | 2026-09-01 | 2026-09-22 |
| CVE-2026-91996 lamp-cloud through 5.10.0 whitelists the path pattern /*/anno/** for anonymous a... |
high | 7.5 | — | — | 2026-09-15 | 2026-09-22 |
| CVE-2026-92793 GoAdmin through 1.2.26 fails to properly anchor the logout pattern when checking... |
high | 8.1 | — | — | 2026-09-16 | 2026-09-22 |
| CVE-2026-92796 Manticore Search versions 27.0.0 before 28.4.4 fail to validate permissions for... |
high | 8.8 | — | — | 2026-09-16 | 2026-09-22 |
| CVE-2026-92815 changedetection.io through 0.60.6 fails to validate the Goto URL action in brows... |
high | 7.5 | — | — | 2026-09-16 | 2026-09-22 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.