September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,186
Critical
1,210
High
4,308
Medium
4,071
Low
456
Severity not reported
1,141
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (605), oracle (274), apple (244), adobe (197), dell (137), ibm (104), arubanetworks (101), mongodb (64), apache (53)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-94496 jshERP through 3.6 fails to validate caller permissions in role management endpo... |
high | 8.3 | — | — | 2026-09-21 | 2026-09-22 |
| CVE-2026-94497 jshERP through 3.6 fails to validate object ownership in by-id info, update, and... |
high | 8.3 | — | — | 2026-09-21 | 2026-09-22 |
| CVE-2026-94501 jshERP through 3.6 contains an authorization bypass vulnerability in the userBus... |
high | 8.8 | — | — | 2026-09-21 | 2026-09-22 |
| CVE-2026-43643 Softaculous Virtualizor before 3.2.9 (Patch 9) and 3.0.0 contains an authorizati... |
high | 7.5 | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-92792 OpenNHP through 1.0.2 selects its trusted-execution attestation verifier based o... |
high | 7.5 | — | — | 2026-09-16 | 2026-09-22 |
| CVE-2026-92592 Craft CMS 4.8.0 through 4.18.5 and 5.0.0 through 5.10.12 sign an authenticated u... |
high | 8.8 | — | — | 2026-09-16 | 2026-09-22 |
| CVE-2026-92593 Craft CMS versions 5.10.0 through 5.10.12 contain an incomplete fix for CVE-2026... |
high | 8.8 | — | — | 2026-09-16 | 2026-09-22 |
| CVE-2026-92594 Craft CMS 5.0.0-RC1 through versions before 5.11.0 incorrectly authorize the Gra... |
high | 7.5 | — | — | 2026-09-16 | 2026-09-22 |
| CVE-2026-92596 Nodemailer before 9.1.0 contains a quadratic time complexity vulnerability in th... |
high | 7.5 | — | — | 2026-09-16 | 2026-09-22 |
| CVE-2026-92599 joi (npm package `joi`, hapi.js) versions >=17.2.0 <17.13.7 and >=18.0.0 <18.2.6... |
high | 7.5 | — | — | 2026-09-16 | 2026-09-22 |
| CVE-2026-89036 Appwrite before 2.0.0 contains an argument injection vulnerability that allows a... |
high | 8.8 | — | — | 2026-09-17 | 2026-09-22 |
| CVE-2026-93292 SigNoz versions from 0.88.0 before 0.142.1 contain a SQL injection vulnerability... |
high | 8.5 | — | — | 2026-09-17 | 2026-09-22 |
| CVE-2026-93426 SigNoz versions 0.87.0 before 0.142.0 fail to escape user-supplied telemetry fie... |
high | 8.5 | — | — | 2026-09-17 | 2026-09-22 |
| CVE-2026-93450 go-openapi/swag jsonutils before 0.27.1 contains a stack overflow vulnerability... |
high | 7.5 | — | — | 2026-09-18 | 2026-09-22 |
| CVE-2026-93599 rustls-webpki through 0.103.12 (and 0.104.0-alpha releases before 0.104.0-alpha.... |
high | 7.5 | — | — | 2026-09-18 | 2026-09-22 |
| CVE-2026-93658 uutils coreutils versions before 0.10.0 apply setuid or setgid mode to install d... |
high | 7.0 | — | — | 2026-09-18 | 2026-09-22 |
| CVE-2026-7006 Sublime Text for Windows through Build 4192 (Sublime Text 4) and Build 3207 (Sub... |
high | 7.3 | — | — | 2026-09-18 | 2026-09-22 |
| CVE-2026-93690 uri-js through 4.4.1 contains a denial of service vulnerability in the removeDot... |
high | 7.5 | — | — | 2026-09-18 | 2026-09-22 |
| CVE-2026-93749 source-map-js through 1.2.1 fails to validate the per-section offset line value... |
high | 7.5 | — | — | 2026-09-18 | 2026-09-22 |
| CVE-2026-93752 CSSOM through 0.5.0 contains a denial of service vulnerability in CSSStyleDeclar... |
high | 7.5 | — | — | 2026-09-18 | 2026-09-22 |
| CVE-2017-20284 Caucho Resin contains a path traversal vulnerability in the documentation webapp... |
high | 7.5 | — | — | 2026-09-18 | 2026-09-22 |
| CVE-2026-93991 Argo Workflows versions 4.1.0 through 4.1.3 contain an authorization bypass vuln... |
high | 7.7 | — | — | 2026-09-19 | 2026-09-22 |
| CVE-2026-94106 getID3 before 1.9.26 contains an OS command injection vulnerability in shell-out... |
high | 8.8 | — | — | 2026-09-20 | 2026-09-22 |
| CVE-2026-95861 A malicious actor with access to the network could exploit an Uncontrolled Recur... |
high | 7.5 | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-95862 A malicious actor with access to the network could exploit an Out-of-bounds Writ... |
high | 7.5 | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-93710 Dancer2 versions from 2.0.0 before 2.2.0 for Perl dispatch a route that a dying... |
high | 7.5 | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-93712 Dancer2 versions from 2.1.0 before 2.2.0 for Perl serve files from outside publi... |
high | 7.5 | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-77544 A malicious actor with access to the network could exploit an Out-of-bounds Writ... |
high | 7.5 | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-77555 A malicious actor with access to the network could exploit an Out-of-bounds Writ... |
high | 7.5 | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-77556 A malicious actor with access to the network could exploit an Out-of-bounds Read... |
high | 7.5 | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-77558 A malicious actor with access to the network could exploit an Out-of-bounds Read... |
high | 7.5 | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-75744 Adobe Experience Manager Forms JEE is affected by a stored Cross-Site Scripting... |
high | 8.1 | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-70410 Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection... |
high | 8.8 | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-69725 Double free in Windows Hello allows an authorized attacker to elevate privileges... |
high | 7.8 | — | Microsoft / windows 10 21h2 | 2026-09-08 | 2026-09-22 |
| CVE-2026-69729 Heap-based buffer overflow in Windows Credential Providers allows an authorized... |
high | 8.8 | — | Microsoft / windows 11 24h2 | 2026-09-08 | 2026-09-22 |
| CVE-2026-69735 Use after free in Windows Broadcast DVR User Service allows an authorized attack... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-22 |
| CVE-2026-69740 Use after free in Windows Hello allows an authorized attacker to elevate privile... |
high | 8.8 | — | Microsoft / windows 11 23h2 | 2026-09-08 | 2026-09-22 |
| CVE-2026-69757 Use after free in Windows TCP/IP allows an authorized attacker to elevate privil... |
high | 7.5 | — | Microsoft / windows 10 1809 | 2026-09-08 | 2026-09-22 |
| CVE-2026-69762 Stack-based buffer overflow in Windows Win32K allows an authorized attacker to e... |
high | 8.8 | — | Microsoft / windows 10 1809 | 2026-09-08 | 2026-09-22 |
| CVE-2026-89087 The cstruct package before 6.3.0 for OCaml mishandles indexes. |
high | 7.3 | — | — | 2026-09-10 | 2026-09-22 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.