September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,186
Critical
1,210
High
4,308
Medium
4,071
Low
456
Severity not reported
1,141
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (605), oracle (274), apple (244), adobe (197), dell (137), ibm (104), arubanetworks (101), mongodb (64), apache (53)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2025-12995 Medtronic CareLink Network allows an unauthenticated remote attacker to perform... |
critical | 9.8 | — | Medtronic / carelink network | 2025-12-04 | 2026-09-25 |
| CVE-2025-66562 TUUI is a desktop MCP client designed as a tool unitary utility integration. |
critical | 9.6 | — | Aiql / tuui | 2025-12-05 | 2026-09-25 |
| CVE-2025-66039 FreePBX Endpoint Manager is a module for managing telephony endpoints in FreePBX... |
critical | 9.8 | — | Sangoma / freepbx | 2025-12-09 | 2026-09-25 |
| CVE-2025-67791 An issue was discovered in DriveLock 24.1 through 24.1.*, 24.2 through 24.2.*, a... |
critical | 9.8 | — | Drivelock / drivelock | 2025-12-17 | 2026-09-25 |
| CVE-2025-15012 A vulnerability was determined in code-projects Refugee Food Management System 1... |
critical | 9.8 | — | Fabian / refugee food management system | 2025-12-22 | 2026-09-25 |
| CVE-1999-0199 manual/search.texi in the GNU C Library (aka glibc) before 2.2 lacks a statement... |
critical | 9.8 | — | Gnu / glibc | 2020-10-06 | 2026-09-25 |
| CVE-2026-70200 Improper limitation of a pathname to a restricted directory ('path traversal') i... |
critical | 9.8 | — | Microsoft / azure logic apps | 2026-09-17 | 2026-09-25 |
| CVE-2026-83944 Improper access control in Azure Logic Apps allows an unauthorized attacker to e... |
critical | 9.1 | — | Microsoft / azure logic apps | 2026-09-17 | 2026-09-25 |
| CVE-2026-69843 Authentication bypass by spoofing in Microsoft Fabric allows an unauthorized att... |
critical | 10.0 | — | Microsoft / fabric | 2026-09-18 | 2026-09-25 |
| CVE-2026-51994 mcp-remote versions 0.1.32 through 0.1.38 are vulnerable to Server-Side Request... |
critical | 9.1 | — | — | 2026-09-24 | 2026-09-25 |
| CVE-2026-75682 Adobe Connect is affected by an Improper Neutralization of Special Elements used... |
critical | 9.9 | — | Adobe / connect | 2026-09-22 | 2026-09-25 |
| CVE-2026-75686 Adobe Connect is affected by an Improper Input Validation vulnerability that cou... |
critical | 9.3 | — | Adobe / connect | 2026-09-22 | 2026-09-25 |
| CVE-2026-88351 An integer overflow vulnerability exists in the MPack Node API in MPack 1.1.1 on... |
critical | 9.8 | — | — | 2026-09-24 | 2026-09-25 |
| CVE-2026-33824 Microsoft Internet Key Exchange (IKE) Service Extensions Double Free Vulnerabili... |
critical | 9.8 | Listed | Microsoft / Internet Key Exchange (IKE) Service Extensions | 2026-04-14 | 2026-09-25 |
| CVE-2026-75697 Adobe Connect is affected by a stored Cross-Site Scripting (XSS) vulnerability t... |
critical | 9.3 | — | Adobe / connect | 2026-09-22 | 2026-09-25 |
| CVE-2026-75698 Adobe Connect is affected by a reflected Cross-Site Scripting (XSS) vulnerabilit... |
critical | 9.3 | — | Adobe / connect | 2026-09-22 | 2026-09-25 |
| CVE-2026-76708 A vulnerability exists in the Analytics and Location Engine (ALE) where the appl... |
critical | 9.8 | — | Arubanetworks / analytics and location engine | 2026-09-22 | 2026-09-25 |
| CVE-2026-95699 Prior to 9/18/2026, the iSteamX mobile application's AWS policy could grant auth... |
critical | 9.6 | — | — | 2026-09-24 | 2026-09-25 |
| CVE-2026-97230 IO::Socket::SSL::SelfCertificate versions 1.00 for Perl contains malware which e... |
critical | 9.8 | — | — | 2026-09-24 | 2026-09-25 |
| CVE-2026-92288 Lemonldap::NG::Portal versions from 2.20.0 before 2.21.6, from 2.22.0 before 2.2... |
critical | 9.1 | — | — | 2026-09-25 | 2026-09-25 |
| CVE-2026-73242 FreeRDP is a free implementation of the Remote Desktop Protocol. |
critical | 9.1 | — | Freerdp / freerdp | 2026-08-11 | 2026-09-25 |
| CVE-2026-67278 MikroTik RouterOS accepts malformed RSA/PKCS#1 v1.5 signatures across RSA-based... |
critical | 9.1 | — | Mikrotik / routeros | 2026-09-05 | 2026-09-25 |
| CVE-2026-70009 Improper limitation of a pathname to a restricted directory ('path traversal') i... |
critical | 9.8 | — | Microsoft / azure arc | 2026-09-17 | 2026-09-25 |
| CVE-2026-85889 Missing authentication for critical function in Azure AI Foundry allows an unaut... |
critical | 9.8 | — | Microsoft / azure ai foundry | 2026-09-17 | 2026-09-25 |
| CVE-2026-85878 Improper authorization in Azure Database for PostgreSQL allows an authorized att... |
critical | 9.9 | — | Microsoft / azure horizondb | 2026-09-18 | 2026-09-25 |
| CVE-2026-53581 OPNsense is a FreeBSD based firewall and routing platform. |
critical | 9.0 | — | — | 2026-09-08 | 2026-09-25 |
| CVE-2026-62379 Open Access Management (OpenAM) is an access management solution. |
critical | 9.8 | — | — | 2026-09-15 | 2026-09-25 |
| CVE-2026-89055 The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to autho... |
critical | 9.1 | — | — | 2026-09-25 | 2026-09-25 |
| CVE-2026-93765 Mongoid contains an unsafe reflection weakness in the document persistence layer... |
critical | 9.1 | — | Mongodb / mongoid | 2026-09-18 | 2026-09-25 |
| CVE-2026-25254 Improper authorization leads to Remote Code Execution via SocketIO interface. |
critical | 9.8 | — | Qualcomm / software center | 2026-09-22 | 2026-09-25 |
| CVE-2026-85724 Moquette is a lightweight Java MQTT broker. |
critical | 9.6 | — | Moquette / moquette | 2026-09-23 | 2026-09-25 |
| CVE-2026-14281 The Automation Web Platform – Notifications and OTP for WooCommerce, Advanced Co... |
critical | 9.8 | — | — | 2026-09-25 | 2026-09-25 |
| CVE-2026-76669 Privilege escalation vulnerabilities exist in the API of HPE Networking EdgeConn... |
critical | 9.9 | — | Arubanetworks / edgeconnect sd-wan orchestrator | 2026-09-15 | 2026-09-25 |
| CVE-2026-76670 Privilege escalation vulnerabilities exist in the API of HPE Networking EdgeConn... |
critical | 9.9 | — | Arubanetworks / edgeconnect sd-wan orchestrator | 2026-09-15 | 2026-09-25 |
| CVE-2026-76673 Vulnerabilities have been identified in the API of EdgeConnect SD-WAN Orchestrat... |
critical | 9.8 | — | Arubanetworks / edgeconnect sd-wan orchestrator | 2026-09-15 | 2026-09-25 |
| CVE-2026-76672 A vulnerability exists in the SD-WAN Orchestrator that may lead to the exposure... |
critical | 9.9 | — | Arubanetworks / edgeconnect sd-wan orchestrator | 2026-09-15 | 2026-09-25 |
| CVE-2026-5430 WSO2 Multiple Products Path Traversal Vulnerability |
critical | 10.0 | Listed | WSO2 / Multiple Products | 2026-08-06 | 2026-09-25 |
| CVE-2026-19072 Velociraptor stores the compiled VQL in the hunt object internally to avoid havi... |
critical | 9.9 | — | — | 2026-09-24 | 2026-09-25 |
| CVE-2026-94493 A vulnerability was detected in Gigatech PDV5701 1.0.31_240305_112640. |
critical | 10.0 | — | — | 2026-09-22 | 2026-09-24 |
| CVE-2026-78445 Use after free in Windows Services for NFS ONCRPC XDR Driver allows an unauthori... |
critical | 9.8 | — | Microsoft / windows server 2012 | 2026-09-08 | 2026-09-24 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.