September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,186
Critical
1,210
High
4,308
Medium
4,071
Low
456
Severity not reported
1,141
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (605), oracle (274), apple (244), adobe (197), dell (137), ibm (104), arubanetworks (101), mongodb (64), apache (53)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-53266 Linux Kernel Out-of-Bounds Write Vulnerability |
high | 8.8 | Listed | Linux / Kernel | 2026-06-25 | 2026-09-19 |
| CVE-2026-15815 Grafana OSS and Grafana Enterprise did not safely resolve symbolic links when
ex... |
high | 8.8 | — | — | 2026-09-17 | 2026-09-19 |
| CVE-2026-11381 IBM MQ could allow an authenticated attacker to cause a denial of service or pot... |
high | 8.8 | — | — | 2026-09-18 | 2026-09-19 |
| CVE-2026-10744 IBM MQ for HPE NonStop 8.1.0 through 8.1.0.40 could allow an authenticated attac... |
high | 7.5 | — | — | 2026-09-18 | 2026-09-19 |
| CVE-2026-92917 Grav is a flat-file CMS. |
high | 7.5 | — | — | 2026-09-17 | 2026-09-19 |
| CVE-2026-66619 Administrator SQL Injection in Newsletters <= 4.18 versions. |
high | 7.6 | — | — | 2026-09-17 | 2026-09-19 |
| CVE-2026-66630 Administrator SQL Injection in PublishPress Series <= 3.1.3 versions. |
high | 7.6 | — | — | 2026-09-17 | 2026-09-19 |
| CVE-2026-93591 SiYuan versions before 3.8.3 contain an SQL injection vulnerability in the graph... |
high | 7.6 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-92958 vm2 through 3.11.6 contains a builtin-module denylist bypass in NodeVM. |
high | 8.5 | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-93331 A vulnerability was identified in GPAC 26.08-DEV. |
high | 7.3 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-92942 vm2 before 3.11.7 (affected versions <= 3.11.6) does not enforce the VM({ timeou... |
high | 7.5 | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-81179 SysReptor is a fully customizable pentest reporting platform. |
high | 8.1 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-6205 An external control of file name or path vulnerability in Upload API in Synology... |
high | 8.1 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-54612 Vvveb is a powerful and easy to use CMS with page builder to build websites, blo... |
high | 8.8 | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-20336 As part of Cisco's ongoing commitment to proactive security and product quality,... |
high | 8.8 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-20333 As part of Cisco's ongoing commitment to proactive security and product quality,... |
high | 8.8 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-20334 As part of Cisco's ongoing commitment to proactive security and product quality,... |
high | 8.4 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-20335 As part of Cisco's ongoing commitment to proactive security and product quality,... |
high | 8.1 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-18911 ManageEngine DataSecurity Plus versions before 6310 are vulnerable to an agent a... |
high | 7.5 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-18405 The Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates f... |
high | 7.2 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-13673 An incorrect permission assignment for critical resource vulnerability in LDAP A... |
high | 8.8 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-13285 IBM MQ is vulnerable to an XML external entity injection (XXE) attack when proce... |
high | 7.1 | — | — | 2026-09-14 | 2026-09-18 |
| CVE-2026-12384 Authorization bypass through User-Controlled key vulnerability in TECHIN2B TECHI... |
high | 8.8 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-56986 In multiple files, there is a possible out-of-bounds read due to type confusion. |
high | 8.4 | — | Google / android | 2026-09-15 | 2026-09-18 |
| CVE-2026-56970 In multiple locations, there is a possible permission bypass due to a missing pe... |
high | 8.4 | — | Google / android | 2026-09-15 | 2026-09-18 |
| CVE-2026-56974 In Start of AudioRtpPayloadEncoderNode.cpp, there is a possible out-of-bounds wr... |
high | 8.8 | — | Google / android | 2026-09-15 | 2026-09-18 |
| CVE-2026-56978 In get_global_config_item_addr of gc.c, there is a possible out-of-bounds read d... |
high | 8.4 | — | Google / android | 2026-09-15 | 2026-09-18 |
| CVE-2026-56982 In VPU, there is a possible permission bypass due to a missing permission check. |
high | 7.8 | — | Google / android | 2026-09-15 | 2026-09-18 |
| CVE-2026-56985 In multiple files, there is a possible way to obtain signatures due to type conf... |
high | 8.4 | — | Google / android | 2026-09-15 | 2026-09-18 |
| CVE-2026-57012 In the Setup Wizard, there is a possible remote package install due to a missing... |
high | 8.4 | — | Google / android | 2026-09-15 | 2026-09-18 |
| CVE-2026-92838 A DLL hijacking
vulnerability exists in the GeoVision GV-Remote E-Map desktop
ap... |
high | 7.8 | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-38058 The endpoint on the iDirect iQ200 VSAT terminal returns the complete device conf... |
high | 8.1 | — | — | 2026-09-11 | 2026-09-18 |
| CVE-2026-78224 The XSLT Transformer Step builds a bare TransformerFactory without the proper se... |
high | 8.2 | — | — | 2026-09-11 | 2026-09-18 |
| CVE-2026-82578 When XML batch processing is turned on and the XPath option is selected, the raw... |
high | 7.5 | — | — | 2026-09-11 | 2026-09-18 |
| CVE-2026-82583 NextGen Connect (Mirth Connect) versions 4.7.1 and earlier allow an authenticate... |
high | 8.3 | — | — | 2026-09-11 | 2026-09-18 |
| CVE-2026-87020 An integer overflow in a specified pitch and buffer-size computation leads to a... |
high | 8.1 | — | — | 2026-09-11 | 2026-09-18 |
| CVE-2026-68070 The affected products are missing authentication for a critical function, which... |
high | 8.8 | — | — | 2026-09-15 | 2026-09-18 |
| CVE-2026-68950 The affected products use hard-coded credentials, which could allow an attacker... |
high | 8.8 | — | — | 2026-09-15 | 2026-09-18 |
| CVE-2026-84507 A race condition was addressed with improved state handling. |
high | 7.8 | — | Apple / ipados | 2026-09-14 | 2026-09-18 |
| CVE-2026-38056 A local privilege escalation vulnerability exists in the iDirect iQ200 VSAT term... |
high | 8.8 | — | — | 2026-09-11 | 2026-09-18 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.