September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,826
Low
527
Severity not reported
2,544
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), apache (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-18872 IBM Financial Transaction Manager (FTM) for RedHat OpenShift is vulnerable to st... |
critical | 9.3 | — | Ibm / financial transaction manager | 2026-09-23 | 2026-10-07 |
| CVE-2026-96560 LightLLM through 1.2.0 contains a remote code execution vulnerability in the KV-... |
critical | 9.8 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-86708 ZohoCorp ManageEngine Applications Manager versions 182200 and below were vulner... |
critical | 10.0 | — | — | 2026-09-23 | 2026-09-24 |
| CVE-2026-59167 SunEditor is a lightweight and powerful WYSIWYG editor in vanilla JavaScript wit... |
critical | 10.0 | — | — | 2026-09-23 | 2026-09-24 |
| CVE-2026-86246 Initialization of a resource with an insecure default vulnerability in Apache To... |
critical | 9.1 | — | Apache / tomcat native | 2026-09-23 | 2026-10-06 |
| CVE-2026-19599 ZohoCorp ManageEngine OpManager MSP versions 12.8.709 and below were vulnerable... |
critical | 9.9 | — | — | 2026-09-23 | 2026-09-24 |
| CVE-2026-86248 CLIENT_CERT authentication does not fail as expected for some scenarios when sof... |
critical | 9.8 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-86350 Inconsistent interpretation of HTTP/2 requests ('HTTP Request/Response smuggling... |
critical | 9.1 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-76183 Authentication Bypass by Alternate Name vulnerability in Apache Tomcat allowed t... |
critical | 9.8 | — | — | 2026-09-23 | 2026-09-30 |
| CVE-2026-82331 Improper link resolution before file access ('link following') vulnerability in... |
critical | 9.8 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-82843 The WP OAuth Server ( Login with WordPress ) WordPress plugin before 6.4.0 does... |
critical | 9.0 | — | — | 2026-09-23 | 2026-09-24 |
| CVE-2026-75799 The YAHMAN Add-ons WordPress plugin before 0.9.31 does not validate the type of... |
critical | 9.0 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-96257 A flaw has been found in Fast FAC1203R Gigabit Edition 2.0.4. |
critical | 10.0 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-18162 IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remot... |
critical | 9.8 | — | Ibm / financial transaction manager | 2026-09-22 | 2026-10-06 |
| CVE-2026-18163 IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remot... |
critical | 9.8 | — | Ibm / financial transaction manager | 2026-09-22 | 2026-10-06 |
| CVE-2026-18169 IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remot... |
critical | 9.9 | — | Ibm / financial transaction manager | 2026-09-22 | 2026-10-06 |
| CVE-2026-17635 IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remot... |
critical | 9.1 | — | Ibm / financial transaction manager | 2026-09-22 | 2026-10-08 |
| CVE-2026-17472 IBM Concert 1.0.0 through 3.0.0 could allow a remote authenticated attacker to a... |
critical | 9.6 | — | — | 2026-09-22 | 2026-09-24 |
| CVE-2026-17618 IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remot... |
critical | 9.8 | — | Ibm / financial transaction manager | 2026-09-22 | 2026-10-15 |
| CVE-2026-16346 IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated a... |
critical | 9.9 | — | Ibm / datastage on cloud pak for data | 2026-09-22 | 2026-10-06 |
| CVE-2026-77987 A server-side request forgery (SSRF) vulnerability was identified in the noteboo... |
critical | 9.8 | — | Github / enterprise server | 2026-09-22 | 2026-10-02 |
| CVE-2026-88624 Missing path validation in the Worktree.remove component of openCode v1.18.26 al... |
critical | 9.1 | — | — | 2026-09-22 | 2026-09-24 |
| CVE-2026-89282 The Apache Lounge Windows distribution of Apache HTTP Server build contains an i... |
critical | 9.1 | — | — | 2026-09-22 | 2026-09-23 |
| CVE-2026-88416 MCMS 6.1.1 through 6.2.1 has a SQL injection vulnerability in the custom model/f... |
critical | 9.8 | — | — | 2026-09-22 | 2026-10-06 |
| CVE-2026-87121 lwIP TCP/IP Stack MQTT is vulnerable to an out-of-bounds write, which may allow... |
critical | 9.8 | — | — | 2026-09-22 | 2026-09-23 |
| CVE-2026-76708 A vulnerability exists in the Analytics and Location Engine (ALE) where the appl... |
critical | 9.8 | — | Arubanetworks / analytics and location engine | 2026-09-22 | 2026-09-25 |
| CVE-2026-76709 A vulnerability exists in the internal administrative component of Analytics and... |
critical | 9.8 | — | Arubanetworks / analytics and location engine | 2026-09-22 | 2026-09-28 |
| CVE-2026-28324 SolarWinds Observability Self-Hosted was found to be affected by an unauthentica... |
critical | 9.8 | — | — | 2026-09-22 | 2026-09-24 |
| CVE-2026-47116 LTSecurity LTK3500SF contains a hard-coded credentials vulnerability where the r... |
critical | 9.8 | — | — | 2026-09-22 | 2026-09-24 |
| CVE-2026-88414 MCMS 6.1.1 through 6.2.1 contains a SQL injection vulnerability in the PageActio... |
critical | 9.8 | — | — | 2026-09-22 | 2026-09-26 |
| CVE-2026-82000 Adobe Experience Manager Forms JEE is affected by a Server-Side Request Forgery... |
critical | 9.6 | — | — | 2026-09-22 | 2026-09-23 |
| CVE-2026-81995 Adobe Experience Manager Forms JEE is affected by an Improper Input Validation v... |
critical | 9.1 | — | — | 2026-09-22 | 2026-09-23 |
| CVE-2026-77254 MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (C... |
critical | 9.1 | — | Mcp-atlassian / mcp atlassian | 2026-09-22 | 2026-09-28 |
| CVE-2026-75745 Adobe Experience Manager Forms JEE is affected by an Incorrect Authorization vul... |
critical | 10.0 | — | — | 2026-09-22 | 2026-09-26 |
| CVE-2026-75682 Adobe Connect is affected by an Improper Neutralization of Special Elements used... |
critical | 9.9 | — | Adobe / connect | 2026-09-22 | 2026-09-25 |
| CVE-2026-75684 Adobe Connect is affected by a stored Cross-Site Scripting (XSS) vulnerability t... |
critical | 9.3 | — | Adobe / connect | 2026-09-22 | 2026-09-26 |
| CVE-2026-75686 Adobe Connect is affected by an Improper Input Validation vulnerability that cou... |
critical | 9.3 | — | Adobe / connect | 2026-09-22 | 2026-09-25 |
| CVE-2026-75689 Adobe Connect is affected by a stored Cross-Site Scripting (XSS) vulnerability t... |
critical | 9.3 | — | Adobe / connect | 2026-09-22 | 2026-09-26 |
| CVE-2026-75697 Adobe Connect is affected by a stored Cross-Site Scripting (XSS) vulnerability t... |
critical | 9.3 | — | Adobe / connect | 2026-09-22 | 2026-09-25 |
| CVE-2026-75698 Adobe Connect is affected by a reflected Cross-Site Scripting (XSS) vulnerabilit... |
critical | 9.3 | — | Adobe / connect | 2026-09-22 | 2026-09-25 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.