September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,826
Low
527
Severity not reported
2,544
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), apache (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-57149 plone.app.portlets.portlets provides a Plone-specific user interface for plone.p... |
critical | 9.9 | — | — | 2026-09-22 | 2026-09-23 |
| CVE-2026-89275 Adobe Campaign Classic (ACC) is affected by an Improper Control of Generation of... |
critical | 10.0 | — | Adobe / campaign | 2026-09-22 | 2026-09-23 |
| CVE-2026-89276 Adobe Campaign Classic (ACC) is affected by an Improper Control of Generation of... |
critical | 9.9 | — | Adobe / campaign | 2026-09-22 | 2026-09-26 |
| CVE-2026-83660 Adobe Campaign Classic (ACC) is affected by a Server-Side Request Forgery (SSRF)... |
critical | 10.0 | — | Adobe / campaign | 2026-09-22 | 2026-09-26 |
| CVE-2026-84412 Adobe Campaign Classic (ACC) is affected by an Improper Control of Generation of... |
critical | 10.0 | — | Adobe / campaign | 2026-09-22 | 2026-09-23 |
| CVE-2026-82008 Adobe Campaign Classic (ACC) is affected by an Improper Input Validation vulnera... |
critical | 9.9 | — | Adobe / campaign | 2026-09-22 | 2026-09-23 |
| CVE-2026-82009 Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Specia... |
critical | 9.1 | — | Adobe / campaign | 2026-09-22 | 2026-09-26 |
| CVE-2026-82010 Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Specia... |
critical | 9.9 | — | Adobe / campaign | 2026-09-22 | 2026-09-23 |
| CVE-2026-82011 Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Specia... |
critical | 9.1 | — | Adobe / campaign | 2026-09-22 | 2026-09-24 |
| CVE-2026-82013 Adobe Campaign Classic (ACC) is affected by a Server-Side Request Forgery (SSRF)... |
critical | 9.9 | — | Adobe / campaign | 2026-09-22 | 2026-09-26 |
| CVE-2026-82443 Adobe Campaign Classic (ACC) is affected by a Server-Side Request Forgery (SSRF)... |
critical | 9.9 | — | Adobe / campaign | 2026-09-22 | 2026-09-23 |
| CVE-2026-77244 MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (C... |
critical | 10.0 | — | Mcp-atlassian / mcp atlassian | 2026-09-22 | 2026-09-29 |
| CVE-2026-75721 Adobe Campaign Classic (ACC) is affected by an Improper Control of Generation of... |
critical | 10.0 | — | Adobe / campaign | 2026-09-22 | 2026-09-26 |
| CVE-2026-75723 Adobe Campaign Classic (ACC) is affected by an Incorrect Authorization vulnerabi... |
critical | 10.0 | — | Adobe / campaign | 2026-09-22 | 2026-09-23 |
| CVE-2026-75728 Adobe Campaign Classic (ACC) is affected by an Incorrect Authorization vulnerabi... |
critical | 9.1 | — | Adobe / campaign | 2026-09-22 | 2026-09-24 |
| CVE-2026-73369 Adobe Campaign Classic (ACC) is affected by an Improper Control of Generation of... |
critical | 10.0 | — | Adobe / campaign | 2026-09-22 | 2026-09-24 |
| CVE-2026-75699 Adobe Campaign Classic (ACC) is affected by an Improper Control of Generation of... |
critical | 10.0 | — | Adobe / campaign | 2026-09-22 | 2026-09-26 |
| CVE-2026-75703 Adobe Campaign Classic (ACC) is affected by an Improper Control of Generation of... |
critical | 10.0 | — | Adobe / campaign | 2026-09-22 | 2026-09-23 |
| CVE-2026-43641 Softaculous Virtualizor before 3.2.9 (Patch 9) and 3.0.0 contains an OS command... |
critical | 9.8 | — | — | 2026-09-22 | 2026-09-23 |
| CVE-2026-94456 Postiz generates security-sensitive credentials using `Math.random()` instead of... |
critical | 9.1 | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-85734 LightRAG provides simple and fast retrieval-augmented generation. |
critical | 9.1 | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-86059 Dokploy is a free, self-hostable Platform as a Service (PaaS). |
critical | 9.6 | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-80156 Lantronix SLC8000 before firmware v9.7.0.5, SLC9000 before firmware v9.7.0.2, EM... |
critical | 9.1 | — | — | 2026-09-22 | 2026-09-24 |
| CVE-2026-80151 Lantronix SLC8000 before firmware v9.7.0.3, SLC9000 before firmware v9.7.0.2, EM... |
critical | 9.1 | — | — | 2026-09-22 | 2026-09-26 |
| CVE-2026-80152 Lantronix SLC8000 before firmware v9.7.0.3, SLC9000 before firmware v9.7.0.2, EM... |
critical | 9.1 | — | — | 2026-09-22 | 2026-09-26 |
| CVE-2026-80154 All firmware versions of Lantronix SLC8000, SLC9000, EMG8500, EMG7500, SLB882, S... |
critical | 9.6 | — | — | 2026-09-22 | 2026-09-24 |
| CVE-2026-80155 Lantronix SLC8000 before firmware v9.7.0.5, SLC9000 before firmware v9.7.0.2, EM... |
critical | 10.0 | — | — | 2026-09-22 | 2026-09-24 |
| CVE-2026-80145 Lantronix SLC8000/SLC9000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmw... |
critical | 9.1 | — | — | 2026-09-22 | 2026-09-24 |
| CVE-2026-80146 Lantronix SLC8000/SLC9000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmw... |
critical | 9.9 | — | — | 2026-09-22 | 2026-09-26 |
| CVE-2026-80147 Lantronix SLC8000/SLC9000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmw... |
critical | 9.9 | — | — | 2026-09-22 | 2026-09-24 |
| CVE-2026-80144 Lantronix SLC8000/SLC9000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmw... |
critical | 9.9 | — | — | 2026-09-22 | 2026-09-24 |
| CVE-2026-80143 Lantronix SLC8000/SLC9000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmw... |
critical | 9.9 | — | — | 2026-09-22 | 2026-09-24 |
| CVE-2026-94127 F5 BIG-IP APM Heap-based Buffer Overflow Vulnerability |
critical | 9.8 | Listed | F5 / BIG-IP APM | 2026-09-22 | 2026-09-23 |
| CVE-2026-93088 SGLang's multimodal generation runtime is vulnerable to unauthenticated arbitrar... |
critical | 9.8 | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-84388 A improper restriction of rendered ui layers or frames vulnerability in Fortinet... |
critical | 9.6 | — | — | 2026-09-22 | 2026-09-27 |
| CVE-2026-79313 webpy web.py 0.76 is vulnerable to Insufficient Session Expiration. |
critical | 9.8 | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-65130 NVIDIA Infrastructure Controller for Linux contains a vulnerability where an att... |
critical | 9.8 | — | Nvidia / infra controller | 2026-09-22 | 2026-09-29 |
| CVE-2026-65118 NVIDIA Infrastructure Controller for Linux contains a vulnerability where an att... |
critical | 9.8 | — | Nvidia / infra controller | 2026-09-22 | 2026-09-29 |
| CVE-2026-65121 NVIDIA Infrastructure Controller for Linux contains a vulnerability where an att... |
critical | 9.8 | — | Nvidia / infra controller | 2026-09-22 | 2026-09-29 |
| CVE-2026-65113 NVIDIA Infrastructure Controller for Linux contains a vulnerability where an att... |
critical | 9.8 | — | Nvidia / infra controller | 2026-09-22 | 2026-09-29 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.