September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,364
Critical
1,230
High
4,374
Medium
4,126
Low
462
Severity not reported
1,172
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (964), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-82843 The WP OAuth Server ( Login with WordPress ) WordPress plugin before 6.4.0 does... |
critical | 9.0 | — | — | 2026-09-23 | 2026-09-24 |
| CVE-2026-73369 Adobe Campaign Classic (ACC) is affected by an Improper Control of Generation of... |
critical | 10.0 | — | Adobe / campaign | 2026-09-22 | 2026-09-24 |
| CVE-2026-75728 Adobe Campaign Classic (ACC) is affected by an Incorrect Authorization vulnerabi... |
critical | 9.1 | — | Adobe / campaign | 2026-09-22 | 2026-09-24 |
| CVE-2026-82011 Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Specia... |
critical | 9.1 | — | Adobe / campaign | 2026-09-22 | 2026-09-24 |
| CVE-2026-92238 A maliciously constructed mail header could lead to multiple fields being parsed... |
critical | 9.8 | — | Mozilla / thunderbird | 2026-09-15 | 2026-09-24 |
| CVE-2026-92240 A malicious or compromised IMAP server can trigger an out-of-bounds read in the... |
critical | 9.1 | — | Mozilla / thunderbird | 2026-09-15 | 2026-09-24 |
| CVE-2026-91749 Use after free in Workers in Google Chrome prior to 153.0.8010.47 allowed a remo... |
critical | 9.6 | — | Google / chrome | 2026-09-15 | 2026-09-24 |
| CVE-2026-94097 A vulnerability was determined in Netcore NBR200V2 1.3.241127.071246. |
critical | 10.0 | — | — | 2026-09-21 | 2026-09-24 |
| CVE-2026-88405 A remote code execution (RCE) vulnerability in the RemoteRegisterFunctionService... |
critical | 9.8 | — | — | 2026-09-21 | 2026-09-24 |
| CVE-2026-67827 Incorrect Access Control in the HTTP API module in ZLMediaKit commit 9fd5152 all... |
critical | 9.8 | — | — | 2026-09-21 | 2026-09-24 |
| CVE-2026-36469 CuteNews v.2.1.2 is vulnerable to Server-Side Request Forgery (SSRF) in core/mod... |
critical | 9.1 | — | — | 2026-09-21 | 2026-09-24 |
| CVE-2025-32432 Craft CMS Code Injection Vulnerability |
critical | 10.0 | Listed | Craft CMS / Craft CMS | 2025-04-25 | 2026-09-24 |
| CVE-2025-42599 Qualitia Active! Mail Stack-Based Buffer Overflow Vulnerability |
critical | 9.8 | Listed | Qualitia / Active! Mail | 2025-04-18 | 2026-09-24 |
| CVE-2025-0108 Palo Alto Networks PAN-OS Authentication Bypass Vulnerability |
critical | 9.1 | Listed | Palo Alto Networks / PAN-OS | 2025-02-12 | 2026-09-24 |
| CVE-2025-23006 SonicWall SMA1000 Appliances Deserialization Vulnerability |
critical | 9.8 | Listed | SonicWall / SMA1000 Appliances | 2025-01-23 | 2026-09-24 |
| CVE-2026-85706 GitLab Community Edition and Enterprise Edition Path Traversal Vulnerability |
critical | 10.0 | Listed | GitLab / Community Edition and Enterprise Edition | 2026-09-12 | 2026-09-24 |
| CVE-2026-94003 A vulnerability has been found in Comfast CF-N1-S 2.6.0.1. |
critical | 10.0 | — | — | 2026-09-20 | 2026-09-24 |
| CVE-2026-91949 FreeRDP server versions before 3.31.0 contain a protocol negotiation bypass vuln... |
critical | 9.3 | — | Freerdp / freerdp | 2026-09-15 | 2026-09-24 |
| CVE-2026-84502 A flaw was found in Red Hat Ansible Automation Platform's automation-
controller... |
critical | 9.9 | — | — | 2026-09-23 | 2026-09-24 |
| CVE-2026-84474 A flaw was found in Red Hat Ansible Automation Platform's automation-
controller... |
critical | 9.9 | — | — | 2026-09-23 | 2026-09-24 |
| CVE-2026-86708 ZohoCorp ManageEngine Applications Manager versions 182200 and below were vulner... |
critical | 10.0 | — | — | 2026-09-23 | 2026-09-24 |
| CVE-2026-19599 ZohoCorp ManageEngine OpManager MSP versions 12.8.709 and below were vulnerable... |
critical | 9.9 | — | — | 2026-09-23 | 2026-09-24 |
| CVE-2026-17472 IBM Concert 1.0.0 through 3.0.0 could allow a remote authenticated attacker to a... |
critical | 9.6 | — | — | 2026-09-22 | 2026-09-24 |
| CVE-2026-70913 Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware... |
critical | 9.8 | — | Oracle / identity manager | 2026-09-15 | 2026-09-23 |
| CVE-2026-89275 Adobe Campaign Classic (ACC) is affected by an Improper Control of Generation of... |
critical | 10.0 | — | Adobe / campaign | 2026-09-22 | 2026-09-23 |
| CVE-2026-84412 Adobe Campaign Classic (ACC) is affected by an Improper Control of Generation of... |
critical | 10.0 | — | Adobe / campaign | 2026-09-22 | 2026-09-23 |
| CVE-2026-82443 Adobe Campaign Classic (ACC) is affected by a Server-Side Request Forgery (SSRF)... |
critical | 9.9 | — | Adobe / campaign | 2026-09-22 | 2026-09-23 |
| CVE-2026-82008 Adobe Campaign Classic (ACC) is affected by an Improper Input Validation vulnera... |
critical | 9.9 | — | Adobe / campaign | 2026-09-22 | 2026-09-23 |
| CVE-2026-75723 Adobe Campaign Classic (ACC) is affected by an Incorrect Authorization vulnerabi... |
critical | 10.0 | — | Adobe / campaign | 2026-09-22 | 2026-09-23 |
| CVE-2026-75703 Adobe Campaign Classic (ACC) is affected by an Improper Control of Generation of... |
critical | 10.0 | — | Adobe / campaign | 2026-09-22 | 2026-09-23 |
| CVE-2026-82010 Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Specia... |
critical | 9.9 | — | Adobe / campaign | 2026-09-22 | 2026-09-23 |
| CVE-2026-54670 WeGIA is a web manager for charitable institutions. |
critical | 9.1 | — | — | 2026-09-17 | 2026-09-23 |
| CVE-2026-82717 In NLnet Labs Unbound up to and including 1.26.0, a vulnerability was found in t... |
critical | 9.8 | — | Nlnetlabs / unbound | 2026-09-16 | 2026-09-23 |
| CVE-2026-87121 lwIP TCP/IP Stack MQTT is vulnerable to an out-of-bounds write, which may allow... |
critical | 9.8 | — | — | 2026-09-22 | 2026-09-23 |
| CVE-2026-95601 Unauthenticated SQL Injection in Product Filter by WBW <= 3.1.7 versions. |
critical | 9.3 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-96758 orval @orval/core before 8.28.0 contains a code injection vulnerability in the f... |
critical | 9.8 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-84625 A permissions issue was addressed with additional sandbox restrictions. |
critical | 9.1 | — | Apple / ipados | 2026-09-14 | 2026-09-23 |
| CVE-2026-10027 IBM MQ could allow a remote attacker to cause a denial of service or execute arb... |
critical | 9.8 | — | Ibm / mq | 2026-09-18 | 2026-09-23 |
| CVE-2026-85102 Check Point Multiple Products Improper Certificate Validation Vulnerability |
critical | 9.8 | Listed | Check Point / Multiple Products | 2026-09-09 | 2026-09-23 |
| CVE-2026-96757 orval before 8.29.0 fails to escape OpenAPI media-type keys when emitting them i... |
critical | 9.8 | — | — | 2026-09-23 | 2026-09-23 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.