September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,290
Critical
1,223
High
4,344
Medium
4,103
Low
460
Severity not reported
1,160
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-72996 Heap-based buffer overflow in Windows Biometric Service allows an authorized att... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-12 |
| CVE-2026-73002 Integer overflow or wraparound in Windows Biometric Service allows an authorized... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-12 |
| CVE-2026-73007 Heap-based buffer overflow in Windows Biometric Service allows an authorized att... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-12 |
| CVE-2026-78448 Heap-based buffer overflow in Windows Biometric Service allows an authorized att... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-12 |
| CVE-2026-80132 ell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application... |
high | 8.1 | — | Dell / secure connect gateway | 2026-09-07 | 2026-09-11 |
| CVE-2026-80133 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application... |
high | 8.1 | — | Dell / secure connect gateway | 2026-09-07 | 2026-09-11 |
| CVE-2026-80134 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application... |
high | 7.7 | — | Dell / secure connect gateway | 2026-09-07 | 2026-09-11 |
| CVE-2026-80178 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application... |
high | 7.8 | — | Dell / secure connect gateway | 2026-09-07 | 2026-09-11 |
| CVE-2026-78480 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application... |
high | 7.5 | — | Dell / secure connect gateway | 2026-09-07 | 2026-09-11 |
| CVE-2026-79644 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application... |
high | 7.4 | — | Dell / secure connect gateway | 2026-09-07 | 2026-09-11 |
| CVE-2026-79645 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application... |
high | 8.2 | — | Dell / secure connect gateway | 2026-09-07 | 2026-09-11 |
| CVE-2026-89260 MoguBlog through 6.2 contains an XML external entity injection vulnerability in... |
high | 7.5 | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-89249 AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored... |
high | 8.7 | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-89254 AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored... |
high | 8.7 | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-88959 Anchor CMS through 0.12.7 fails to enforce role-based access control in admin us... |
high | 8.8 | — | — | 2026-09-10 | 2026-09-11 |
| CVE-2026-86808 A security vulnerability has been detected in moltis-org moltis up to 20260818.1... |
high | 7.3 | — | — | 2026-09-08 | 2026-09-11 |
| CVE-2026-86305 A security flaw has been discovered in light0011 cms c774dce31c6df0055568a8d5c53... |
high | 7.3 | — | — | 2026-09-07 | 2026-09-11 |
| CVE-2026-86273 A weakness has been identified in projeto-siga siga up to 11.1.1. |
high | 7.3 | — | — | 2026-09-07 | 2026-09-11 |
| CVE-2026-86224 A vulnerability was determined in SourceCodester Class and Exam Timetabling Syst... |
high | 7.3 | — | — | 2026-09-06 | 2026-09-11 |
| CVE-2026-86166 A vulnerability was determined in Tenda HG10 300001138. |
high | 8.8 | — | — | 2026-09-06 | 2026-09-11 |
| CVE-2026-86161 A vulnerability was found in SourceCodester Online Voting System 1.0. |
high | 7.3 | — | — | 2026-09-06 | 2026-09-11 |
| CVE-2026-85516 A vulnerability was detected in code-projects Vehicle Management System 1.0. |
high | 7.3 | — | — | 2026-09-04 | 2026-09-11 |
| CVE-2026-85638 A weakness has been identified in jofpin trape 2.0. |
high | 7.3 | — | — | 2026-09-04 | 2026-09-11 |
| CVE-2026-85402 A vulnerability was detected in code-projects Doctor Appointment System 1.0. |
high | 7.3 | — | — | 2026-09-04 | 2026-09-11 |
| CVE-2026-85378 A vulnerability was identified in light0011 cms c774dce31c6df0055568a8d5c53d964d... |
high | 7.3 | — | — | 2026-09-03 | 2026-09-11 |
| CVE-2026-84816 Unauthenticated Cross Site Scripting (XSS) in WPCS <= 1.3.2 versions. |
high | 7.1 | — | — | 2026-09-10 | 2026-09-11 |
| CVE-2026-83997 Use after free in Windows Message Queuing allows an unauthorized attacker to exe... |
high | 8.1 | — | Microsoft / windows 10 21h2 | 2026-09-08 | 2026-09-11 |
| CVE-2026-83990 Stack-based buffer overflow in Microsoft Graphics Component allows an authorized... |
high | 7.8 | — | Microsoft / windows 11 23h2 | 2026-09-08 | 2026-09-11 |
| CVE-2026-82537 Roo-Code through 3.54.0 contains an auto-approve bypass vulnerability that allow... |
high | 8.8 | — | — | 2026-09-08 | 2026-09-11 |
| CVE-2026-81786 Unauthenticated Broken Access Control in Thank You Page Customizer for WooCommer... |
high | 7.5 | — | — | 2026-09-10 | 2026-09-11 |
| CVE-2026-81825 The Simple Ajax Chat – Add a Fast, Secure Chat Box plugin for WordPress is vulne... |
high | 7.2 | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-78444 Untrusted pointer dereference in Windows Failover Cluster allows an unauthorized... |
high | 8.1 | — | Microsoft / windows 10 1809 | 2026-09-08 | 2026-09-11 |
| CVE-2026-77807 The AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution... |
high | 7.5 | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-77108 Adobe Commerce is affected by an Incorrect Authorization vulnerability that coul... |
high | 7.5 | — | Adobe / commerce | 2026-09-08 | 2026-09-11 |
| CVE-2026-75927 The PublishPress Capabilities – User Role Editor, Access Permissions, User Capab... |
high | 7.2 | — | — | 2026-09-09 | 2026-09-11 |
| CVE-2026-73017 Heap-based buffer overflow in Windows Graphics Kernel allows an authorized attac... |
high | 7.5 | — | Microsoft / windows 10 1809 | 2026-09-08 | 2026-09-11 |
| CVE-2026-62107 Unauthenticated PHP Object Injection in Masteriyo - LMS <= 3.4.0 versions. |
high | 8.8 | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-62109 Editor SQL Injection in Sky Addons for Elementor <= 3.8.4 versions. |
high | 7.6 | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-62089 Missing Authorization vulnerability in Pixar Labs Master Addons for Elementor al... |
high | 7.1 | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-62102 Subscriber Privilege Escalation in Gato GraphQL <= 19.2.3 versions. |
high | 8.8 | — | — | 2026-09-11 | 2026-09-11 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.