September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,290
Critical
1,223
High
4,344
Medium
4,103
Low
460
Severity not reported
1,160
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-55658 Gardens v2 is a modular governance framework that enables communities to create... |
high | 7.7 | — | — | 2026-09-03 | 2026-09-09 |
| CVE-2026-87811 SiYuan before v3.8.2 inserts persisted notebook template paths into HTML input v... |
high | 7.3 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-87813 SiYuan before v3.8.2 contains a stored cross-site scripting vulnerability in the... |
high | 7.3 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-87821 Lara Dashboard through 1.3.1 contains a server-side request forgery vulnerabilit... |
high | 7.1 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-86099 Chainlit through 2.12.0 fails to validate the client-supplied socket.io sessionI... |
high | 8.2 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-86199 PocketMine-MP versions before 5.43.1 fail to properly validate the Certificate f... |
high | 7.5 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-79636 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application... |
high | 7.0 | — | Dell / secure connect gateway | 2026-09-09 | 2026-09-09 |
| CVE-2026-87823 zstd-jni before 1.5.7-14 performs 32-bit signed bounds checks on three direct-By... |
high | 8.2 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-87877 zstd-jni versions before 1.5.7-14 fail to validate closed state in setDict, setL... |
high | 7.7 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-80123 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application... |
high | 7.5 | — | Dell / secure connect gateway | 2026-09-09 | 2026-09-09 |
| CVE-2026-85877 Heap-based buffer overflow in Windows Print Spooler Components allows an unautho... |
high | 8.8 | — | Microsoft / windows 11 24h2 | 2026-09-08 | 2026-09-09 |
| CVE-2026-87927 MaxSite CMS through 109.6 contains a local file inclusion vulnerability in the a... |
high | 8.2 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-87930 MaxSite CMS through 109.6 passes the ci_session cookie to unserialize() without... |
high | 8.1 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-87874 A flaw was found in the memcached cache plugin of the community.general Ansible... |
high | 8.1 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-79738 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application... |
high | 7.5 | — | Dell / secure connect gateway | 2026-09-09 | 2026-09-09 |
| CVE-2026-79740 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application... |
high | 7.5 | — | Dell / secure connect gateway | 2026-09-09 | 2026-09-09 |
| CVE-2026-79950 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application... |
high | 7.5 | — | Dell / secure connect gateway | 2026-09-09 | 2026-09-09 |
| CVE-2026-78482 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application... |
high | 7.8 | — | Dell / secure connect gateway | 2026-09-09 | 2026-09-09 |
| CVE-2026-79692 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application... |
high | 7.3 | — | Dell / secure connect gateway | 2026-09-09 | 2026-09-09 |
| CVE-2026-78490 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application... |
high | 7.5 | — | Dell / secure connect gateway | 2026-09-09 | 2026-09-09 |
| CVE-2026-78485 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application... |
high | 7.3 | — | Dell / secure connect gateway | 2026-09-09 | 2026-09-09 |
| CVE-2026-80122 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application... |
high | 7.3 | — | Dell / secure connect gateway | 2026-09-09 | 2026-09-09 |
| CVE-2026-9854 A vulnerability exists in SYS600 RBAC mechanism where users having access to the... |
high | 7.8 | — | Hitachienergy / microscada x sys600 | 2026-09-03 | 2026-09-09 |
| CVE-2026-9853 A vulnerability exists in SYS600 which allows any user authenticated to the oper... |
high | 7.8 | — | Hitachienergy / microscada x sys600 | 2026-09-03 | 2026-09-09 |
| CVE-2026-9852 A CSV injection vulnerability exists in SYS600. |
high | 7.8 | — | Hitachienergy / microscada x sys600 | 2026-09-03 | 2026-09-09 |
| CVE-2026-81385 Deserialization of untrusted data in Microsoft Office Publisher allows an unauth... |
high | 8.8 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-09 |
| CVE-2026-69742 Integer overflow or wraparound in Microsoft Office Publisher allows an unauthori... |
high | 8.8 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-09 |
| CVE-2026-69285 Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker t... |
high | 8.8 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-09 |
| CVE-2026-69442 Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker t... |
high | 8.8 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-09 |
| CVE-2026-85124 @fastify/http-proxy versions before 11.6.2 do not validate proxied HTTP request... |
high | 7.5 | — | Fastify / fastify\/http-proxy | 2026-09-03 | 2026-09-09 |
| CVE-2026-69629 Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized at... |
high | 8.8 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-09 |
| CVE-2026-83975 Heap-based buffer overflow in Windows Biometric Service allows an authorized att... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-09 |
| CVE-2026-83986 Heap-based buffer overflow in Windows Biometric Service allows an authorized att... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-09 |
| CVE-2026-79390 Trueview TI8161 6.0.23.4 is vulnerable to information disclosure due to the tran... |
high | 7.5 | — | — | 2026-09-04 | 2026-09-09 |
| CVE-2026-78837 A SQL injection vulnerability in the ap_form_{id} parameter in AppNitro MachForm... |
high | 7.5 | — | — | 2026-09-08 | 2026-09-09 |
| CVE-2026-80081 Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to... |
high | 8.8 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-09 |
| CVE-2026-78519 Use of uninitialized resource in Microsoft Office Outlook allows an unauthorized... |
high | 8.8 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-09 |
| CVE-2026-69857 Authorization bypass through user-controlled key in Azure Cosmos DB allows an au... |
high | 8.8 | — | Microsoft / azure cosmos db | 2026-09-03 | 2026-09-09 |
| CVE-2026-79734 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application... |
high | 7.5 | — | Dell / secure connect gateway | 2026-09-07 | 2026-09-09 |
| CVE-2026-80130 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application... |
high | 8.8 | — | Dell / secure connect gateway | 2026-09-07 | 2026-09-09 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.