September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,364
Critical
1,230
High
4,374
Medium
4,126
Low
462
Severity not reported
1,172
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (964), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-96257 A flaw has been found in Fast FAC1203R Gigabit Edition 2.0.4. |
critical | 10.0 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-93952 Arista VeloCloud Orchestrator Improper Input Validation Vulnerability |
critical | 10.0 | Listed | Arista / VeloCloud Orchestrator | 2026-09-22 | 2026-09-23 |
| CVE-2026-94127 F5 BIG-IP APM Heap-based Buffer Overflow Vulnerability |
critical | 9.8 | Listed | F5 / BIG-IP APM | 2026-09-22 | 2026-09-23 |
| CVE-2026-23933 In Zabbix 7.4 the cryptographic key used for signing Frontend sessions has been... |
critical | 9.1 | — | Zabbix / zabbix | 2026-08-18 | 2026-09-23 |
| CVE-2025-15391 A weakness has been identified in D-Link DIR-806A 100CNb11. |
critical | 9.8 | — | Dlink / dir-806a firmware | 2025-12-31 | 2026-09-23 |
| CVE-2025-34468 libcoap versions up to and including 4.3.5, prior to commit 30db3ea, contain a s... |
critical | 9.8 | — | Libcoap / libcoap | 2025-12-31 | 2026-09-23 |
| CVE-2025-69286 RAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine. |
critical | 9.8 | — | Infiniflow / ragflow | 2025-12-31 | 2026-09-23 |
| CVE-2025-69288 Titra is open source project time tracking software. |
critical | 9.1 | — | Kromit / titra | 2025-12-31 | 2026-09-23 |
| CVE-2026-81995 Adobe Experience Manager Forms JEE is affected by an Improper Input Validation v... |
critical | 9.1 | — | — | 2026-09-22 | 2026-09-23 |
| CVE-2026-82000 Adobe Experience Manager Forms JEE is affected by a Server-Side Request Forgery... |
critical | 9.6 | — | — | 2026-09-22 | 2026-09-23 |
| CVE-2026-77006 The WebTotem Backups WordPress plugin before 1.1.0 does not validate a user-supp... |
critical | 9.6 | — | — | 2026-09-12 | 2026-09-23 |
| CVE-2000-0944 CGI Script Center News Update 1.1 does not properly validate the original news a... |
critical | 9.8 | — | Cgi / script center news update | 2000-12-19 | 2026-09-23 |
| CVE-2026-74849 Zohocorp ManageEngine ADSelfService Plus versions before build 7001 are vulnerab... |
critical | 9.8 | — | — | 2026-09-22 | 2026-09-23 |
| CVE-2026-44756 A memory safety vulnerability exists in the Extended Passport Protocol (EPP) pro... |
critical | 10.0 | — | — | 2026-09-08 | 2026-09-22 |
| CVE-2026-93839 LightLLM through 1.2.0 contains an authentication bypass vulnerability in the /p... |
critical | 9.8 | — | — | 2026-09-18 | 2026-09-22 |
| CVE-2026-73749 Multiple vulnerabilities exist in a daemon of AOS-CX that may allow for improper... |
critical | 9.8 | — | Hpe / arubaos-cx | 2026-09-01 | 2026-09-22 |
| CVE-2023-54399 Hongjing e-HR before 8.2 contains a SQL injection vulnerability in the /servlet/... |
critical | 9.8 | — | — | 2026-09-18 | 2026-09-22 |
| CVE-2026-92805 UVdesk Community Skeleton through 1.1.8 fails to authenticate or validate instal... |
critical | 9.8 | — | — | 2026-09-16 | 2026-09-22 |
| CVE-2026-78623 The Okta Access Gateway does not sanitize SAML assertion values before interpola... |
critical | 9.9 | — | Okta / access gateway | 2026-09-08 | 2026-09-22 |
| CVE-2026-95675 D-Link DAP-1360 firmware version 6.14 and earlier contains an unauthenticated re... |
critical | 9.8 | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-93012 Email::Sender::Transport::Sendmail versions before 2.602 for Perl allow arbitrar... |
critical | 9.8 | — | — | 2026-09-21 | 2026-09-22 |
| CVE-2026-79313 webpy web.py 0.76 is vulnerable to Insufficient Session Expiration. |
critical | 9.8 | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-23813 A vulnerability has been identified in the web-based management interface of AOS... |
critical | 9.8 | — | Hpe / arubaos-cx | 2026-03-11 | 2026-09-22 |
| CVE-2026-89086 In the jose package before 0.11.0 for OCaml, library calls to validate an RSA si... |
critical | 9.1 | — | — | 2026-09-10 | 2026-09-22 |
| CVE-2026-89094 Forgejo before 16.0.4 allows remote code execution via a crafted template reposi... |
critical | 9.9 | — | — | 2026-09-10 | 2026-09-22 |
| CVE-2026-71640 An issue in ZJU-FAST-Lab EGO-Planner-v2 All versions up to commit 5c99a95880401e... |
critical | 9.1 | — | — | 2026-09-10 | 2026-09-22 |
| CVE-2026-71644 An issue in Robotics-STAR-Lab (SYSU STAR Group) RACER Tested affected version: c... |
critical | 9.8 | — | — | 2026-09-11 | 2026-09-22 |
| CVE-2026-79395 An improper authentication vulnerability in the WS-Security (wsse:UsernameToken)... |
critical | 9.8 | — | — | 2026-09-11 | 2026-09-22 |
| CVE-2026-79396 Use of hardcoded default credentials in Xiongmai IP Camera XM530 firmware HMT.CM... |
critical | 9.8 | — | — | 2026-09-11 | 2026-09-22 |
| CVE-2026-52630 SQL Injection vulnerability in Woltlab WCF v.6.2.4 and before allows a remote at... |
critical | 9.8 | — | — | 2026-09-11 | 2026-09-22 |
| CVE-2026-79303 kaiten from 57.192.20 to before 57.214.26 is vulnerable to SQL Injection. |
critical | 9.9 | — | — | 2026-09-15 | 2026-09-22 |
| CVE-2026-88617 SmartAdmin v3.30.0 contains an authorization flaw in the configuration query end... |
critical | 9.8 | — | — | 2026-09-15 | 2026-09-22 |
| CVE-2026-37152 TOTOLINK X5000R V9.1.0cu.2415_B20250515 was discovered to contain a hardcoded pa... |
critical | 9.8 | — | — | 2026-09-15 | 2026-09-22 |
| CVE-2026-51990 An issue in Sogou Sogou Input Method < 16.3.0.3498 (fixed in 16.3.0.3498) allows... |
critical | 9.8 | — | — | 2026-09-16 | 2026-09-22 |
| CVE-2026-88592 kkFileView >= 4.2.0 is vulnerable to Server-Side Request Forgery (SSRF). |
critical | 9.1 | — | — | 2026-09-16 | 2026-09-22 |
| CVE-2026-88402 A SQL injection vulnerability in the checkSQL function of nocobase v2.1.21 allow... |
critical | 9.8 | — | — | 2026-09-21 | 2026-09-22 |
| CVE-2026-88404 A remote code execution (RCE) vulnerability in the UniscriptExecutionService.exe... |
critical | 9.8 | — | — | 2026-09-21 | 2026-09-22 |
| CVE-2026-78847 An issue in gray-matter All versions (verified on 4.0.3) allows the JavaScript e... |
critical | 9.8 | — | — | 2026-09-21 | 2026-09-22 |
| CVE-2024-26305 There is a buffer overflow vulnerability in the underlying Utility daemon that c... |
critical | 9.8 | — | Arubanetworks / sd-wan | 2024-05-01 | 2026-09-22 |
| CVE-2026-73952 Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware... |
critical | 9.1 | — | Oracle / webcenter portal | 2026-09-15 | 2026-09-22 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.