September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,290
Critical
1,223
High
4,344
Medium
4,103
Low
460
Severity not reported
1,160
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-56855 Previously, after a channel has been established, a malicious peer could send cr... |
high | 7.5 | — | Golang / crypto | 2026-09-02 | 2026-09-04 |
| CVE-2026-78662 Previously, a channel registered in the mux's chanList is not usable until it is... |
high | 7.5 | — | Golang / crypto | 2026-09-02 | 2026-09-04 |
| CVE-2026-85187 A security vulnerability has been detected in itsourcecode Online Medicine Deliv... |
high | 7.3 | — | — | 2026-09-03 | 2026-09-04 |
| CVE-2026-85512 A security flaw has been discovered in SourceCodester Class and Exam Timetabling... |
high | 7.3 | — | — | 2026-09-04 | 2026-09-04 |
| CVE-2026-84394 fast-uri accepts a host that contains an unbalanced or misplaced authority brack... |
high | 7.5 | — | Openjsf / fast-uri | 2026-09-03 | 2026-09-04 |
| CVE-2026-85397 A vulnerability was determined in code-projects Hospital Information System 1.0. |
high | 7.3 | — | — | 2026-09-04 | 2026-09-04 |
| CVE-2026-85403 A flaw has been found in code-projects Doctor Appointment System 1.0. |
high | 7.3 | — | — | 2026-09-04 | 2026-09-04 |
| CVE-2026-85379 A security flaw has been discovered in light0011 cms c774dce31c6df0055568a8d5c53... |
high | 7.3 | — | — | 2026-09-04 | 2026-09-04 |
| CVE-2026-73764 Vulnerabilities have been identified in the operating system of AOS-CX switches... |
high | 7.1 | — | Hpe / arubaos-cx | 2026-09-01 | 2026-09-04 |
| CVE-2026-73771 An authentication vulnerability exists in the AOS-CX management interface and AP... |
high | 7.5 | — | Hpe / arubaos-cx | 2026-09-01 | 2026-09-04 |
| CVE-2026-73770 An authenticated arbitrary file write vulnerability exists in AOS-CX. |
high | 7.3 | — | Hpe / arubaos-cx | 2026-09-01 | 2026-09-04 |
| CVE-2026-73768 A vulnerability exists in the command line interface of AOS-CX that may allow fo... |
high | 7.3 | — | Hpe / arubaos-cx | 2026-09-01 | 2026-09-04 |
| CVE-2026-73767 Authenticated command injection vulnerabilities exist in the command line interf... |
high | 7.2 | — | Hpe / arubaos-cx | 2026-09-01 | 2026-09-04 |
| CVE-2026-73766 Command injection vulnerabilities in the API endpoint of AOS-CX could allow an a... |
high | 7.2 | — | Hpe / arubaos-cx | 2026-09-01 | 2026-09-04 |
| CVE-2026-73765 Authenticated path traversal vulnerabilities exist in API endpoints of AOS-CX. |
high | 7.2 | — | Hpe / arubaos-cx | 2026-09-01 | 2026-09-04 |
| CVE-2026-73773 An unauthenticated Denial-of-Service (DoS) vulnerability exists in the API endpo... |
high | 7.5 | — | Hpe / arubaos-cx | 2026-09-01 | 2026-09-04 |
| CVE-2026-73774 A buffer overflow vulnerability exists in the underlying operating system of AOS... |
high | 7.6 | — | Hpe / arubaos-cx | 2026-09-01 | 2026-09-04 |
| CVE-2026-73775 Vulnerabilities in the API endpoint of AOS-CX could allow a remote attacker auth... |
high | 7.7 | — | Hpe / arubaos-cx | 2026-09-01 | 2026-09-04 |
| CVE-2026-73776 A signature verification bypass vulnerability exists in the command line interfa... |
high | 7.9 | — | Hpe / arubaos-cx | 2026-09-01 | 2026-09-04 |
| CVE-2026-73777 Vulnerabilities have been identified in the API endpoint of AOS-CX switches that... |
high | 8.1 | — | Hpe / arubaos-cx | 2026-09-01 | 2026-09-04 |
| CVE-2026-73779 Vulnerabilities have been identified in the operating system of AOS-CX switches... |
high | 8.2 | — | Hpe / arubaos-cx | 2026-09-01 | 2026-09-04 |
| CVE-2026-73782 A format string vulnerability exists in the command line interface of AOS-CX tha... |
high | 8.8 | — | Hpe / arubaos-cx | 2026-09-01 | 2026-09-04 |
| CVE-2026-73781 A vulnerability in the web-based management interface of AOS-CX could allow an a... |
high | 8.4 | — | Hpe / arubaos-cx | 2026-09-01 | 2026-09-04 |
| CVE-2026-84848 Unauthenticated Cross Site Scripting (XSS) in Quick Event Manager <= 9.17 versio... |
high | 7.1 | — | — | 2026-09-03 | 2026-09-04 |
| CVE-2026-81776 Unauthenticated Cross Site Scripting (XSS) in WP QuickLaTeX <= 3.8.8 versions. |
high | 7.1 | — | — | 2026-09-03 | 2026-09-04 |
| CVE-2026-84761 Unauthenticated Server Side Request Forgery (SSRF) in LiteSpeed Cache <= 7.9 ver... |
high | 7.2 | — | — | 2026-09-03 | 2026-09-04 |
| CVE-2026-84776 Unauthenticated Denial of Service Attack in MalCare Security <= 6.69 versions. |
high | 7.5 | — | — | 2026-09-03 | 2026-09-04 |
| CVE-2026-80751 In the Linux kernel, the following vulnerability has been resolved:
pmdomain: m... |
high | 7.8 | — | — | 2026-09-03 | 2026-09-04 |
| CVE-2026-80752 In the Linux kernel, the following vulnerability has been resolved:
Input: psxp... |
high | 8.4 | — | — | 2026-09-03 | 2026-09-04 |
| CVE-2026-80735 In the Linux kernel, the following vulnerability has been resolved:
ovpn: ensur... |
high | 7.3 | — | — | 2026-09-03 | 2026-09-04 |
| CVE-2026-80736 In the Linux kernel, the following vulnerability has been resolved:
thunderbolt... |
high | 7.8 | — | — | 2026-09-03 | 2026-09-04 |
| CVE-2026-80741 In the Linux kernel, the following vulnerability has been resolved:
drm/log: Fi... |
high | 7.1 | — | — | 2026-09-03 | 2026-09-04 |
| CVE-2026-80745 In the Linux kernel, the following vulnerability has been resolved:
regulator:... |
high | 8.4 | — | — | 2026-09-03 | 2026-09-04 |
| CVE-2026-80748 In the Linux kernel, the following vulnerability has been resolved:
mmc: loongs... |
high | 7.8 | — | — | 2026-09-03 | 2026-09-04 |
| CVE-2026-80749 In the Linux kernel, the following vulnerability has been resolved:
drm/connect... |
high | 7.1 | — | — | 2026-09-03 | 2026-09-04 |
| CVE-2026-80750 In the Linux kernel, the following vulnerability has been resolved:
pmdomain: m... |
high | 8.4 | — | — | 2026-09-03 | 2026-09-04 |
| CVE-2026-80732 In the Linux kernel, the following vulnerability has been resolved:
ata: pata_s... |
high | 7.8 | — | — | 2026-09-03 | 2026-09-04 |
| CVE-2026-84764 Unauthenticated Cross Site Request Forgery (CSRF) in Simply Schedule Appointment... |
high | 8.8 | — | — | 2026-09-02 | 2026-09-04 |
| CVE-2026-84794 Craft CMS versions before 5.10.11 lack authorization checks in the assets/move-a... |
high | 7.1 | — | — | 2026-09-02 | 2026-09-04 |
| CVE-2026-84441 A security vulnerability has been detected in Piwigo up to 16.3.0. |
high | 7.3 | — | — | 2026-09-02 | 2026-09-04 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.