September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,290
Critical
1,223
High
4,344
Medium
4,103
Low
460
Severity not reported
1,160
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-84668 Jenkins SAML Plugin 4.618.v441a_27fa_46d2 and earlier allows overwriting the SAM... |
high | 8.8 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-84669 A path traversal vulnerability in Jenkins Allure Plugin 2.35.2 and earlier allow... |
high | 8.8 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-84670 Jenkins Performance Plugin 1015.v09ca_52b_3370e and earlier does not restrict th... |
high | 8.8 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-84671 Jenkins File Parameter Plugin 425.v3fa_801681b_5e and earlier allows writing fil... |
high | 8.8 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-84672 Jenkins Microsoft Entra ID (previously Azure AD) Plugin 710.v0b_ff8e9cc2d2 and e... |
high | 8.8 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-84673 Jenkins Customizable Header Plugin 295.v2544b_ca_19b_97 and earlier allows overw... |
high | 8.8 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-84675 OS command injection vulnerability in Jenkins TICS Plugin 2025.1.1 and earlier a... |
high | 7.4 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-84326 Uninitialized resource in V8 in Google Chrome prior to 152.0.7977.75 allowed a r... |
high | 8.8 | — | Google / chrome | 2026-09-02 | 2026-09-03 |
| CVE-2026-84334 Incorrect authorization in Chromoting in Google Chrome on on Windows prior to 15... |
high | 8.1 | — | Google / chrome | 2026-09-02 | 2026-09-03 |
| CVE-2026-84335 Incorrect authorization in TabStrip in Google Chrome prior to 152.0.7977.75 allo... |
high | 8.3 | — | Google / chrome | 2026-09-02 | 2026-09-03 |
| CVE-2026-83551 Cleartext storage of sensitive information in the @step and @remote decorator pi... |
high | 7.2 | — | — | 2026-09-01 | 2026-09-03 |
| CVE-2026-84851 An uncontrolled recursion issue exists in Amazon Ion-C versions before 1.1.6 tha... |
high | 7.5 | — | — | 2026-09-03 | 2026-09-03 |
| CVE-2026-81928 Net::DNS versions before 1.57 for Perl allow memory exhaustion via unbounded rec... |
high | 7.5 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-79679 Use of Weak Credentials vulnerability in B&R Industrial Automation GmbH mapp Aud... |
high | 8.7 | — | — | 2026-09-03 | 2026-09-03 |
| CVE-2026-18329 Description
NGINX JavaScript (njs) and QuickJS (qjs) engines have a vulnerabili... |
high | 8.2 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-84144 Internally found bugs present in Thunderbird 154 and Thunderbird ESR 153.1. |
high | 7.5 | — | Mozilla / firefox | 2026-09-01 | 2026-09-03 |
| CVE-2026-84423 A vulnerability has been found in Casdoor up to 4.0.0. |
high | 7.3 | — | — | 2026-09-01 | 2026-09-03 |
| CVE-2026-84117 Privilege escalation in Firefox for Android. |
high | 8.8 | — | Mozilla / firefox mobile | 2026-09-01 | 2026-09-03 |
| CVE-2026-73712 A vulnerability in the API of HPE Networking Fabric Composer could allow an unau... |
high | 8.1 | — | Arubanetworks / fabric composer | 2026-09-01 | 2026-09-03 |
| CVE-2026-19590 OpenAI Codex Desktop for Windows and macOS could execute attacker-controlled Git... |
high | 7.3 | — | — | 2026-09-01 | 2026-09-03 |
| CVE-2026-84759 Unauthenticated Cross Site Request Forgery (CSRF) in Activity Log <= 2.13.1 vers... |
high | 7.1 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-82883 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-81772 Unauthenticated PHP Object Injection in Ninja Forms - Layout & Styles <= 3.0.31... |
high | 8.8 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-78590 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (... |
high | 7.3 | — | Elastic / kibana | 2026-09-02 | 2026-09-03 |
| CVE-2026-78689 Description
NGINX JavaScript (njs) has a vulnerability in the XML module's name... |
high | 8.1 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-77180 When NGINX Ingress Controller is configured with Ingress annotations, an injecti... |
high | 8.3 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-66842 BIG-IP has a vulnerability where an authenticated user of any role may be able t... |
high | 8.8 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-66362 Description:
When NGINX Plus is configured as the data plane for NGINX Gateway F... |
high | 8.1 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-84128 Privilege escalation in the WebDriver BiDi component. |
high | 8.8 | — | Mozilla / firefox | 2026-09-01 | 2026-09-03 |
| CVE-2026-84131 Privilege escalation due to invalid pointer in the Graphics component. |
high | 8.8 | — | Mozilla / firefox | 2026-09-01 | 2026-09-03 |
| CVE-2026-84145 Internally found bugs present in Thunderbird 154, Thunderbird ESR 153.1 and Thun... |
high | 7.5 | — | Mozilla / firefox | 2026-09-01 | 2026-09-03 |
| CVE-2026-78222 A vulnerability exists in NGINX JavaScript where a malformed HTTP response recei... |
high | 7.5 | — | — | 2026-09-02 | 2026-09-02 |
| CVE-2026-20281 A vulnerability in Cisco Desk Phone 9800 Series, Cisco IP Phone 7800 and 8800 Se... |
high | 7.5 | — | — | 2026-09-02 | 2026-09-02 |
| CVE-2026-76759 Vulnerability in Drupal Screenshot. |
high | 7.3 | — | — | 2026-09-02 | 2026-09-02 |
| CVE-2026-73716 A remote code execution vulnerability exists in the underlying operating system... |
high | 7.5 | — | Arubanetworks / fabric composer | 2026-09-01 | 2026-09-02 |
| CVE-2026-73717 A command injection vulnerability exists in the web-based management interface o... |
high | 7.5 | — | Arubanetworks / fabric composer | 2026-09-01 | 2026-09-02 |
| CVE-2026-19591 OpenAI Codex CLI for Windows, macOS, and Linux and Codex Desktop for Windows and... |
high | 8.8 | — | — | 2026-09-01 | 2026-09-02 |
| CVE-2026-78607 Missing Authorization (CWE-862) in the Elasticsearch custom inference service ca... |
high | 7.1 | — | Elastic / elasticsearch | 2026-09-01 | 2026-09-02 |
| CVE-2026-72649 Deserialization of Untrusted Data (CWE-502) in the Elasticsearch machine learnin... |
high | 8.8 | — | Elastic / elasticsearch | 2026-09-01 | 2026-09-02 |
| CVE-2026-19806 The Support Genix – Helpdesk, AI Chatbot, Knowledge Base & Customer Support Tick... |
high | 8.8 | — | — | 2026-09-01 | 2026-09-02 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.