September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,290
Critical
1,223
High
4,344
Medium
4,103
Low
460
Severity not reported
1,160
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-51768 Incorrect access control in the setElinkQosConfig function of TOTOLINK T6 4.1.5c... |
high | 7.5 | — | — | 2026-09-01 | 2026-09-02 |
| CVE-2026-73710 Vulnerabilities in an API endpoint of HPE Networking Fabric Composer could allow... |
high | 8.2 | — | Arubanetworks / fabric composer | 2026-09-01 | 2026-09-02 |
| CVE-2026-84796 Craft CMS versions before 5.10.11 contain a site scope bypass vulnerability in G... |
high | 8.8 | — | — | 2026-09-02 | 2026-09-02 |
| CVE-2026-84798 Craft CMS versions >= 5.0.0-RC1 and < 5.10.11 fail to perform an independent aut... |
high | 7.1 | — | — | 2026-09-02 | 2026-09-02 |
| CVE-2026-84801 Craft CMS versions before 5.10.11 fail to validate admin status in the actionGet... |
high | 8.8 | — | — | 2026-09-02 | 2026-09-02 |
| CVE-2026-84770 Unauthenticated Cross Site Request Forgery (CSRF) in Mang Board WP <= 2.3.8 vers... |
high | 8.8 | — | — | 2026-09-02 | 2026-09-02 |
| CVE-2026-81288 Unauthenticated Cross Site Scripting (XSS) in Upsell Order Bump Offer for WooCom... |
high | 7.1 | — | — | 2026-09-02 | 2026-09-02 |
| CVE-2026-81770 Unauthenticated Cross Site Scripting (XSS) in Interactive Geo Maps <= 1.6.30 ver... |
high | 7.1 | — | — | 2026-09-02 | 2026-09-02 |
| CVE-2026-73722 Command injection vulnerabilities in the web-based management interface of HPE N... |
high | 7.2 | — | Arubanetworks / fabric composer | 2026-09-01 | 2026-09-02 |
| CVE-2026-73723 A privilege escalation vulnerability exists in the web-based management interfac... |
high | 7.1 | — | Arubanetworks / fabric composer | 2026-09-01 | 2026-09-02 |
| CVE-2026-73724 Privilege escalation vulnerabilities exist in the API of HPE Networking Fabric C... |
high | 7.1 | — | Arubanetworks / fabric composer | 2026-09-01 | 2026-09-02 |
| CVE-2026-73725 A local privilege-escalation vulnerability has been discovered in HPE Networking... |
high | 7.0 | — | Arubanetworks / fabric composer | 2026-09-01 | 2026-09-02 |
| CVE-2026-73704 A command sanitization bypass exists in the API of HPE Networking Fabric Compose... |
high | 8.8 | — | Arubanetworks / fabric composer | 2026-09-01 | 2026-09-02 |
| CVE-2026-73705 An arbitrary file write vulnerability in the API of HPE Networking Fabric Compos... |
high | 8.8 | — | Arubanetworks / fabric composer | 2026-09-01 | 2026-09-02 |
| CVE-2026-73706 A vulnerability in the API of HPE Networking Fabric Composer could allow an unau... |
high | 8.6 | — | Arubanetworks / fabric composer | 2026-09-01 | 2026-09-02 |
| CVE-2026-73707 Privilege escalation vulnerabilities exist in the API of HPE Networking Fabric C... |
high | 8.5 | — | Arubanetworks / fabric composer | 2026-09-01 | 2026-09-02 |
| CVE-2026-73708 A business logic vulnerability exists in the API of HPE Networking Fabric Compos... |
high | 8.3 | — | Arubanetworks / fabric composer | 2026-09-01 | 2026-09-02 |
| CVE-2026-73718 A vulnerability in the web-based management interface of HPE Networking Fabric C... |
high | 7.4 | — | Arubanetworks / fabric composer | 2026-09-01 | 2026-09-02 |
| CVE-2026-73719 An arbitrary file write vulnerability exists in the API of HPE Networking Fabric... |
high | 7.2 | — | Arubanetworks / fabric composer | 2026-09-01 | 2026-09-02 |
| CVE-2026-73720 Insecure file operations in the API of HPE Networking Fabric Composer could allo... |
high | 7.2 | — | Arubanetworks / fabric composer | 2026-09-01 | 2026-09-02 |
| CVE-2026-73721 Vulnerabilities in the API of HPE Networking Fabric Composer could allow an auth... |
high | 7.2 | — | Arubanetworks / fabric composer | 2026-09-01 | 2026-09-02 |
| CVE-2026-73702 A privilege escalation vulnerability exists in the API of HPE Networking Fabric... |
high | 8.8 | — | Arubanetworks / fabric composer | 2026-09-01 | 2026-09-02 |
| CVE-2026-73703 A vulnerability in the web-based management interface of HPE Networking Fabric C... |
high | 8.8 | — | Arubanetworks / fabric composer | 2026-09-01 | 2026-09-02 |
| CVE-2026-51956 A Broken Object Level Authorization vulnerability exists in Grashjs Atlas CMMS p... |
high | 8.1 | — | — | 2026-09-01 | 2026-09-02 |
| CVE-2026-19592 OpenAI Codex CLI for Windows, macOS, and Linux and Codex Desktop for Windows and... |
high | 7.3 | — | — | 2026-09-01 | 2026-09-02 |
| CVE-2026-14357 The DevKit Pro plugin for WordPress is vulnerable to Missing Authorization in ve... |
high | 8.8 | — | — | 2026-09-02 | 2026-09-02 |
| CVE-2026-73711 A privilege escalation vulnerability exists in the API endpoint of HPE Networkin... |
high | 8.1 | — | Arubanetworks / fabric composer | 2026-09-01 | 2026-09-02 |
| CVE-2026-73713 Local privilege-escalation vulnerabilities have been discovered in HPE Networkin... |
high | 7.8 | — | Arubanetworks / fabric composer | 2026-09-01 | 2026-09-02 |
| CVE-2026-73714 A sensitive information disclosure vulnerability exists in the API of HPE Networ... |
high | 7.6 | — | Arubanetworks / fabric composer | 2026-09-01 | 2026-09-02 |
| CVE-2026-73715 A vulnerability in the API of HPE Networking Fabric Composer could allow an unau... |
high | 7.5 | — | Arubanetworks / fabric composer | 2026-09-01 | 2026-09-02 |
| CVE-2026-73709 A vulnerability in the underlying operating system of HPE Networking Fabric Comp... |
high | 8.3 | — | Arubanetworks / fabric composer | 2026-09-01 | 2026-09-02 |
| CVE-2026-84123 Privilege escalation due to use-after-free in the Graphics: WebGPU component. |
high | 8.8 | — | Mozilla / firefox | 2026-09-01 | 2026-09-02 |
| CVE-2026-78592 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (... |
high | 7.3 | — | Elastic / kibana | 2026-09-01 | 2026-09-02 |
| CVE-2026-63137 Incorrect Authorization (CWE-863) in Kibana can lead to privilege escalation via... |
high | 8.3 | — | Elastic / kibana | 2026-09-01 | 2026-09-02 |
| CVE-2026-84800 Craft CMS versions >= 5.0.0-RC1 and < 5.10.11 contain a missing authorization vu... |
high | 7.1 | — | — | 2026-09-02 | 2026-09-02 |
| CVE-2026-75528 The Broken Link Checker plugin for WordPress is vulnerable to Stored Cross-Site... |
high | 7.2 | — | — | 2026-09-02 | 2026-09-02 |
| CVE-2026-81283 Subscriber PHP Object Injection in WP User Frontend <= 4.3.10 versions. |
high | 8.8 | — | — | 2026-09-02 | 2026-09-02 |
| CVE-2026-81289 Unauthenticated Cross Site Scripting (XSS) in MP3 Audio Player for Music, Radio... |
high | 7.1 | — | — | 2026-09-02 | 2026-09-02 |
| CVE-2026-81771 Unauthenticated Cross Site Scripting (XSS) in TrustedSite <= 1.2.5 versions. |
high | 7.1 | — | — | 2026-09-02 | 2026-09-02 |
| CVE-2026-61760 NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a... |
high | 7.8 | — | Nvidia / nemo megatron bridge | 2026-09-01 | 2026-09-02 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.