September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,321
Critical
1,226
High
4,361
Medium
4,108
Low
460
Severity not reported
1,166
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (964), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-73953 Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware... |
critical | 9.8 | — | Oracle / webcenter portal | 2026-09-15 | 2026-09-22 |
| CVE-2026-73956 Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware... |
critical | 9.8 | — | Oracle / webcenter portal | 2026-09-15 | 2026-09-22 |
| CVE-2026-73957 Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware... |
critical | 9.3 | — | Oracle / webcenter portal | 2026-09-15 | 2026-09-22 |
| CVE-2026-90817 An unauthenticated Remote Code Execution vulnerability was found in the survey p... |
critical | 9.8 | — | — | 2026-09-20 | 2026-09-22 |
| CVE-2026-94456 Postiz generates security-sensitive credentials using `Math.random()` instead of... |
critical | 9.1 | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-75878 IBM Sterling File Gateway could allow a remote attacker to bypass authentication... |
critical | 9.1 | — | — | 2026-09-18 | 2026-09-22 |
| CVE-2026-93088 SGLang's multimodal generation runtime is vulnerable to unauthenticated arbitrar... |
critical | 9.8 | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-73639 Imager::File::PNG versions from 1.003 before 1.004 for Perl write past the end o... |
critical | 9.1 | — | — | 2026-09-17 | 2026-09-22 |
| CVE-2026-83006 Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusio... |
critical | 9.1 | — | Oracle / webcenter enterprise capture | 2026-09-15 | 2026-09-22 |
| CVE-2026-83027 Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion... |
critical | 9.3 | — | Oracle / identity manager connector | 2026-09-15 | 2026-09-22 |
| CVE-2026-83042 Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware... |
critical | 9.8 | — | Oracle / identity manager | 2026-09-15 | 2026-09-22 |
| CVE-2026-83054 Vulnerability in the Oracle Internet Directory product of Oracle Fusion Middlewa... |
critical | 9.8 | — | Oracle / internet directory | 2026-09-15 | 2026-09-22 |
| CVE-2026-83059 Vulnerability in the Oracle Internet Directory product of Oracle Fusion Middlewa... |
critical | 10.0 | — | Oracle / internet directory | 2026-09-15 | 2026-09-22 |
| CVE-2026-83060 Vulnerability in the Oracle Internet Directory product of Oracle Fusion Middlewa... |
critical | 9.8 | — | Oracle / internet directory | 2026-09-15 | 2026-09-22 |
| CVE-2026-83061 Vulnerability in the Oracle Internet Directory product of Oracle Fusion Middlewa... |
critical | 9.8 | — | Oracle / internet directory | 2026-09-15 | 2026-09-22 |
| CVE-2026-83062 Vulnerability in the Oracle Internet Directory product of Oracle Fusion Middlewa... |
critical | 9.8 | — | Oracle / internet directory | 2026-09-15 | 2026-09-22 |
| CVE-2026-83066 Vulnerability in the Oracle Internet Directory product of Oracle Fusion Middlewa... |
critical | 9.8 | — | Oracle / internet directory | 2026-09-15 | 2026-09-22 |
| CVE-2026-78030 DBI versions before 1.653 for Perl load arbitrary modules via unvalidated dbm_ty... |
critical | 9.8 | — | — | 2026-09-19 | 2026-09-22 |
| CVE-2016-15059 Net::IDN::Punycode versions before 2.301 for Perl allow a heap buffer overflow v... |
critical | 9.8 | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-87078 Net::IDN::Punycode versions from 2.302 before 2.590 for Perl leak the output buf... |
critical | 9.1 | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-87080 Net::IDN::Punycode::PP versions before 2.590 for Perl decode a truncated label t... |
critical | 9.1 | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-12718 Improper neutralization of special elements used in an SQL command ('SQL injecti... |
critical | 9.8 | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-13355 The Meta Box AIO plugin for WordPress is vulnerable to Privilege Escalation to A... |
critical | 9.8 | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-19658 The Give Tributes plugin for WordPress is vulnerable to PHP Object Injection in... |
critical | 9.8 | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-81642 In NLnet Labs Unbound up to and including 1.26.0, a vulnerability was found in t... |
critical | 9.8 | — | Nlnetlabs / unbound | 2026-09-16 | 2026-09-22 |
| CVE-2026-87184 Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hype... |
critical | 9.8 | — | Oracle / hyperion financial management | 2026-09-15 | 2026-09-22 |
| CVE-2026-86059 Dokploy is a free, self-hostable Platform as a Service (PaaS). |
critical | 9.6 | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-85734 LightRAG provides simple and fast retrieval-augmented generation. |
critical | 9.1 | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-4374 Improper Restriction of XML External Entity Reference vulnerability in RTI Conne... |
critical | 9.1 | — | Rti / connext professional | 2026-04-01 | 2026-09-22 |
| CVE-2026-87129 Vulnerability in the Oracle Hyperion Data Relationship Management product of Ora... |
critical | 9.1 | — | Oracle / hyperion data relationship management | 2026-09-15 | 2026-09-22 |
| CVE-2026-89040 Tencent Mass Service Engine in Cluster (MSEC) allows a remote, unauthenticated a... |
critical | 9.8 | — | — | 2026-09-15 | 2026-09-22 |
| CVE-2026-87223 Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hype... |
critical | 9.1 | — | Oracle / hyperion financial management | 2026-09-15 | 2026-09-22 |
| CVE-2026-87170 Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hype... |
critical | 9.1 | — | Oracle / hyperion financial management | 2026-09-15 | 2026-09-22 |
| CVE-2026-87172 Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hype... |
critical | 9.9 | — | Oracle / hyperion financial management | 2026-09-15 | 2026-09-22 |
| CVE-2026-87173 Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hype... |
critical | 9.1 | — | Oracle / hyperion financial management | 2026-09-15 | 2026-09-22 |
| CVE-2026-87175 Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hype... |
critical | 9.1 | — | Oracle / hyperion financial management | 2026-09-15 | 2026-09-22 |
| CVE-2026-87176 Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hype... |
critical | 9.1 | — | Oracle / hyperion financial management | 2026-09-15 | 2026-09-22 |
| CVE-2026-87186 Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hype... |
critical | 9.6 | — | Oracle / hyperion financial management | 2026-09-15 | 2026-09-22 |
| CVE-2026-87188 Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hype... |
critical | 9.8 | — | Oracle / hyperion financial management | 2026-09-15 | 2026-09-22 |
| CVE-2026-87189 Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hype... |
critical | 9.1 | — | Oracle / hyperion financial management | 2026-09-15 | 2026-09-22 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.