September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,364
Critical
1,230
High
4,374
Medium
4,126
Low
462
Severity not reported
1,172
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (964), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-94099 A security flaw has been discovered in Netcore NBR200V2 1.3.241127.071246. |
critical | 9.9 | — | — | 2026-09-21 | 2026-09-22 |
| CVE-2026-94089 A vulnerability was determined in D-Link DIR-868L 2.01b05. |
critical | 10.0 | — | — | 2026-09-20 | 2026-09-22 |
| CVE-2026-93738 A vulnerability was found in Totolink A3002MU Hh-B20211125.1046. |
critical | 9.9 | — | — | 2026-09-18 | 2026-09-22 |
| CVE-2026-93741 A security flaw has been discovered in Totolink A3002MU Hh-B20211125.1046. |
critical | 10.0 | — | — | 2026-09-19 | 2026-09-22 |
| CVE-2026-79916 MaxKB is an open-source AI assistant for enterprise. |
critical | 9.1 | — | — | 2026-09-21 | 2026-09-22 |
| CVE-2026-93603 vm2 through 3.12.0 (fixed in 3.12.1) does not correctly handle a nullish `this`... |
critical | 10.0 | — | — | 2026-09-18 | 2026-09-22 |
| CVE-2026-77521 MaxKB is an open-source AI assistant for enterprise. |
critical | 10.0 | — | — | 2026-09-21 | 2026-09-22 |
| CVE-2026-69641 Missing authorization in Microsoft Exchange Server allows an authorized attacker... |
critical | 9.1 | — | Microsoft / exchange server | 2026-09-08 | 2026-09-22 |
| CVE-2026-94301 The fix for CVE-2026-47065/ZDRES-232 ("resolveProxyClass Not Overridden - accept... |
critical | 9.8 | — | — | 2026-09-21 | 2026-09-22 |
| CVE-2026-83283 Vulnerability in the Oracle Business Intelligence Enterprise Edition product of... |
critical | 9.8 | — | — | 2026-09-15 | 2026-09-22 |
| CVE-2026-83269 Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component:... |
critical | 9.8 | — | — | 2026-09-15 | 2026-09-22 |
| CVE-2026-93605 vm2 NodeVM versions before 3.12.1 contain a sandbox escape vulnerability where t... |
critical | 10.0 | — | — | 2026-09-18 | 2026-09-21 |
| CVE-2024-40766 SonicWall SonicOS Improper Access Control Vulnerability |
critical | 9.8 | Listed | SonicWall / SonicOS | 2024-08-23 | 2026-09-21 |
| CVE-2026-94095 A vulnerability has been found in Netcore NBR200V2 1.3.241127.071246. |
critical | 9.9 | — | — | 2026-09-21 | 2026-09-21 |
| CVE-2026-94100 A weakness has been identified in Netcore NBR200V2 1.3.241127.071246. |
critical | 9.9 | — | — | 2026-09-21 | 2026-09-21 |
| CVE-2026-2771 Undefined behavior in the DOM: Core & HTML component. |
critical | 9.8 | — | Mozilla / firefox | 2026-02-24 | 2026-09-21 |
| CVE-2026-93958 A vulnerability was found in D-Link R95 BE9500_1.00.16. |
critical | 9.1 | — | — | 2026-09-20 | 2026-09-21 |
| CVE-2026-93742 A weakness has been identified in Totolink A3002MU Hh-B20211125.1046. |
critical | 9.9 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-85497 CareCam CM2507 IP cameras store the device's root-account password using a fixed... |
critical | 9.8 | — | — | 2026-09-18 | 2026-09-21 |
| CVE-2026-69586 Integer overflow or wraparound in Microsoft Windows PDF allows an unauthorized a... |
critical | 9.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-21 |
| CVE-2026-73947 Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (... |
critical | 9.8 | — | Oracle / access manager | 2026-09-15 | 2026-09-21 |
| CVE-2026-73950 Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (... |
critical | 9.8 | — | Oracle / access manager | 2026-09-15 | 2026-09-21 |
| CVE-2026-73962 Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (... |
critical | 9.6 | — | Oracle / access manager | 2026-09-15 | 2026-09-21 |
| CVE-2026-73963 Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware... |
critical | 9.8 | — | Oracle / webcenter portal | 2026-09-15 | 2026-09-21 |
| CVE-2026-83001 Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (... |
critical | 9.1 | — | Oracle / access manager | 2026-09-15 | 2026-09-21 |
| CVE-2026-83043 Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware... |
critical | 9.6 | — | Oracle / webcenter portal | 2026-09-15 | 2026-09-21 |
| CVE-2026-83339 Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusio... |
critical | 9.8 | — | Oracle / webcenter enterprise capture | 2026-09-15 | 2026-09-21 |
| CVE-2026-87128 Vulnerability in the Oracle Hyperion Data Relationship Management product of Ora... |
critical | 9.1 | — | Oracle / hyperion data relationship management | 2026-09-15 | 2026-09-21 |
| CVE-2026-71133 Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (... |
critical | 10.0 | — | Oracle / access manager | 2026-09-15 | 2026-09-21 |
| CVE-2026-71163 Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (... |
critical | 9.9 | — | Oracle / access manager | 2026-09-15 | 2026-09-21 |
| CVE-2026-73940 Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (... |
critical | 9.8 | — | Oracle / access manager | 2026-09-15 | 2026-09-21 |
| CVE-2026-73944 Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (... |
critical | 9.1 | — | Oracle / access manager | 2026-09-15 | 2026-09-21 |
| CVE-2026-73948 Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware... |
critical | 9.9 | — | Oracle / webcenter portal | 2026-09-15 | 2026-09-21 |
| CVE-2026-73946 Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (... |
critical | 9.1 | — | Oracle / access manager | 2026-09-15 | 2026-09-21 |
| CVE-2026-73945 Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (... |
critical | 9.9 | — | Oracle / access manager | 2026-09-15 | 2026-09-21 |
| CVE-2026-85385 Concrete CMS below 9.5.4 did not validate the user timezone value (uTimezone) on... |
critical | 9.6 | — | Concretecms / concrete cms | 2026-09-16 | 2026-09-21 |
| CVE-2026-81236 Dell Wyse Management Suite, versions prior to 2605.0.3.683, contain an Unrestric... |
critical | 9.8 | — | Dell / wyse management suite | 2026-09-15 | 2026-09-21 |
| CVE-2026-81238 Dell Wyse Management Suite, versions prior to 2605.0.3.683, contain a Missing Au... |
critical | 9.1 | — | Dell / wyse management suite | 2026-09-15 | 2026-09-21 |
| CVE-2026-81239 Dell Wyse Management Suite, versions prior to 2605.0.3.683, contain an Unrestric... |
critical | 9.8 | — | Dell / wyse management suite | 2026-09-15 | 2026-09-21 |
| CVE-2026-81240 Dell Wyse Management Suite, versions prior to 2605.0.3.683, contain an Unrestric... |
critical | 9.8 | — | Dell / wyse management suite | 2026-09-15 | 2026-09-21 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.