September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,290
Critical
1,223
High
4,344
Medium
4,103
Low
460
Severity not reported
1,160
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-85292 InvoicePlane is a self-hosted open source application for managing invoices, cli... |
medium | 4.8 | — | — | 2026-09-25 | 2026-09-28 |
| CVE-2026-85293 InvoicePlane is a self-hosted open source application for managing invoices, cli... |
medium | 4.8 | — | — | 2026-09-25 | 2026-09-28 |
| CVE-2026-77247 MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (C... |
medium | 6.5 | — | Mcp-atlassian / mcp atlassian | 2026-09-22 | 2026-09-28 |
| CVE-2026-82915 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') v... |
medium | 6.5 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-82969 Improper neutralization of input during web page generation ('cross-site scripti... |
medium | 5.4 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-87752 Improper neutralization of input during web page generation ('cross-site scripti... |
medium | 6.1 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-82326 Improper neutralization of input during web page generation ('cross-site scripti... |
medium | 4.1 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-82381 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 5.4 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-82382 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.1 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-86507 Improper neutralization of input in Apache Roller 6.1.5 allows an anonymous remo... |
medium | 6.1 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-101068 A security flaw has been discovered in dbgate up to 7.3.1. |
medium | 6.5 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-100722 vm2 before 3.12.2 does not apply host-side Promise rejection handling in the san... |
medium | 6.8 | — | — | 2026-09-27 | 2026-09-28 |
| CVE-2024-53922 An issue was discovered in the buffer queue driver in Samsung Automotive Process... |
medium | 5.7 | — | — | 2026-09-14 | 2026-09-28 |
| CVE-2024-23176 An issue was discovered in the MassMessage extension in MediaWiki before 1.40.2. |
medium | 5.4 | — | — | 2026-09-14 | 2026-09-28 |
| CVE-2024-58384 Tornado before 6.4.1 contains a CRLF injection vulnerability in CurlAsyncHTTPCli... |
medium | 5.4 | — | — | 2026-09-15 | 2026-09-28 |
| CVE-2024-38639 An improper authentication vulnerability has been reported to affect product. |
medium | 4.8 | — | — | 2026-09-18 | 2026-09-28 |
| CVE-2024-56344 IBM Cognos Analytics 12.0.4 through 12.0.4 FP2, and 12.1.0 through 12.1.3 FP1 co... |
medium | 5.9 | — | — | 2026-09-18 | 2026-09-28 |
| CVE-2026-76717 A vulnerability exists in the Analytics and Location Engine (ALE) API that may a... |
medium | 5.3 | — | Arubanetworks / analytics and location engine | 2026-09-22 | 2026-09-28 |
| CVE-2026-76716 Multiple vulnerabilities exist in the Analytics and Location Engine (ALE) that m... |
medium | 5.3 | — | Arubanetworks / analytics and location engine | 2026-09-22 | 2026-09-28 |
| CVE-2026-76698 A command injection vulnerability exists in the web-based management interface o... |
medium | 6.5 | — | Arubanetworks / edgeconnect sd-wan orchestrator | 2026-09-15 | 2026-09-28 |
| CVE-2026-76700 Vulnerabilities in HPE Networking EdgeConnect SD-WAN Gateways could allow an una... |
medium | 5.9 | — | Arubanetworks / edgeconnect sd-wan orchestrator | 2026-09-15 | 2026-09-28 |
| CVE-2026-76699 A buffer overflow vulnerability exists in a system service within the underlying... |
medium | 6.4 | — | Arubanetworks / edgeconnect sd-wan orchestrator | 2026-09-15 | 2026-09-28 |
| CVE-2026-76701 A vulnerability in the API endpoint of HPE Networking EdgeConnect SD-WAN Gateway... |
medium | 5.9 | — | Arubanetworks / edgeconnect sd-wan orchestrator | 2026-09-15 | 2026-09-28 |
| CVE-2026-76702 A vulnerability in the operating system of HPE Networking EdgeConnect SD-WAN Gat... |
medium | 5.8 | — | Arubanetworks / edgeconnect sd-wan orchestrator | 2026-09-15 | 2026-09-28 |
| CVE-2026-76703 A buffer overflow vulnerability exists in the web-based management interface of... |
medium | 5.5 | — | Arubanetworks / edgeconnect sd-wan orchestrator | 2026-09-15 | 2026-09-28 |
| CVE-2026-76707 A vulnerability in HPE Networking EdgeConnect SD-WAN Gateways could allow an una... |
medium | 4.3 | — | Arubanetworks / edgeconnect sd-wan orchestrator | 2026-09-15 | 2026-09-28 |
| CVE-2026-76705 A buffer overflow vulnerability exists in the API endpoint of HPE Networking Edg... |
medium | 5.5 | — | Arubanetworks / edgeconnect sd-wan orchestrator | 2026-09-15 | 2026-09-28 |
| CVE-2026-76697 A vulnerability in the web-based management interface of HPE Networking EdgeConn... |
medium | 6.5 | — | Arubanetworks / edgeconnect sd-wan orchestrator | 2026-09-15 | 2026-09-28 |
| CVE-2026-76696 A vulnerability in HPE Networking EdgeConnect SD-WAN Gateways could allow an una... |
medium | 6.5 | — | Arubanetworks / edgeconnect sd-wan orchestrator | 2026-09-15 | 2026-09-28 |
| CVE-2026-76695 Buffer overflow vulnerabilities exist in the underlying operating system of HPE... |
medium | 6.5 | — | Arubanetworks / edgeconnect sd-wan orchestrator | 2026-09-15 | 2026-09-28 |
| CVE-2026-76694 A privilege escalation vulnerability exists in the command line interface of HPE... |
medium | 6.6 | — | Arubanetworks / edgeconnect sd-wan orchestrator | 2026-09-15 | 2026-09-28 |
| CVE-2026-77270 MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (C... |
medium | 6.5 | — | Mcp-atlassian / mcp atlassian | 2026-09-22 | 2026-09-28 |
| CVE-2026-8030 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.0... |
medium | 4.3 | — | Gitlab / gitlab | 2026-09-16 | 2026-09-28 |
| CVE-2026-7514 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.9... |
medium | 4.3 | — | Gitlab / gitlab | 2026-09-16 | 2026-09-28 |
| CVE-2026-3855 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2.... |
medium | 6.8 | — | Gitlab / gitlab | 2026-09-16 | 2026-09-28 |
| CVE-2026-81885 radare2 is a UNIX-like reverse engineering framework and command-line toolset. |
medium | 5.5 | — | Radare / radare2 | 2026-09-22 | 2026-09-28 |
| CVE-2026-78252 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.3... |
medium | 6.1 | — | Gitlab / gitlab | 2026-09-16 | 2026-09-28 |
| CVE-2026-81886 radare2 is a UNIX-like reverse engineering framework and command-line toolset. |
medium | 5.5 | — | Radare / radare2 | 2026-09-22 | 2026-09-28 |
| CVE-2026-77256 MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (C... |
medium | 6.5 | — | Mcp-atlassian / mcp atlassian | 2026-09-22 | 2026-09-28 |
| CVE-2026-76433 A vulnerability in the client provisioning download feature of Cisco ISE and Cis... |
medium | 5.3 | — | Cisco / identity services engine | 2026-09-16 | 2026-09-28 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.