September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,290
Critical
1,223
High
4,344
Medium
4,103
Low
460
Severity not reported
1,160
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-76432 A vulnerability in the web-based management interface of Cisco ISE and Cisco ISE... |
medium | 4.9 | — | Cisco / identity services engine | 2026-09-16 | 2026-09-28 |
| CVE-2026-76431 A vulnerability in the file management function of the web-based management inte... |
medium | 4.9 | — | Cisco / identity services engine | 2026-09-16 | 2026-09-28 |
| CVE-2026-76434 A vulnerability in the certificate import functionality of the web-based managem... |
medium | 4.9 | — | Cisco / identity services engine | 2026-09-16 | 2026-09-28 |
| CVE-2026-77266 MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (C... |
medium | 6.5 | — | Mcp-atlassian / mcp atlassian | 2026-09-22 | 2026-09-28 |
| CVE-2026-76439 A vulnerability in the endpoint posture status reporting functionality of the gu... |
medium | 5.3 | — | Cisco / identity services engine | 2026-09-16 | 2026-09-28 |
| CVE-2026-76446 A vulnerability in an API of Cisco ISE and Cisco ISE-PIC could allow an authenti... |
medium | 4.9 | — | Cisco / identity services engine | 2026-09-16 | 2026-09-28 |
| CVE-2026-76428 A vulnerability in the REST APIs of Cisco ISE and Cisco ISE-PIC could allow an a... |
medium | 4.9 | — | Cisco / identity services engine | 2026-09-16 | 2026-09-28 |
| CVE-2026-77272 MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (C... |
medium | 6.1 | — | Mcp-atlassian / mcp atlassian | 2026-09-22 | 2026-09-28 |
| CVE-2026-76447 A vulnerability in the Online Certificate Status Protocol (OCSP) responder of Ci... |
medium | 5.3 | — | Cisco / identity services engine passive identity connector | 2026-09-16 | 2026-09-28 |
| CVE-2026-76444 A vulnerability in an internal service of Cisco ISE and Cisco ISE-PIC could allo... |
medium | 5.3 | — | Cisco / identity services engine passive identity connector | 2026-09-16 | 2026-09-28 |
| CVE-2026-76449 A vulnerability in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Id... |
medium | 4.9 | — | Cisco / identity services engine | 2026-09-16 | 2026-09-28 |
| CVE-2026-76450 A vulnerability in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Id... |
medium | 4.9 | — | Cisco / identity services engine | 2026-09-16 | 2026-09-28 |
| CVE-2026-76451 A vulnerability in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Id... |
medium | 4.9 | — | Cisco / identity services engine passive identity connector | 2026-09-16 | 2026-09-28 |
| CVE-2026-76448 A vulnerability in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Id... |
medium | 4.9 | — | Cisco / identity services engine | 2026-09-16 | 2026-09-28 |
| CVE-2026-76427 A vulnerability in the offline profiler feed service of Cisco ISE could allow an... |
medium | 4.9 | — | Cisco / identity services engine | 2026-09-16 | 2026-09-28 |
| CVE-2026-76426 A vulnerability in the REST API of Cisco ISE and Cisco ISE-PIC could allow an au... |
medium | 4.9 | — | Cisco / identity services engine | 2026-09-16 | 2026-09-28 |
| CVE-2026-96276 If a malicious SDK container declares an extension point with a crafted `directo... |
medium | 6.5 | — | — | 2026-09-23 | 2026-09-27 |
| CVE-2026-97176 A flaw was found in the Level of Authentication enforcement mechanism of Keycloa... |
medium | 4.2 | — | — | 2026-09-24 | 2026-09-26 |
| CVE-2026-96807 In Flatpak before 1.18.1, a malicious sandboxed app can replace ~/.var/app/$appi... |
medium | 4.0 | — | — | 2026-09-23 | 2026-09-26 |
| CVE-2026-97155 Fabasoft Folio Client before 2026, a locally installed component that communicat... |
medium | 6.5 | — | — | 2026-09-24 | 2026-09-26 |
| CVE-2026-96446 A flaw was found in the Pushed Authorization Request PAR implementation of Keycl... |
medium | 4.2 | — | — | 2026-09-23 | 2026-09-26 |
| CVE-2026-96448 A flaw was found in the Fine-Grained Admin Permissions (FGAP v2) feature of Keyc... |
medium | 6.6 | — | — | 2026-09-25 | 2026-09-26 |
| CVE-2026-92680 Araxis Merge for Windows version 2011.4074 through 2026.0 stores user-configured... |
medium | 5.5 | — | — | 2026-09-24 | 2026-09-26 |
| CVE-2026-88840 BusyBox TLS get_client_hello() reads past the end of the input buffer when parsi... |
medium | 5.3 | — | — | 2026-09-23 | 2026-09-26 |
| CVE-2026-84724 An argument-injection flaw was found in the Ansible Automation Platform automati... |
medium | 6.6 | — | — | 2026-09-23 | 2026-09-26 |
| CVE-2026-84717 A flaw was found in the Ansible Automation Platform automation-controller. |
medium | 5.3 | — | — | 2026-09-23 | 2026-09-26 |
| CVE-2026-100710 Froxlor through 2.3.10 does not filter sensitive columns from API responses: Dom... |
medium | 4.9 | — | — | 2026-09-26 | 2026-09-26 |
| CVE-2026-100719 Froxlor versions before 2.3.12 contain a credential disclosure vulnerability in... |
medium | 6.5 | — | — | 2026-09-26 | 2026-09-26 |
| CVE-2026-95811 Lemonldap::NG::Handler versions from 2.0.0 before 2.16.10, from 2.17.0 before 2.... |
medium | 6.5 | — | — | 2026-09-25 | 2026-09-26 |
| CVE-2026-81945 PLANET IGS-5225-8P2T4S industrial managed switch V1 and V2 firmware versions bef... |
medium | 6.6 | — | — | 2026-09-18 | 2026-09-26 |
| CVE-2026-67279 Mikrotik RouterOS Improper Enforcement of Behavioral Workflow Vulnerability |
medium | 6.5 | Listed | MikroTik / RouterOS | 2026-09-05 | 2026-09-26 |
| CVE-2026-95829 A vulnerability was identified in TDuckCloud tduck-platform up to 5.3. |
medium | 6.3 | — | — | 2026-09-23 | 2026-09-26 |
| CVE-2026-95929 A weakness has been identified in iFlytek astron-agent up to 1.0.7. |
medium | 6.3 | — | — | 2026-09-23 | 2026-09-26 |
| CVE-2026-96258 A vulnerability has been found in onSite internet GmbH Auktion NG Auktionssoftwa... |
medium | 4.3 | — | — | 2026-09-23 | 2026-09-26 |
| CVE-2026-84396 InDesign Desktop is affected by a NULL Pointer Dereference vulnerability that co... |
medium | 5.5 | — | — | 2026-09-22 | 2026-09-26 |
| CVE-2026-83805 Nautobot is a Network Source of Truth and Network Automation Platform. |
medium | 6.4 | — | — | 2026-09-22 | 2026-09-26 |
| CVE-2026-95813 e621ng versions before 26.09.16 pass untrusted request parameters directly to Ra... |
medium | 6.1 | — | — | 2026-09-22 | 2026-09-26 |
| CVE-2026-63386 js-toml is a TOML parser for JavaScript. |
medium | 5.3 | — | — | 2026-09-22 | 2026-09-26 |
| CVE-2026-57576 plone.app.dexterity is a content-type system for the Plone content management sy... |
medium | 6.5 | — | — | 2026-09-22 | 2026-09-26 |
| CVE-2026-93343 MarketKing plugin for WordPress before 2.1.72 contains a missing authorization v... |
medium | 6.5 | — | — | 2026-09-22 | 2026-09-26 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.