September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,321
Critical
1,226
High
4,361
Medium
4,108
Low
460
Severity not reported
1,166
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (964), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-70416 Dell ObjectScale, versions prior to 4.4.0.0, contains a Deserialization of Untru... |
critical | 9.8 | — | Dell / objectscale | 2026-09-16 | 2026-09-21 |
| CVE-2026-91097 HP has identified and remediated multiple externally reported vulnerabilities wi... |
critical | 9.8 | — | Hp / linux imaging and printing | 2026-09-16 | 2026-09-21 |
| CVE-2026-91098 HP has identified and remediated multiple externally reported vulnerabilities wi... |
critical | 9.8 | — | Hp / linux imaging and printing | 2026-09-16 | 2026-09-21 |
| CVE-2026-91099 HP has identified and remediated multiple externally reported vulnerabilities wi... |
critical | 9.8 | — | Hp / linux imaging and printing | 2026-09-16 | 2026-09-21 |
| CVE-2026-91100 HP has identified and remediated multiple externally reported vulnerabilities wi... |
critical | 9.8 | — | Hp / linux imaging and printing | 2026-09-16 | 2026-09-21 |
| CVE-2026-91101 HP has identified and remediated multiple externally reported vulnerabilities wi... |
critical | 9.8 | — | Hp / linux imaging and printing | 2026-09-16 | 2026-09-21 |
| CVE-2026-91102 HP has identified and remediated multiple externally reported vulnerabilities wi... |
critical | 9.8 | — | Hp / linux imaging and printing | 2026-09-16 | 2026-09-21 |
| CVE-2026-91103 HP has identified and remediated multiple externally reported vulnerabilities wi... |
critical | 9.8 | — | Hp / linux imaging and printing | 2026-09-16 | 2026-09-21 |
| CVE-2026-91104 HP has identified and remediated multiple externally reported vulnerabilities wi... |
critical | 9.8 | — | Hp / linux imaging and printing | 2026-09-16 | 2026-09-21 |
| CVE-2026-91105 HP has identified and remediated multiple externally reported vulnerabilities wi... |
critical | 9.8 | — | Hp / linux imaging and printing | 2026-09-16 | 2026-09-21 |
| CVE-2026-86863 pgAdmin 4's Webserver authentication source is intended to accept an identity as... |
critical | 9.8 | — | Pgadmin / pgadmin 4 | 2026-09-17 | 2026-09-21 |
| CVE-2026-91106 HP has identified and remediated multiple externally reported vulnerabilities wi... |
critical | 9.8 | — | Hp / linux imaging and printing | 2026-09-16 | 2026-09-21 |
| CVE-2026-55366 In IP Multimedia Subsystem, there is a possible authentication bypass due to a l... |
critical | 9.8 | — | Google / android | 2026-09-15 | 2026-09-21 |
| CVE-2026-94098 A vulnerability was identified in Netcore NBR200V2 1.3.241127.071246. |
critical | 9.1 | — | — | 2026-09-21 | 2026-09-21 |
| CVE-2026-83197 Vulnerability in the Siebel Apps - Financial Services product of Oracle Siebel C... |
critical | 9.1 | — | — | 2026-09-15 | 2026-09-21 |
| CVE-2026-83149 Vulnerability in Oracle Application Testing Suite. |
critical | 9.1 | — | — | 2026-09-15 | 2026-09-21 |
| CVE-2026-56960 In multiple locations, there is a possible use-after-free due to a logic error i... |
critical | 9.8 | — | Google / android | 2026-09-15 | 2026-09-21 |
| CVE-2026-83154 Vulnerability in the Siebel CRM End User product of Oracle Siebel CRM (component... |
critical | 9.1 | — | Oracle / siebel crm | 2026-09-15 | 2026-09-21 |
| CVE-2026-83201 Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (compone... |
critical | 9.1 | — | Oracle / siebel crm | 2026-09-15 | 2026-09-21 |
| CVE-2026-83202 Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (compone... |
critical | 9.1 | — | Oracle / siebel crm | 2026-09-15 | 2026-09-21 |
| CVE-2026-93740 A vulnerability was identified in Totolink A3002MU Hh-B20211125.1046. |
critical | 10.0 | — | — | 2026-09-18 | 2026-09-21 |
| CVE-2026-93374 Use after free in Dawn in Google Chrome on on Android prior to 153.0.8010.52 all... |
critical | 9.6 | — | Google / chrome | 2026-09-17 | 2026-09-21 |
| CVE-2026-82187 The Web to Print Online Designer WordPress plugin before 2.15.0 does not validat... |
critical | 9.8 | — | — | 2026-09-21 | 2026-09-21 |
| CVE-2026-93373 Use after free in Extensions in Google Chrome prior to 153.0.8010.52 allowed a r... |
critical | 9.6 | — | Google / chrome | 2026-09-17 | 2026-09-21 |
| CVE-2026-93372 Buffer overflow in WebGL in Google Chrome on on Android prior to 153.0.8010.52 a... |
critical | 9.6 | — | Google / chrome | 2026-09-17 | 2026-09-21 |
| CVE-2024-50492 Improper Control of Generation of Code ('Code Injection') vulnerability in Scott... |
critical | 9.8 | — | Wpplugin / scottcart | 2024-10-28 | 2026-09-21 |
| CVE-2026-86591 The Botiga Pro WordPress plugin before 1.6.5 does not perform any authorisation... |
critical | 9.8 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-84434 The Gravity Forms plugin for WordPress is vulnerable to Arbitrary File Upload in... |
critical | 9.8 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-89274 The WP Recipe Maker plugin for WordPress is vulnerable to Arbitrary Shortcode Ex... |
critical | 9.1 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-92229 The The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plug... |
critical | 9.1 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-94096 A vulnerability was found in Netcore NBR200V2 1.3.241127.071246. |
critical | 9.9 | — | — | 2026-09-21 | 2026-09-21 |
| CVE-2026-94101 A security vulnerability has been detected in Netcore NBR200V2 1.3.241127.071246... |
critical | 9.9 | — | — | 2026-09-21 | 2026-09-21 |
| CVE-2026-10747 IBM MQ Appliance could allow a remote attacker to cause a denial of service or p... |
critical | 10.0 | — | — | 2026-09-18 | 2026-09-21 |
| CVE-2026-87214 Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hype... |
critical | 9.1 | — | Oracle / hyperion financial management | 2026-09-15 | 2026-09-21 |
| CVE-2026-87217 Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hype... |
critical | 9.1 | — | Oracle / hyperion financial management | 2026-09-15 | 2026-09-21 |
| CVE-2026-87230 Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hype... |
critical | 10.0 | — | Oracle / hyperion financial management | 2026-09-15 | 2026-09-21 |
| CVE-2026-81321 CM2507 IP cameras store configured wireless network credentials in cleartext wit... |
critical | 9.8 | — | — | 2026-09-18 | 2026-09-19 |
| CVE-2026-61516 Netis NX10 firmware V4.0.1.5808 and V3.0.0.4142 contain an information disclosur... |
critical | 9.8 | — | — | 2026-09-08 | 2026-09-19 |
| CVE-2026-10858 IBM MQ for HPE NonStop 8.1.0 through 8.1.0.40 could allow an authenticated attac... |
critical | 9.9 | — | — | 2026-09-18 | 2026-09-19 |
| CVE-2026-92938 vm2 versions 3.11.3 through 3.11.6 expose Node.js's host node:sqlite module to c... |
critical | 9.9 | — | — | 2026-09-17 | 2026-09-19 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.