September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,290
Critical
1,223
High
4,344
Medium
4,103
Low
460
Severity not reported
1,160
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-69449 Heap-based buffer overflow in Windows BitLocker allows an authorized attacker to... |
medium | 6.7 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-25 |
| CVE-2026-61413 Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16,... |
medium | 6.8 | — | Dell / policy manager for secure connect gateway | 2026-09-23 | 2026-09-25 |
| CVE-2026-71177 Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16,... |
medium | 5.4 | — | Dell / policy manager for secure connect gateway | 2026-09-23 | 2026-09-25 |
| CVE-2026-73586 Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16,... |
medium | 6.4 | — | Dell / policy manager for secure connect gateway | 2026-09-23 | 2026-09-25 |
| CVE-2026-73587 Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16,... |
medium | 6.8 | — | Dell / policy manager for secure connect gateway | 2026-09-23 | 2026-09-25 |
| CVE-2026-73589 Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16,... |
medium | 6.3 | — | Dell / policy manager for secure connect gateway | 2026-09-23 | 2026-09-25 |
| CVE-2026-78393 The Link Library WordPress plugin before 7.9.6 does not properly escape some par... |
medium | 6.1 | — | — | 2026-09-25 | 2026-09-25 |
| CVE-2026-78394 The Link Library WordPress plugin before 7.9.6 does not sanitize a user-supplied... |
medium | 4.1 | — | — | 2026-09-25 | 2026-09-25 |
| CVE-2026-78397 The Link Library WordPress plugin before 7.9.6 does not validate the destination... |
medium | 4.0 | — | — | 2026-09-25 | 2026-09-25 |
| CVE-2026-80514 The wpForo Forum WordPress plugin from 3.0.0 before 3.1.6 does not verify the so... |
medium | 5.3 | — | — | 2026-09-25 | 2026-09-25 |
| CVE-2026-86837 The Bookly WordPress plugin before 28.3 does not properly verify a customer's id... |
medium | 5.3 | — | — | 2026-09-25 | 2026-09-25 |
| CVE-2026-88848 The MasterStudy LMS WordPress plugin from 1.9 before 3.7.50 does not verify that... |
medium | 4.2 | — | — | 2026-09-25 | 2026-09-25 |
| CVE-2026-81508 ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. |
medium | 4.3 | — | — | 2026-09-24 | 2026-09-25 |
| CVE-2026-91867 When Neethi fetches a remote policy reference, it only limits the time per read,... |
medium | 4.3 | — | Apache / neethi | 2026-09-21 | 2026-09-25 |
| CVE-2026-92799 The Online Scheduling and Appointment Booking System – Bookly plugin for WordPre... |
medium | 5.3 | — | — | 2026-09-25 | 2026-09-25 |
| CVE-2026-96766 The GeoDirectory – WP Business Directory Plugin and Classified Listings Director... |
medium | 6.4 | — | — | 2026-09-25 | 2026-09-25 |
| CVE-2026-17577 The SSL Zen plugin for WordPress is vulnerable to Reflected Cross-Site Scripting... |
medium | 6.1 | — | — | 2026-09-25 | 2026-09-25 |
| CVE-2026-88996 The WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Surv... |
medium | 6.1 | — | — | 2026-09-25 | 2026-09-25 |
| CVE-2026-76704 A vulnerability in the web-based management interface of the EdgeConnect SD-WAN... |
medium | 5.5 | — | Arubanetworks / edgeconnect sd-wan orchestrator | 2026-09-15 | 2026-09-25 |
| CVE-2026-76706 A vulnerability in the API endpoint of HPE Networking EdgeConnect SD-WAN Orchest... |
medium | 5.3 | — | Arubanetworks / edgeconnect sd-wan orchestrator | 2026-09-15 | 2026-09-25 |
| CVE-2026-69453 Missing authorization in Microsoft Windows Search Component allows an authorized... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-25 |
| CVE-2026-93561 A flaw was found in io.netty/netty-codec-memcache. |
medium | 6.5 | — | — | 2026-09-18 | 2026-09-25 |
| CVE-2026-94532 lamp-cloud through 5.10.0 contains an authorization bypass vulnerability in the... |
medium | 6.5 | — | — | 2026-09-21 | 2026-09-24 |
| CVE-2026-88978 Hatchet is a platform for orchestrating background tasks, AI agents, and durable... |
medium | 4.3 | — | — | 2026-09-21 | 2026-09-24 |
| CVE-2026-91166 Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. |
medium | 5.7 | — | — | 2026-09-21 | 2026-09-24 |
| CVE-2026-93433 A flaw was found in libstoragemgmt. |
medium | 5.5 | — | — | 2026-09-21 | 2026-09-24 |
| CVE-2026-79918 MaxKB is an open-source AI assistant for enterprise. |
medium | 6.3 | — | — | 2026-09-21 | 2026-09-24 |
| CVE-2026-78508 Out-of-bounds read in Windows CD-ROM Driver allows an unauthorized attacker to d... |
medium | 4.6 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-78453 Integer underflow (wrap or wraparound) in Microsoft Windows SCSI Class System Fi... |
medium | 6.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-77892 No cwe for this issue in Windows Boot Manager allows an unauthorized attacker to... |
medium | 6.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-77887 Out-of-bounds read in Windows DHCP Server allows an authorized attacker to execu... |
medium | 6.4 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-77891 Out-of-bounds read in Windows DHCP Server allows an authorized attacker to execu... |
medium | 6.4 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-77561 Tinyauth is an authentication and authorization server. |
medium | 5.3 | — | — | 2026-09-21 | 2026-09-24 |
| CVE-2026-77519 MaxKB is an open-source AI assistant for enterprise. |
medium | 5.4 | — | — | 2026-09-21 | 2026-09-24 |
| CVE-2026-77522 MaxKB is an open-source AI assistant for enterprise. |
medium | 4.3 | — | — | 2026-09-21 | 2026-09-24 |
| CVE-2026-77525 MaxKB is an open-source AI assistant for enterprise. |
medium | 4.2 | — | — | 2026-09-21 | 2026-09-24 |
| CVE-2026-73019 Improper resolution of path equivalence in Windows URL Moniker allows an unautho... |
medium | 4.3 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-72985 Heap-based buffer overflow in Windows Volume Shadow Copy allows an unauthorized... |
medium | 6.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-72966 Missing authorization in Windows Remote Access Connection Manager allows an auth... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-72939 Null pointer dereference in Windows Routing and Remote Access Service (RRAS) all... |
medium | 6.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.