September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,321
Critical
1,226
High
4,361
Medium
4,108
Low
460
Severity not reported
1,166
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (964), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-92944 vm2 versions 3.10.2 through 3.11.6 contain a sandbox escape vulnerability on Nod... |
critical | 9.8 | — | — | 2026-09-17 | 2026-09-19 |
| CVE-2026-92860 A security flaw has been discovered in rcourtman Pulse up to 6.0.4/6.1.0-rc.4. |
critical | 9.1 | — | — | 2026-09-17 | 2026-09-19 |
| CVE-2026-87796 The Multi Uploader for Gravity Forms plugin for WordPress is vulnerable to Arbit... |
critical | 9.8 | — | — | 2026-09-17 | 2026-09-19 |
| CVE-2026-62104 Unauthenticated Remote Code Execution (RCE) in Migratico Lite <= 2.6.8 versions. |
critical | 10.0 | — | — | 2026-09-17 | 2026-09-19 |
| CVE-2026-75513 Marten is a .NET Transactional Document DB and Event Store on PostgreSQL. |
critical | 9.1 | — | — | 2026-09-16 | 2026-09-19 |
| CVE-2026-92953 vm2 versions from 3.11.0 before 3.11.8 fail to protect host TypedArray and Array... |
critical | 10.0 | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-92937 vm2 3.11.6 is vulnerable to a sandbox escape leading to remote code execution in... |
critical | 10.0 | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-92948 vm2 versions >= 3.9.6 and <= 3.11.6 are affected by a NodeVM builtin allowlist b... |
critical | 9.9 | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-54767 WeGIA is a web manager for charitable institutions. |
critical | 9.1 | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-20331 As part of Cisco's ongoing commitment to proactive security and product quality,... |
critical | 9.6 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-20332 As part of Cisco's ongoing commitment to proactive security and product quality,... |
critical | 9.9 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-20329 As part of Cisco's ongoing commitment to proactive security and product quality,... |
critical | 9.9 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-20330 As part of Cisco's ongoing commitment to proactive security and product quality,... |
critical | 9.9 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-13684 An improper encoding or escaping of output vulnerability in SCGI in Synology Dis... |
critical | 9.8 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-13639 An insufficient entropy vulnerability in login logic in Synology DiskStation Man... |
critical | 9.8 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-66890 The affected products use hard-coded credentials, which could allow remote acces... |
critical | 9.6 | — | — | 2026-09-15 | 2026-09-18 |
| CVE-2026-66887 The affected products are missing authorization on state-changing CGIs and sessi... |
critical | 9.6 | — | — | 2026-09-15 | 2026-09-18 |
| CVE-2026-73807 The mySCADA myPRO Manager command API does not properly enforce authentication f... |
critical | 9.8 | — | — | 2026-09-15 | 2026-09-18 |
| CVE-2026-91843 A stack overflow during the unauthenticated login process may allow an attacker... |
critical | 9.8 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-90898 Bifrost registers MCP clients through its management API. |
critical | 9.8 | — | — | 2026-09-14 | 2026-09-18 |
| CVE-2026-80462 A vulnerability in the Chef Automate API gateway and identity validation path ma... |
critical | 10.0 | — | — | 2026-09-11 | 2026-09-18 |
| CVE-2026-90822 FatPipe MPVPN, WARP, and IPVPN appliances running the end-of-life firmware versi... |
critical | 9.8 | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-90823 FatPipe MPVPN, WARP, and IPVPN appliances running the end-of-life firmware versi... |
critical | 9.8 | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-18119 Concrete CMS below 9.5.3 did not sanitize custom style values in the Block Desig... |
critical | 9.0 | — | Concretecms / concrete cms | 2026-09-14 | 2026-09-18 |
| CVE-2026-93467 The OAKlouds developed by HGiga has a Insecure Deserialization vulnerability. |
critical | 9.8 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-19773 libwebsockets HTTP/2 HPACK Path Header Parsing Out-Of-Bounds Write Remote Code E... |
critical | 9.8 | — | — | 2026-09-15 | 2026-09-18 |
| CVE-2026-86707 The Private Feed Key WordPress plugin through 0.1 does not verify that the key u... |
critical | 9.8 | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-86709 The Pressengine WordPress plugin through 1.0 does not stop its login handler fro... |
critical | 9.8 | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-86710 The Login with QR WordPress plugin through 1.0.0 does not verify that the code u... |
critical | 9.8 | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-88795 The wpShopGermany IT-RECHT KANZLEI WordPress plugin before 2.4 does not generate... |
critical | 9.0 | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-84738 The AF Companion WordPress plugin before 2.2.0 does not validate the type of fil... |
critical | 9.1 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-75031 In the interchange/interchange project, a critical remote code execution (RCE) v... |
critical | 9.8 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-86426 LibreNMS before 26.8.0 contains an authentication bypass vulnerability in the RE... |
critical | 9.8 | — | Librenms / librenms | 2026-09-07 | 2026-09-18 |
| CVE-2026-93606 vm2 (npm) versions 3.12.0 and earlier contain a sandbox escape in `VM` and `Node... |
critical | 10.0 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-93019 Imager versions before 1.036 for Perl exit the process reading a TGA with a colo... |
critical | 9.1 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-86184 Lara Dashboard before 1.3.0 contains an authentication bypass vulnerability in t... |
critical | 9.8 | — | — | 2026-09-05 | 2026-09-18 |
| CVE-2026-86189 WWBN AVideo contains a path traversal vulnerability in notify.ffmpeg.json.php th... |
critical | 9.8 | — | — | 2026-09-05 | 2026-09-18 |
| CVE-2026-12744 A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM bef... |
critical | 9.8 | — | Ivanti / neurons for itsm | 2026-09-08 | 2026-09-18 |
| CVE-2026-12745 A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM bef... |
critical | 9.8 | — | Ivanti / neurons for itsm | 2026-09-08 | 2026-09-18 |
| CVE-2026-90999 Sentry Seer is vulnerable to a multi-stage trust-boundary violation that allows... |
critical | 9.8 | — | — | 2026-09-16 | 2026-09-18 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.