September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,290
Critical
1,223
High
4,344
Medium
4,103
Low
460
Severity not reported
1,160
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-75892 In osmo-ggsn 1.14.0 an out of bounds write issue was found in the gtp_decode_pdp... |
medium | 6.5 | — | — | 2026-09-18 | 2026-09-21 |
| CVE-2026-92949 vm2 versions from 3.9.6 before 3.11.7 fail to properly restrict access to access... |
medium | 4.0 | — | — | 2026-09-17 | 2026-09-21 |
| CVE-2026-76871 Netcore NR255-V version 1.5.130703 contains a sensitive information disclosure v... |
medium | 6.5 | — | — | 2026-09-15 | 2026-09-21 |
| CVE-2026-81925 Concrete CMS before 9.5.3 improperly neutralized a user-supplied custom date for... |
medium | 6.1 | — | Concretecms / concrete cms | 2026-09-15 | 2026-09-21 |
| CVE-2026-18426 Concrete CMS 9.0.0 through 9.5.2 did not enforce a block-level edit-permission c... |
medium | 6.5 | — | Concretecms / concrete cms | 2026-09-15 | 2026-09-21 |
| CVE-2026-81926 Concrete CMS 9.4.0 through 9.5.2 did not escape colliding page paths before rend... |
medium | 6.1 | — | Concretecms / concrete cms | 2026-09-15 | 2026-09-21 |
| CVE-2026-85386 Concrete CMS before 9.5.4 did not sanitize XML and XSLT documents uploaded throu... |
medium | 6.1 | — | Concretecms / concrete cms | 2026-09-16 | 2026-09-21 |
| CVE-2026-87028 Concrete CMS 9 through 9.5.3 did not confirm that a board InstanceItem submitted... |
medium | 6.5 | — | Concretecms / concrete cms | 2026-09-16 | 2026-09-21 |
| CVE-2026-18120 Concrete CMS before 9.5.3 exposed a legacy Express entry search endpoint that re... |
medium | 5.9 | — | Concretecms / concrete cms | 2026-09-16 | 2026-09-21 |
| CVE-2026-18422 Concrete CMS before 9.5.3 did not enforce a destination-side authorization check... |
medium | 6.5 | — | Concretecms / concrete cms | 2026-09-15 | 2026-09-21 |
| CVE-2026-81924 Concrete CMS before 9.5.3 is vulnerable to Cross-Site Request Forgery (CSRF) in... |
medium | 6.5 | — | Concretecms / concrete cms | 2026-09-15 | 2026-09-21 |
| CVE-2026-18116 Concrete CMS 8.3.0 to 9.5.2 stored calendar event names without sanitization and... |
medium | 6.1 | — | Concretecms / concrete cms | 2026-09-14 | 2026-09-21 |
| CVE-2026-90828 A security flaw has been discovered in GNU Binutils 2.47. |
medium | 6.6 | — | Gnu / binutils | 2026-09-14 | 2026-09-21 |
| CVE-2026-81235 Dell Wyse Management Suite, versions prior to 2605.0.3.683, contain a Missing Cr... |
medium | 4.9 | — | Dell / wyse management suite | 2026-09-15 | 2026-09-21 |
| CVE-2026-81237 Dell Wyse Management Suite, versions prior to 2605.0.3.683, contain an Improper... |
medium | 6.5 | — | Dell / wyse management suite | 2026-09-15 | 2026-09-21 |
| CVE-2026-76104 Dell ObjectScale, versions prior to 4.4.0.0, contains an Incorrect Permission As... |
medium | 5.5 | — | Dell / objectscale | 2026-09-16 | 2026-09-21 |
| CVE-2026-71181 Dell Update Package Framework, versions prior to 26.07.03, contains an Improper... |
medium | 6.0 | — | Dell / update package framework | 2026-09-16 | 2026-09-21 |
| CVE-2026-71182 Dell Update Package Framework, versions prior to 26.07.03, contains an Improper... |
medium | 6.0 | — | Dell / update package framework | 2026-09-16 | 2026-09-21 |
| CVE-2026-86862 pgAdmin 4's Restore and Maintenance tools passed the client-supplied 'database'... |
medium | 6.5 | — | Pgadmin / pgadmin 4 | 2026-09-17 | 2026-09-21 |
| CVE-2026-86861 pgAdmin 4's File Manager save_file endpoint, which backs saving from the Query T... |
medium | 5.9 | — | Pgadmin / pgadmin 4 | 2026-09-17 | 2026-09-21 |
| CVE-2026-0177 In do_sss_aes_gcm_256_op of crypto-aes.c, there is a possible out-of-bounds read... |
medium | 4.4 | — | Google / android | 2026-09-15 | 2026-09-21 |
| CVE-2026-0179 In Bootloader, there is a possible permission bypass due to a missing permission... |
medium | 6.7 | — | Google / android | 2026-09-15 | 2026-09-21 |
| CVE-2026-0183 In CPM, there is a possible information disclosure due to a confused deputy. |
medium | 4.4 | — | Google / android | 2026-09-15 | 2026-09-21 |
| CVE-2026-0186 In ac_init_one_sswrp of init.c, there is a possible escalation of privilege due... |
medium | 6.7 | — | Google / android | 2026-09-15 | 2026-09-21 |
| CVE-2026-0187 In gsa_sw_pk_hash_compare of image-auth-srv.c, there is a possible escalation of... |
medium | 6.7 | — | Google / android | 2026-09-15 | 2026-09-21 |
| CVE-2026-0192 In Bootloader, there is a possible escalation of privilege due to a missing perm... |
medium | 6.7 | — | Google / android | 2026-09-15 | 2026-09-21 |
| CVE-2026-0197 In VPU, there is a possible information dislclosure due to a logic error in the... |
medium | 4.4 | — | Google / android | 2026-09-15 | 2026-09-21 |
| CVE-2026-55302 In multiple locations, there is a possible permission bypass due to a logic erro... |
medium | 6.7 | — | Google / android | 2026-09-15 | 2026-09-21 |
| CVE-2026-55304 In addr_remap_address_map of remap.c, there is a possible escalation of privileg... |
medium | 6.7 | — | Google / android | 2026-09-15 | 2026-09-21 |
| CVE-2026-55317 In printf of printf.c, there is a possible out-of-bounds write due to improper i... |
medium | 6.7 | — | Google / android | 2026-09-15 | 2026-09-21 |
| CVE-2026-55332 In multiple locations, there is a possible out-of-bounds write due to improper i... |
medium | 6.7 | — | Google / android | 2026-09-15 | 2026-09-21 |
| CVE-2026-55365 In multiple functions of remap.c, there is a possible out-of-bounds write due to... |
medium | 6.7 | — | Google / android | 2026-09-15 | 2026-09-21 |
| CVE-2026-56879 In gmc_mb_msg_handler of gmc_mba.c, there is a possible memory corruption due to... |
medium | 6.7 | — | Google / android | 2026-09-15 | 2026-09-21 |
| CVE-2026-94113 Frappe ERPNext versions before 15.121.0 and 16.x before 16.34.0 contain an infor... |
medium | 6.5 | — | — | 2026-09-20 | 2026-09-21 |
| CVE-2026-94046 A weakness has been identified in 0215AndrewFeng ACE-MCP up to 4.10.8. |
medium | 4.3 | — | — | 2026-09-20 | 2026-09-21 |
| CVE-2026-94051 A vulnerability was found in 0717376 cowork_bench up to d943e75bc0fc8e3b27141979... |
medium | 6.3 | — | — | 2026-09-20 | 2026-09-21 |
| CVE-2026-94093 A security vulnerability has been detected in DLR-RM stable-baselines3 up to 2.9... |
medium | 6.3 | — | — | 2026-09-20 | 2026-09-21 |
| CVE-2026-94031 A vulnerability was detected in 0-Gaurav-0 nexus-mcp aed0026e7ac1f23dc940e46e9fd... |
medium | 6.3 | — | — | 2026-09-20 | 2026-09-21 |
| CVE-2026-94041 A vulnerability has been found in AdithyaYelloju Restaurant-Management-System up... |
medium | 6.3 | — | — | 2026-09-20 | 2026-09-21 |
| CVE-2026-56888 In multiple locations, there is a possible permission bypass due to side channel... |
medium | 6.2 | — | Google / android | 2026-09-15 | 2026-09-21 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.