September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,321
Critical
1,226
High
4,361
Medium
4,108
Low
460
Severity not reported
1,166
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (964), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-20307 A vulnerability in the web-based management interface of Cisco ISE could allow a... |
critical | 9.9 | — | — | 2026-09-16 | 2026-09-17 |
| CVE-2026-20176 A vulnerability in Cisco ISE could allow an authenticated, remote attacker to ex... |
critical | 9.1 | — | — | 2026-09-16 | 2026-09-17 |
| CVE-2026-20211 A vulnerability in Cisco ISE could allow an authenticated, remote attacker to ex... |
critical | 9.1 | — | — | 2026-09-16 | 2026-09-17 |
| CVE-2026-83020 Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion... |
critical | 10.0 | — | — | 2026-09-15 | 2026-09-17 |
| CVE-2026-73453 An unauthenticated P4Runtime (Programming Protocol-Independent Packet Processors... |
critical | 10.0 | — | — | 2026-09-16 | 2026-09-17 |
| CVE-2026-73437 On affected platforms running Arista EOS with Dynamic Host Configuration Protoco... |
critical | 9.6 | — | — | 2026-09-15 | 2026-09-17 |
| CVE-2026-20305 A vulnerability in the diagnostic tools of Cisco ISE and ISE-PIC could allow an... |
critical | 9.1 | — | — | 2026-09-16 | 2026-09-17 |
| CVE-2026-20306 A vulnerability in the REST API of Cisco ISE and ISE-PIC could allow an authenti... |
critical | 9.1 | — | — | 2026-09-16 | 2026-09-17 |
| CVE-2026-81046 Dell ThinOS 10, versions prior to 2605_10.2616, contain a Protection Mechanism F... |
critical | 9.4 | — | Dell / thinos | 2026-09-10 | 2026-09-16 |
| CVE-2026-81467 Dell ThinOS 10, versions prior to 2605_10. |
critical | 9.8 | — | Dell / thinos | 2026-09-10 | 2026-09-16 |
| CVE-2026-71324 Traefik is an open source HTTP reverse proxy and load balancer. |
critical | 9.1 | — | Traefik / traefik | 2026-08-06 | 2026-09-16 |
| CVE-2026-78299 In Eclipse Embedded CDT versions 6.0 to 6.7 if the CMSIS-Pack archive extracts a... |
critical | 9.1 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-63695 Dell SmartFabric OS10 Software, versions prior to 10.6.1.3, contains a Session F... |
critical | 9.8 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-63696 Dell SmartFabric OS10 Software, versions prior to 10.6.1.3, contains a Download... |
critical | 9.1 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-86106 An unauthenticated actor with network access to the private HA interconnect may... |
critical | 9.6 | — | — | 2026-09-16 | 2026-09-16 |
| CVE-2026-91939 Cotonti 1.0.0 Comments plugin passes the ci GET parameter to unserialize() witho... |
critical | 9.8 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-45764 Suricata is a network Intrusion Detection System, Intrusion Prevention System an... |
critical | 9.1 | — | Oisf / suricata | 2026-09-10 | 2026-09-16 |
| CVE-2026-92397 A vulnerability has been found in Ruijie RG-EW3000GX EW_3.0(1)B11P380. |
critical | 9.1 | — | — | 2026-09-16 | 2026-09-16 |
| CVE-2023-27172 Xpand IT Write-back Manager v2.3.1 uses weak secret keys to sign JWT tokens. |
critical | 9.1 | — | Xpand-it / write-back manager | 2023-12-20 | 2026-09-16 |
| CVE-2023-27168 An arbitrary file upload vulnerability in Xpand IT Write-back Manager v2.3.1 all... |
critical | 9.8 | — | Xpand-it / write-back manager | 2024-01-19 | 2026-09-16 |
| CVE-2026-73961 Vulnerability in the Oracle JDeveloper product of Oracle Fusion Middleware (comp... |
critical | 9.8 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-82994 Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion... |
critical | 9.8 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-82995 Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion... |
critical | 9.8 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-82997 Vulnerability in the Service Delivery Platform product of Oracle Fusion Middlewa... |
critical | 9.9 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-82998 Vulnerability in the Service Delivery Platform product of Oracle Fusion Middlewa... |
critical | 9.9 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-82999 Vulnerability in the Service Delivery Platform product of Oracle Fusion Middlewa... |
critical | 9.9 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-83000 Vulnerability in the Service Delivery Platform product of Oracle Fusion Middlewa... |
critical | 9.8 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-83029 Vulnerability in the Oracle Managed File Transfer product of Oracle Fusion Middl... |
critical | 9.6 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-83151 Vulnerability in the Service Delivery Platform product of Oracle Fusion Middlewa... |
critical | 9.8 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-83232 Vulnerability in the Oracle Data Integrator product of Oracle Fusion Middleware... |
critical | 9.8 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-83261 Vulnerability in the Oracle Product Lifecycle Analytics product of Oracle Supply... |
critical | 9.8 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-83327 Vulnerability in the Oracle Applications Framework product of Oracle E-Business... |
critical | 9.8 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-83355 Vulnerability in the Oracle Enterprise Manager for Fusion Middleware product of... |
critical | 9.8 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-90711 proxy-addr is a Node.js module that determines a request's client address behind... |
critical | 9.1 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-82787 Missing authentication for critical function vulnerability exists in CPSL-08P1EN... |
critical | 9.8 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-66302 External control of file name or path in Skype for Business allows an unauthoriz... |
critical | 9.8 | — | Microsoft / skype for business server | 2026-09-08 | 2026-09-16 |
| CVE-2026-12944 IBM Langflow OSS 1.0.0 through 1.10.0 can allow attackers to execute arbitrary P... |
critical | 9.6 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-12351 IBM MQ 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through... |
critical | 9.8 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-27565 An unauthenticated remote attacker can upload a malicious IODD file that places... |
critical | 9.8 | — | — | 2026-09-16 | 2026-09-16 |
| CVE-2026-27546 An unauthenticated remote attacker can exploit an authentication bypass in the _... |
critical | 9.8 | — | — | 2026-09-16 | 2026-09-16 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.