September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,321
Critical
1,226
High
4,361
Medium
4,108
Low
460
Severity not reported
1,166
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (964), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-14349 The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress i... |
critical | 9.8 | — | — | 2026-09-16 | 2026-09-16 |
| CVE-2026-69910 Stack-based buffer overflow in Windows Hyper-V allows an unauthorized attacker t... |
critical | 9.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-16 |
| CVE-2026-84561 A double free issue was addressed with improved memory management. |
critical | 9.8 | — | Apple / ipados | 2026-09-14 | 2026-09-16 |
| CVE-2026-86881 A certificate validation issue was addressed with improved certificate validatio... |
critical | 9.1 | — | Apple / ipados | 2026-09-14 | 2026-09-16 |
| CVE-2026-92398 A vulnerability was found in Ruijie RG-EW3000GX EW_3.0(1)B11P380. |
critical | 9.1 | — | — | 2026-09-16 | 2026-09-16 |
| CVE-2026-57148 PraisonAI is a multi-agent teams system. |
critical | 9.8 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-20079 Cisco Firewall Management Center Authentication Bypass Using an Alternate Path o... |
critical | 10.0 | Listed | Cisco / Secure Firewall Management Center (FMC) and Security Cloud Control (SCC) Firewall Management | 2026-03-04 | 2026-09-16 |
| CVE-2026-84520 A buffer overflow was addressed with improved size validation. |
critical | 9.8 | — | Apple / macos | 2026-09-14 | 2026-09-16 |
| CVE-2026-90680 A security flaw has been discovered in D-Link DIR-823G 1.0.2B05_20181207. |
critical | 9.9 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-90608 A flaw has been found in Totolink A3002MU Hh-B20211125.1046. |
critical | 9.9 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-82617 The two built-in name-finder patterns exposed by
opennlp.tools.namefind.RegexNam... |
critical | 9.8 | — | Apache / opennlp | 2026-09-11 | 2026-09-16 |
| CVE-2026-57127 PraisonAI is a multi-agent teams system. |
critical | 9.8 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-57131 PraisonAI is a multi-agent teams system. |
critical | 9.8 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-49364 An unauthenticated network-adjacent attacker can leverage discovery to capture c... |
critical | 9.1 | — | Apache / artemis | 2026-09-10 | 2026-09-16 |
| CVE-2026-67593 A remote attacker can craft an Openwire RemoveSubscriptionInfo command to cause... |
critical | 9.1 | — | Apache / artemis | 2026-09-10 | 2026-09-16 |
| CVE-2026-65414 An out-of-bounds write issue was addressed with improved bounds checking. |
critical | 9.8 | — | Apple / ipados | 2026-09-14 | 2026-09-16 |
| CVE-2026-81204 IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote attacker to execute a... |
critical | 9.8 | — | Langflow / langflow | 2026-09-10 | 2026-09-16 |
| CVE-2026-79724 IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote attacker to execute a... |
critical | 9.8 | — | Langflow / langflow | 2026-09-10 | 2026-09-16 |
| CVE-2026-78573 IBM ContextForge MCP Gateway 1.0.0 through 1.0.7 could allow a remote attacker t... |
critical | 9.8 | — | Ibm / contextforge | 2026-09-10 | 2026-09-16 |
| CVE-2026-80424 IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated a... |
critical | 9.1 | — | Ibm / datastage on cloud pak for data | 2026-09-10 | 2026-09-16 |
| CVE-2026-82107 IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated a... |
critical | 9.6 | — | Ibm / datastage on cloud pak for data | 2026-09-10 | 2026-09-16 |
| CVE-2026-85184 @fastify/middie versions >= 9.1.0 and before 9.3.4 decide whether to run path-sc... |
critical | 9.1 | — | Fastify / fastify\/middie | 2026-09-04 | 2026-09-15 |
| CVE-2026-90606 A security vulnerability has been detected in Totolink A3002MU Hh-B20211125.1046... |
critical | 9.9 | — | — | 2026-09-14 | 2026-09-15 |
| CVE-2026-90847 A vulnerability was determined in EFM ipTIME C200E 1.094. |
critical | 9.1 | — | — | 2026-09-15 | 2026-09-15 |
| CVE-2026-52098 An issue in Flowise 3.1.2 allows a remote attacker to execute arbitrary code via... |
critical | 9.8 | — | Flowiseai / flowise | 2026-09-10 | 2026-09-15 |
| CVE-2026-90703 A vulnerability has been found in D-Link DWR-M921 1.1.52. |
critical | 9.1 | — | — | 2026-09-14 | 2026-09-15 |
| CVE-2026-76441 As part of Cisco's ongoing commitment to proactive security and product quality,... |
critical | 9.8 | — | — | 2026-09-14 | 2026-09-15 |
| CVE-2026-76443 As part of Cisco's ongoing commitment to proactive security and product quality,... |
critical | 9.8 | — | — | 2026-09-14 | 2026-09-15 |
| CVE-2026-76440 As part of Cisco's ongoing commitment to proactive security and product quality,... |
critical | 9.8 | — | — | 2026-09-14 | 2026-09-15 |
| CVE-2026-20353 As part of Cisco's ongoing commitment to proactive security and product quality,... |
critical | 9.8 | — | — | 2026-09-14 | 2026-09-15 |
| CVE-2026-85025 IBM Langflow OSS 1.0.0 through 1.11.5 Langflow could allow an unauthenticated at... |
critical | 9.8 | — | Langflow / langflow | 2026-09-10 | 2026-09-15 |
| CVE-2026-90693 A flaw has been found in D-Link DIR-878 120B05. |
critical | 9.9 | — | — | 2026-09-14 | 2026-09-15 |
| CVE-2019-7105 Adobe XD versions 16.0 and earlier have a path traversal vulnerability. |
critical | 9.8 | — | Adobe / xd | 2019-05-23 | 2026-09-15 |
| CVE-2019-7106 Adobe XD versions 16.0 and earlier have a path traversal vulnerability. |
critical | 9.8 | — | Adobe / xd | 2019-05-23 | 2026-09-15 |
| CVE-2026-91003 A flaw has been found in D-Link DI-8300 16.07. |
critical | 9.1 | — | — | 2026-09-15 | 2026-09-15 |
| CVE-2026-91001 A security flaw has been discovered in D-Link DI-8400 16.07. |
critical | 9.9 | — | — | 2026-09-15 | 2026-09-15 |
| CVE-2026-77822 IBM ContextForge MCP Gateway could allow a remote authenticated attacker to obta... |
critical | 9.6 | — | Ibm / contextforge | 2026-09-04 | 2026-09-15 |
| CVE-2026-57123 PraisonAI is a multi-agent teams system. |
critical | 9.8 | — | — | 2026-09-14 | 2026-09-15 |
| CVE-2026-57125 PraisonAI is a multi-agent teams system. |
critical | 9.8 | — | — | 2026-09-14 | 2026-09-15 |
| CVE-2026-57124 PraisonAI is a multi-agent teams system. |
critical | 9.8 | — | — | 2026-09-14 | 2026-09-15 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.