September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,321
Critical
1,226
High
4,361
Medium
4,108
Low
460
Severity not reported
1,166
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (964), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-57145 PraisonAI is a multi-agent teams system. |
critical | 9.1 | — | — | 2026-09-14 | 2026-09-15 |
| CVE-2026-57140 PraisonAI is a multi-agent teams system. |
critical | 9.4 | — | — | 2026-09-15 | 2026-09-15 |
| CVE-2026-57141 PraisonAI is a multi-agent teams system. |
critical | 9.8 | — | — | 2026-09-15 | 2026-09-15 |
| CVE-2026-84961 undici's BalancedPool constructor passes its entire options object through an in... |
critical | 9.1 | — | Nodejs / undici | 2026-09-04 | 2026-09-15 |
| CVE-2026-28606 In handleBondStateChanged of AdapterService.java, there is a possible way to ski... |
critical | 9.8 | — | Google / android | 2026-09-08 | 2026-09-15 |
| CVE-2026-90702 A flaw has been found in D-Link DWR-M921 1.1.52. |
critical | 9.1 | — | — | 2026-09-14 | 2026-09-15 |
| CVE-2026-90692 A vulnerability was detected in D-Link DIR-878 120B05. |
critical | 9.9 | — | — | 2026-09-14 | 2026-09-15 |
| CVE-2026-90605 A weakness has been identified in Totolink A3002MU Hh-B20211125.1046. |
critical | 9.9 | — | — | 2026-09-14 | 2026-09-15 |
| CVE-2026-76461 Cisco Secure Email Gateway SQL Injection Vulnerability |
critical | 9.8 | Listed | Cisco / Secure Email Gateway | 2026-09-14 | 2026-09-15 |
| CVE-2026-18924 A flaw in libcurl's handling of HTTP/2 Server Push streams, when the parent
hand... |
critical | 9.1 | — | Haxx / curl | 2026-09-06 | 2026-09-15 |
| CVE-2026-19931 A flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given
ho... |
critical | 9.8 | — | Haxx / curl | 2026-09-06 | 2026-09-15 |
| CVE-2026-72709 SPIP before version 4.4.18 contains a missing authorization vulnerability in sen... |
critical | 9.8 | — | — | 2026-09-11 | 2026-09-15 |
| CVE-2026-72710 SPIP before 4.4.18 contains a mass assignment vulnerability in the editer_objet... |
critical | 9.8 | — | — | 2026-09-11 | 2026-09-15 |
| CVE-2026-87595 Server-side request forgery in Mobile in Google Chrome prior to 153.0.8010.36 al... |
critical | 9.8 | — | Google / chrome | 2026-09-09 | 2026-09-14 |
| CVE-2026-75800 The Frontegg SAML SSO WordPress plugin through 1.0.1 does not verify the signatu... |
critical | 9.8 | — | — | 2026-09-12 | 2026-09-14 |
| CVE-2026-77005 The CODE MONKEYS PROPOSALS WordPress plugin through 1.0.1 does not validate a us... |
critical | 9.6 | — | — | 2026-09-12 | 2026-09-14 |
| CVE-2026-81402 The DS Ad Rotator WordPress plugin through 0.8 does not perform any capability c... |
critical | 9.8 | — | — | 2026-09-12 | 2026-09-14 |
| CVE-2026-82845 The Masteriyo LMS WordPress plugin before 3.4.1 does not prevent user-supplied v... |
critical | 9.9 | — | — | 2026-09-12 | 2026-09-14 |
| CVE-2026-84171 The WP images upload on piclect WordPress plugin through 1.0 does not validate t... |
critical | 9.8 | — | — | 2026-09-12 | 2026-09-14 |
| CVE-2026-85681 The WP Component WordPress plugin through 2.2.4 does not have any capability or... |
critical | 9.8 | — | — | 2026-09-12 | 2026-09-14 |
| CVE-2026-81648 The CryptoPayment Gateway WordPress plugin from 1.2.1 to 1.2.2 does not apply an... |
critical | 10.0 | — | — | 2026-09-13 | 2026-09-14 |
| CVE-2026-82232 Improper neutralization of special elements used in an SQL command ('SQL injecti... |
critical | 9.8 | — | — | 2026-09-14 | 2026-09-14 |
| CVE-2026-86460 Cypher injection vulnerability in the Neo4j persistence layer when processing so... |
critical | 9.8 | — | — | 2026-09-14 | 2026-09-14 |
| CVE-2026-87785 Authentication bypass by spoofing vulnerability in Apache Syncope. |
critical | 9.1 | — | — | 2026-09-14 | 2026-09-14 |
| CVE-2026-87802 Improper verification of cryptographic signature vulnerability in Apache Syncope... |
critical | 9.1 | — | — | 2026-09-14 | 2026-09-14 |
| CVE-2026-73470 Improper Privilege Management vulnerability in Apache Syncope. |
critical | 9.8 | — | — | 2026-09-14 | 2026-09-14 |
| CVE-2026-73579 Incorrect Authorization vulnerability in Apache Syncope. |
critical | 9.8 | — | — | 2026-09-14 | 2026-09-14 |
| CVE-2026-73668 Incorrect Authorization vulnerability in Apache Syncope. |
critical | 9.8 | — | — | 2026-09-14 | 2026-09-14 |
| CVE-2026-75030 Missing Authorization vulnerability in Apache Syncope. |
critical | 9.8 | — | — | 2026-09-14 | 2026-09-14 |
| CVE-2026-77051 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
critical | 9.8 | — | — | 2026-09-14 | 2026-09-14 |
| CVE-2026-77181 Incorrect Authorization vulnerability in Apache Syncope. |
critical | 9.8 | — | — | 2026-09-14 | 2026-09-14 |
| CVE-2026-78330 Incorrect privilege assignment vulnerability in Apache Syncope. |
critical | 9.8 | — | — | 2026-09-14 | 2026-09-14 |
| CVE-2026-73370 Incorrect Authorization vulnerability in Apache Syncope. |
critical | 9.8 | — | — | 2026-09-14 | 2026-09-14 |
| CVE-2026-82439 Description
The DRPC server kept a map from function name to request queue and... |
critical | 9.8 | — | — | 2026-09-14 | 2026-09-14 |
| CVE-2026-82441 Description
A submitted topology carries two lists of blobstore keys, `dependen... |
critical | 9.1 | — | — | 2026-09-14 | 2026-09-14 |
| CVE-2026-82431 Description
`SimpleACLAuthorizer` evaluated the user-level command set by retur... |
critical | 9.8 | — | — | 2026-09-14 | 2026-09-14 |
| CVE-2026-82435 Description
The worker's Netty message decoder is installed ahead of the SASL a... |
critical | 9.8 | — | — | 2026-09-14 | 2026-09-14 |
| CVE-2026-90607 A vulnerability was detected in Totolink A3002MU Hh-B20211125.1046. |
critical | 9.9 | — | — | 2026-09-14 | 2026-09-14 |
| CVE-2026-90699 A weakness has been identified in D-Link DWR-M920 1.1.7. |
critical | 9.9 | — | — | 2026-09-14 | 2026-09-14 |
| CVE-2026-86751 Snipe-IT before 8.7.0 fails to properly sanitize markdown image syntax in note f... |
critical | 9.6 | — | Snipeitapp / snipe-it | 2026-09-09 | 2026-09-14 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.