September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,291
Critical
1,223
High
4,345
Medium
4,103
Low
460
Severity not reported
1,160
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-78838 A reflected cross-site scripting (XSS) vulnerability in the grid_datasource.php... |
medium | 6.5 | — | — | 2026-09-08 | 2026-09-09 |
| CVE-2026-78738 Silverpeas Core 6.4.6 is vulnerable to Cross Site Scripting (XSS) via the Docume... |
medium | 6.1 | — | — | 2026-09-08 | 2026-09-09 |
| CVE-2026-75170 Cross-site scripting (XSS) vulnerability in the /loginController/doLogin endpoin... |
medium | 6.1 | — | — | 2026-09-04 | 2026-09-09 |
| CVE-2026-75162 An information disclosure vulnerability in the opcua-configuration method of /cg... |
medium | 6.5 | — | — | 2026-09-04 | 2026-09-09 |
| CVE-2026-49455 Waku is the minimal React framework. |
medium | 6.5 | — | — | 2026-09-03 | 2026-09-09 |
| CVE-2026-85392 Peppermint through 0.5.5 contains an authorization bypass vulnerability in the G... |
medium | 4.3 | — | — | 2026-09-03 | 2026-09-09 |
| CVE-2026-87808 SiYuan versions <= 3.8.1 contain an incomplete fix for CVE-2026-32767 (GHSA-j7wh... |
medium | 4.9 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-38961 Cross-Site Scripting (XSS) vulnerability in the RSS Widget of Netgate pfSense Pl... |
medium | 5.4 | — | — | 2026-09-04 | 2026-09-09 |
| CVE-2026-39020 An issue in WIngs3D v.2.4.1 allows a local attacker to cause a denial of service... |
medium | 5.5 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-82530 IP2Location Country Blocker plugin for WordPress before 2.45.0 contains an acces... |
medium | 5.3 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-80055 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application... |
medium | 4.4 | — | Dell / secure connect gateway | 2026-09-09 | 2026-09-09 |
| CVE-2026-80177 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application... |
medium | 6.5 | — | Dell / secure connect gateway | 2026-09-09 | 2026-09-09 |
| CVE-2026-83991 Missing authentication for critical function in Windows Cloud Files Mini Filter... |
medium | 5.5 | — | Microsoft / windows 10 1809 | 2026-09-08 | 2026-09-09 |
| CVE-2026-79638 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application... |
medium | 5.3 | — | Dell / secure connect gateway | 2026-09-09 | 2026-09-09 |
| CVE-2026-79694 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application... |
medium | 5.5 | — | Dell / secure connect gateway | 2026-09-09 | 2026-09-09 |
| CVE-2026-85788 Incomplete list of disallowed inputs in the mutable SQL detector component in Am... |
medium | 5.5 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-79961 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application... |
medium | 5.3 | — | Dell / secure connect gateway | 2026-09-09 | 2026-09-09 |
| CVE-2026-79962 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application... |
medium | 5.9 | — | Dell / secure connect gateway | 2026-09-09 | 2026-09-09 |
| CVE-2026-79965 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application... |
medium | 5.3 | — | Dell / secure connect gateway | 2026-09-09 | 2026-09-09 |
| CVE-2026-78483 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application... |
medium | 5.9 | — | Dell / secure connect gateway | 2026-09-09 | 2026-09-09 |
| CVE-2026-78486 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application... |
medium | 4.4 | — | Dell / secure connect gateway | 2026-09-09 | 2026-09-09 |
| CVE-2026-79952 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application... |
medium | 5.3 | — | Dell / secure connect gateway | 2026-09-09 | 2026-09-09 |
| CVE-2026-79964 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application... |
medium | 5.3 | — | Dell / secure connect gateway | 2026-09-09 | 2026-09-09 |
| CVE-2026-79735 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application... |
medium | 4.4 | — | Dell / secure connect gateway | 2026-09-09 | 2026-09-09 |
| CVE-2026-79947 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application... |
medium | 5.5 | — | Dell / secure connect gateway | 2026-09-09 | 2026-09-09 |
| CVE-2026-84967 A component of the MongoDB extension for Visual Studio Code does not neutralize... |
medium | 4.3 | — | Mongodb / mongodb | 2026-09-03 | 2026-09-09 |
| CVE-2026-78489 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application... |
medium | 5.9 | — | Dell / secure connect gateway | 2026-09-09 | 2026-09-09 |
| CVE-2026-78481 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application... |
medium | 6.5 | — | Dell / secure connect gateway | 2026-09-09 | 2026-09-09 |
| CVE-2026-79973 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application... |
medium | 6.3 | — | Dell / secure connect gateway | 2026-09-09 | 2026-09-09 |
| CVE-2026-79967 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application... |
medium | 5.6 | — | Dell / secure connect gateway | 2026-09-09 | 2026-09-09 |
| CVE-2026-79640 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application... |
medium | 5.4 | — | Dell / secure connect gateway | 2026-09-09 | 2026-09-09 |
| CVE-2026-85090 FreeRDP before 3.31.0 contains a heap out-of-bounds read vulnerability in the ge... |
medium | 5.4 | — | Freerdp / freerdp | 2026-09-03 | 2026-09-09 |
| CVE-2026-87563 Origin validation error in Paint in Google Chrome prior to 153.0.8010.36 allowed... |
medium | 4.3 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-87565 Information leak in Passwords in Google Chrome on on Android prior to 153.0.8010... |
medium | 6.5 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-87566 Observable discrepancy in Layout in Google Chrome prior to 153.0.8010.36 allowed... |
medium | 5.3 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-87724 Tor before 0.4.9.12 interprets the CC_RESPONSE extension even when CC_REQUEST wa... |
medium | 6.5 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-87735 An issue was discovered in the mirage-crypto-pk package before 2.3.0 for OCaml. |
medium | 4.3 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-79588 U-speed WIFI4 N300 T1 Pro v1.0.0 is vulnerable to Cleartext transmission of admi... |
medium | 4.3 | — | — | 2026-09-08 | 2026-09-09 |
| CVE-2026-69690 Improper neutralization of input during web page generation ('cross-site scripti... |
medium | 5.4 | — | Microsoft / sharepoint server | 2026-09-08 | 2026-09-09 |
| CVE-2026-52486 An issue in OpenDDS 3.33.x allows a local attacker to cause a denial of service... |
medium | 6.6 | — | — | 2026-09-08 | 2026-09-09 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.