September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,321
Critical
1,226
High
4,361
Medium
4,108
Low
460
Severity not reported
1,166
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (964), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-14563 The advanced-customized-prompts WordPress plugin through 1.0.1 does not verify t... |
critical | 9.8 | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-57163 PJSIP is a free and open source multimedia communication library written in C. |
critical | 9.1 | — | Teluu / pjsip | 2026-09-04 | 2026-09-11 |
| CVE-2026-57162 PJSIP is a free and open source multimedia communication library written in C. |
critical | 9.1 | — | Teluu / pjsip | 2026-09-04 | 2026-09-11 |
| CVE-2026-75940 A vulnerability was reported in Lenovo Health Android Application, distributed e... |
critical | 9.1 | — | — | 2026-09-10 | 2026-09-11 |
| CVE-2026-77089 Command Center API contained an authentication bypass issue affecting privilege... |
critical | 9.8 | — | Commvault / commvault | 2026-09-08 | 2026-09-11 |
| CVE-2026-77092 Content Extractor contained a deserialization of untrusted data issue affecting... |
critical | 9.8 | — | Commvault / commvault | 2026-09-08 | 2026-09-11 |
| CVE-2026-77098 Private Metrics Server contained an SQL injection condition affecting database o... |
critical | 9.8 | — | Commvault / commvault | 2026-09-08 | 2026-09-11 |
| CVE-2026-19232 Adobe Experience Manager is affected by an Incorrect Authorization vulnerability... |
critical | 9.9 | — | Adobe / experience manager | 2026-09-08 | 2026-09-11 |
| CVE-2026-79941 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application... |
critical | 9.8 | — | Dell / secure connect gateway | 2026-09-09 | 2026-09-11 |
| CVE-2026-79689 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application... |
critical | 9.8 | — | Dell / secure connect gateway | 2026-09-09 | 2026-09-11 |
| CVE-2026-42264 Axios is a promise based HTTP client for the browser and Node.js. |
critical | 9.1 | — | Axios / axios | 2026-05-08 | 2026-09-11 |
| CVE-2026-21095 Heap-based buffer overflow in DNG decoder of libimagecodec.quram.so prior to SMR... |
critical | 9.8 | — | Samsung / android | 2026-09-09 | 2026-09-11 |
| CVE-2026-21096 Heap-based buffer overflow in JPEG decoder of libimagecodec.quram.so prior to SM... |
critical | 9.8 | — | Samsung / android | 2026-09-09 | 2026-09-11 |
| CVE-2026-84939 Path traversal vulnerability in Apache FreeMarker template loading mechanism, if... |
critical | 9.1 | — | Apache / freemarker | 2026-09-10 | 2026-09-11 |
| CVE-2026-86060 MikroTik RouterOS Improper Neutralization of Argument Delimiters in a Command Vu... |
critical | 9.8 | Listed | MikroTik / RouterOS | 2026-09-05 | 2026-09-11 |
| CVE-2026-80172 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application... |
critical | 9.8 | — | Dell / secure connect gateway | 2026-09-09 | 2026-09-11 |
| CVE-2026-19583 Velociraptor allows some sensitive artifacts to be gated by additional permissio... |
critical | 9.9 | — | — | 2026-09-10 | 2026-09-11 |
| CVE-2026-18658 IBM Operational Decision Manager 9.6.0.0, 9.5.0.0, 8.11.1.0, 8.11.0.1, 8.12.0.1,... |
critical | 9.8 | — | — | 2026-09-04 | 2026-09-10 |
| CVE-2026-41869 Missing Authorization, Improper Resource Shutdown and Job Interruption vulnerabi... |
critical | 9.1 | — | Apache / nutch | 2026-09-09 | 2026-09-10 |
| CVE-2026-41871 Missing Authorization, Use of Externally-Controlled Input to Select Classes or C... |
critical | 9.8 | — | Apache / nutch | 2026-09-09 | 2026-09-10 |
| CVE-2026-56207 Signature of Bearer token is not verified in last step of SAML2 authentication f... |
critical | 9.8 | — | Apache / impala | 2026-09-09 | 2026-09-10 |
| CVE-2026-53939 OpenIDC/cjose is a C library implementing the Javascript Object Signing and Encr... |
critical | 9.1 | — | — | 2026-09-09 | 2026-09-10 |
| CVE-2026-68487 Path traversal in Plesk's Backup Manager causes arbitrary file write as root by... |
critical | 9.9 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-68488 A Time-of-check Time-of-use (TOCTOU) race condition leading to insecure symlink... |
critical | 9.9 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-85228 An integer overflow in the tensor buffer validation component in Amazon Deep Jav... |
critical | 9.1 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-88044 rclone is a command-line program to sync files and directories to and from diffe... |
critical | 9.1 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-89049 A server-side request forgery issue due to improper validation of equivalent add... |
critical | 9.9 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-85216 MISP contains an authentication bypass vulnerability in its LDAP and LinOTP auth... |
critical | 9.8 | — | Misp-project / misp | 2026-09-03 | 2026-09-10 |
| CVE-2026-85221 MISP contains an improper TLS certificate validation vulnerability in CurlClient... |
critical | 9.1 | — | Misp-project / misp | 2026-09-03 | 2026-09-10 |
| CVE-2026-75003 In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, an unclosed url() in... |
critical | 9.8 | — | Roundcube / webmail | 2026-08-17 | 2026-09-10 |
| CVE-2026-87534 Missing authorization in WebView in Google Chrome on on Android prior to 153.0.8... |
critical | 9.8 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-86152 A flaw has been found in Tenda CP3 27.5.57.101. |
critical | 10.0 | — | — | 2026-09-06 | 2026-09-10 |
| CVE-2026-86840 The `vtoken-minting` and `slpx` pallets in Bifrost contain an improper authoriza... |
critical | 9.1 | — | — | 2026-09-08 | 2026-09-10 |
| CVE-2026-44950 fs_read_glyphs() in the libXfont2 font-server client (src/fc/fserve.c) copies ea... |
critical | 9.0 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2020-14498 HMS Industrial Networks AB eCatcher all versions prior to 6.5.5 is vulnerable to... |
critical | 10.0 | — | Hms-networks / ecatcher | 2020-08-26 | 2026-09-10 |
| CVE-2026-87464 Use after free in WebGL in Google Chrome prior to 153.0.8010.36 allowed a remote... |
critical | 9.6 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-73778 A vulnerability exists in the Credential Manager component that may allow for un... |
critical | 9.8 | — | Hpe / arubaos-cx | 2026-09-01 | 2026-09-10 |
| CVE-2026-8323 URL redirection to untrusted site ('open redirect') vulnerability in Armiya Info... |
critical | 9.3 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-88285 GeoVision GV-LPC2211 V1.13 exposes a network-accessible PTZ control service with... |
critical | 9.4 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-88869 AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored... |
critical | 9.3 | — | — | 2026-09-10 | 2026-09-10 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.