September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,313
Critical
1,226
High
4,359
Medium
4,108
Low
460
Severity not reported
1,160
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (964), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-2573 The GutenKit – Page Builder Blocks, Patterns, and Templates for Gutenberg Block... |
medium | 6.4 | — | — | 2026-09-03 | 2026-09-03 |
| CVE-2026-3852 The Divi theme for WordPress is vulnerable to Stored Cross-Site Scripting via th... |
medium | 6.4 | — | — | 2026-09-03 | 2026-09-03 |
| CVE-2026-85021 A vulnerability was determined in langgenius dify 1.13.0. |
medium | 4.3 | — | — | 2026-09-03 | 2026-09-03 |
| CVE-2026-85040 A weakness has been identified in ZhongBangKeJi CRMEB up to 6.0.0. |
medium | 4.7 | — | — | 2026-09-03 | 2026-09-03 |
| CVE-2026-85100 A vulnerability was detected in 2FastLabs agent-squad up to 1.1.4. |
medium | 4.3 | — | — | 2026-09-03 | 2026-09-03 |
| CVE-2026-85107 A vulnerability was found in NousResearch hermes-agent 0.18.0. |
medium | 4.3 | — | — | 2026-09-03 | 2026-09-03 |
| CVE-2026-84815 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 5.8 | — | — | 2026-09-03 | 2026-09-03 |
| CVE-2026-85135 A security flaw has been discovered in ILIAS up to 9.21/10.9/11.2. |
medium | 6.3 | — | — | 2026-09-03 | 2026-09-03 |
| CVE-2026-84357 Improper input validation in Omnibox in Google Chrome prior to 152.0.7977.75 all... |
medium | 6.5 | — | Google / chrome | 2026-09-02 | 2026-09-03 |
| CVE-2026-84358 Improper privilege management in Downloads in Google Chrome prior to 152.0.7977.... |
medium | 4.2 | — | Google / chrome | 2026-09-02 | 2026-09-03 |
| CVE-2026-84348 Information leak in MediaCapture in Google Chrome prior to 152.0.7977.75 allowed... |
medium | 6.5 | — | Google / chrome | 2026-09-02 | 2026-09-03 |
| CVE-2026-84654 In Stapler 2107.v8dfcb_e8ed317 and earlier, except 2088.2093.vd7c3e58008a_6, inc... |
medium | 5.4 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-84660 A missing permission check in Jenkins Pipeline: Build Step Plugin 599.v4b_67ea_1... |
medium | 5.4 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-84661 A missing permission check in Jenkins Pipeline: Build Step Plugin 599.v4b_67ea_1... |
medium | 5.4 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-84662 Jenkins LDAP Plugin 807.809.vd3a_4e5e4ec98 and earlier allows connecting to a sp... |
medium | 4.3 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-84663 A cross-site request forgery (CSRF) vulnerability in Jenkins Pipeline: Groovy Li... |
medium | 5.4 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-84664 Jenkins GitLab Plugin 1.9.16 and earlier allows overwriting the global GitLab co... |
medium | 5.4 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-84674 Missing permission checks in Jenkins XebiaLabs XL Deploy Plugin 26.1.0 and earli... |
medium | 5.4 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-84676 Jenkins Parameterized Remote Trigger Plugin 3.2.2 and earlier stores tokens unen... |
medium | 4.3 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-84677 Jenkins update-center2 3.18.3 and earlier does not escape plugin-provided values... |
medium | 5.4 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-84323 Missing authorization in FileSystem in Google Chrome prior to 152.0.7977.75 allo... |
medium | 5.3 | — | Google / chrome | 2026-09-02 | 2026-09-03 |
| CVE-2026-84329 Confused deputy in CredentialProvider in Google Chrome on on Windows prior to 15... |
medium | 5.3 | — | Google / chrome | 2026-09-02 | 2026-09-03 |
| CVE-2026-84332 Incorrect authorization in SiteSettings in Google Chrome prior to 152.0.7977.75... |
medium | 6.5 | — | Google / chrome | 2026-09-02 | 2026-09-03 |
| CVE-2026-17539 RTU500 has a vulnerability, where high-load scenarios, such as sending GI reques... |
medium | 5.9 | — | — | 2026-09-03 | 2026-09-03 |
| CVE-2026-12704 When SAML IdP-initiated login is enabled in Grafana Enterprise, the SAML library... |
medium | 6.8 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-19475 An authenticated user with permission to query a SQL data source can bypass the... |
medium | 6.5 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-73728 Denial-of-service vulnerabilities exist in the API of HPE Networking Fabric Comp... |
medium | 6.5 | — | Arubanetworks / fabric composer | 2026-09-01 | 2026-09-03 |
| CVE-2026-73729 A vulnerability in the underlying operating system of HPE Networking Fabric Comp... |
medium | 6.5 | — | Arubanetworks / fabric composer | 2026-09-01 | 2026-09-03 |
| CVE-2026-73730 A privilege escalation vulnerability exists in the API of HPE Networking Fabric... |
medium | 6.5 | — | Arubanetworks / fabric composer | 2026-09-01 | 2026-09-03 |
| CVE-2026-73742 A vulnerability in an API endpoint of HPE Networking Fabric Composer could allow... |
medium | 4.3 | — | Arubanetworks / fabric composer | 2026-09-01 | 2026-09-03 |
| CVE-2026-73731 A vulnerability in the web-based management interface of HPE Networking Fabric C... |
medium | 6.1 | — | Arubanetworks / fabric composer | 2026-09-01 | 2026-09-03 |
| CVE-2026-73741 A vulnerability in the API of HPE Networking Fabric Composer could allow an auth... |
medium | 4.3 | — | Arubanetworks / fabric composer | 2026-09-01 | 2026-09-03 |
| CVE-2026-73739 A vulnerability exists in the API of HPE Networking Fabric Composer that allows... |
medium | 4.4 | — | Arubanetworks / fabric composer | 2026-09-01 | 2026-09-03 |
| CVE-2026-73740 A local privilege escalation vulnerability in HPE Networking Fabric Composer cou... |
medium | 4.4 | — | Arubanetworks / fabric composer | 2026-09-01 | 2026-09-03 |
| CVE-2026-73738 A vulnerability in the underlying operating system of HPE Networking Fabric Comp... |
medium | 4.7 | — | Arubanetworks / fabric composer | 2026-09-01 | 2026-09-03 |
| CVE-2026-73737 An unauthenticated path traversal vulnerability exists in the API endpoint of HP... |
medium | 4.8 | — | Arubanetworks / fabric composer | 2026-09-01 | 2026-09-03 |
| CVE-2026-73735 Vulnerabilities in the API of HPE Networking Fabric Composer could allow an auth... |
medium | 5.4 | — | Arubanetworks / fabric composer | 2026-09-01 | 2026-09-03 |
| CVE-2026-73736 A vulnerability in the web-based management interface of HPE Networking Fabric C... |
medium | 5.3 | — | Arubanetworks / fabric composer | 2026-09-01 | 2026-09-03 |
| CVE-2026-73734 A vulnerability in the web-based management interface of HPE Networking Fabric C... |
medium | 5.4 | — | Arubanetworks / fabric composer | 2026-09-01 | 2026-09-03 |
| CVE-2026-73733 Authentication bypasses in the API of HPE Networking Fabric Composer could allow... |
medium | 5.4 | — | Arubanetworks / fabric composer | 2026-09-01 | 2026-09-03 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.