September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,313
Critical
1,226
High
4,359
Medium
4,108
Low
460
Severity not reported
1,160
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (964), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-73732 A vulnerability in the underlying operating system of HPE Networking Fabric Comp... |
medium | 5.6 | — | Arubanetworks / fabric composer | 2026-09-01 | 2026-09-03 |
| CVE-2026-84772 Editor Server Side Request Forgery (SSRF) in Broken Link Checker <= 2.4.14 versi... |
medium | 5.5 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-84781 Contributor Cross Site Scripting (XSS) in Gallery PhotoBlocks <= 1.3.4 versions. |
medium | 6.5 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-78586 Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lea... |
medium | 6.5 | — | Elastic / kibana | 2026-09-02 | 2026-09-03 |
| CVE-2026-78591 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (... |
medium | 6.3 | — | Elastic / kibana | 2026-09-02 | 2026-09-03 |
| CVE-2026-78599 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (... |
medium | 6.5 | — | Elastic / kibana | 2026-09-02 | 2026-09-03 |
| CVE-2026-78601 Missing Authorization (CWE-862) in Kibana can lead to information disclosure via... |
medium | 5.5 | — | Elastic / kibana | 2026-09-02 | 2026-09-03 |
| CVE-2026-78598 Incorrect Authorization (CWE-863) in the Kibana machine learning feature can lea... |
medium | 5.4 | — | Elastic / kibana | 2026-09-02 | 2026-09-03 |
| CVE-2026-78584 Observable Response Discrepancy (CWE-204) in the Kibana Osquery feature can lead... |
medium | 4.3 | — | Elastic / kibana | 2026-09-02 | 2026-09-03 |
| CVE-2026-84126 Incorrect boundary conditions in the Layout: Grid component. |
medium | 4.3 | — | Mozilla / firefox | 2026-09-01 | 2026-09-03 |
| CVE-2026-84127 Information disclosure in the WebExtensions component in Firefox for Android. |
medium | 4.3 | — | Mozilla / firefox mobile | 2026-09-01 | 2026-09-03 |
| CVE-2026-20354 Multiple vulnerabilities in the Secure/Multipurpose Internet Mail Extensions (S/... |
medium | 5.9 | — | — | 2026-09-02 | 2026-09-02 |
| CVE-2026-20355 Multiple vulnerabilities in the Secure/Multipurpose Internet Mail Extensions (S/... |
medium | 5.9 | — | — | 2026-09-02 | 2026-09-02 |
| CVE-2026-76758 Vulnerability in Drupal Link content parser. |
medium | 5.9 | — | — | 2026-09-02 | 2026-09-02 |
| CVE-2026-78597 Missing Authorization (CWE-862) in the Kibana Entity Store feature can lead to u... |
medium | 4.3 | — | Elastic / kibana | 2026-09-01 | 2026-09-02 |
| CVE-2026-78605 Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') (CWE-444... |
medium | 5.9 | — | Elastic / elasticsearch | 2026-09-01 | 2026-09-02 |
| CVE-2026-72654 Execution with Unnecessary Privileges (CWE-250) in the Kibana machine learning f... |
medium | 6.5 | — | Elastic / kibana | 2026-09-01 | 2026-09-02 |
| CVE-2026-83744 A security vulnerability has been detected in invoiceninja Invoice Ninja up to 5... |
medium | 4.3 | — | — | 2026-09-01 | 2026-09-02 |
| CVE-2026-77189 The Charitable – Donation & Fundraising Platform (Donation Forms, Recurring Dona... |
medium | 6.5 | — | — | 2026-09-01 | 2026-09-02 |
| CVE-2026-76006 The Photo Gallery by Ays – Responsive Image Gallery plugin for WordPress is vuln... |
medium | 4.9 | — | — | 2026-09-01 | 2026-09-02 |
| CVE-2026-16787 The Live Composer – Free WordPress Website Builder plugin for WordPress is vulne... |
medium | 6.4 | — | — | 2026-09-01 | 2026-09-02 |
| CVE-2026-84118 Use-after-free in the JavaScript: GC component. |
medium | 5.4 | — | Mozilla / firefox | 2026-09-01 | 2026-09-02 |
| CVE-2026-84120 Use-after-free in the Audio/Video component. |
medium | 5.4 | — | Mozilla / firefox | 2026-09-01 | 2026-09-02 |
| CVE-2026-84806 Kimai before 2.63.0 contains an improper authorization vulnerability in team acc... |
medium | 5.4 | — | — | 2026-09-02 | 2026-09-02 |
| CVE-2026-84431 A vulnerability was detected in AirAsia MOVE App up to 12.47.1 on Android. |
medium | 4.4 | — | — | 2026-09-02 | 2026-09-02 |
| CVE-2026-84288 A vulnerability has been found in NousResearch hermes-agent up to 0.18.2. |
medium | 4.3 | — | — | 2026-09-01 | 2026-09-02 |
| CVE-2026-84289 A vulnerability was found in NousResearch hermes-agent up to 0.18.2. |
medium | 4.3 | — | — | 2026-09-01 | 2026-09-02 |
| CVE-2026-82223 Unauthenticated Broken Access Control in WP Event SOlution <= 4.1.22 versions. |
medium | 6.5 | — | — | 2026-09-02 | 2026-09-02 |
| CVE-2026-73726 A vulnerability has been identified in the underlying operating system of HPE Ne... |
medium | 6.8 | — | Arubanetworks / fabric composer | 2026-09-01 | 2026-09-02 |
| CVE-2026-73727 Vulnerabilities in the API of HPE Networking Fabric Composer could allow an auth... |
medium | 6.5 | — | Arubanetworks / fabric composer | 2026-09-01 | 2026-09-02 |
| CVE-2026-66652 Cross-Site Request Forgery (CSRF) vulnerability in ThemeGoods Grand Tour allows... |
medium | 5.4 | — | — | 2026-09-02 | 2026-09-02 |
| CVE-2026-84122 Use-after-free in the Audio/Video component. |
medium | 5.4 | — | Mozilla / firefox | 2026-09-01 | 2026-09-02 |
| CVE-2026-84124 Use-after-free in the DOM: Core & HTML component. |
medium | 5.4 | — | Mozilla / firefox | 2026-09-01 | 2026-09-02 |
| CVE-2026-84125 Use-after-free in the DOM: Core & HTML component. |
medium | 5.4 | — | Mozilla / firefox | 2026-09-01 | 2026-09-02 |
| CVE-2026-78608 Missing Authorization (CWE-862) in Kibana can lead to information disclosure via... |
medium | 6.5 | — | Elastic / kibana | 2026-09-01 | 2026-09-02 |
| CVE-2026-78606 Incorrect Authorization (CWE-863) in Kibana can lead to unauthorized disclosure,... |
medium | 4.2 | — | Elastic / kibana | 2026-09-01 | 2026-09-02 |
| CVE-2026-78603 Missing Authorization (CWE-862) in Kibana can lead to information disclosure via... |
medium | 4.3 | — | Elastic / kibana | 2026-09-01 | 2026-09-02 |
| CVE-2026-72682 Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lea... |
medium | 6.5 | — | Elastic / kibana | 2026-09-01 | 2026-09-02 |
| CVE-2026-72652 Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lea... |
medium | 6.5 | — | Elastic / kibana | 2026-09-01 | 2026-09-02 |
| CVE-2026-72644 Uncaught Exception (CWE-248) in Kibana can lead to a denial of service via Input... |
medium | 6.5 | — | Elastic / kibana | 2026-09-01 | 2026-09-02 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.