September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,321
Critical
1,226
High
4,361
Medium
4,108
Low
460
Severity not reported
1,166
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (964), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-88278 GeoVision GV-LPC2211 V1.13 fails to enforce WS-Security UsernameToken freshness... |
critical | 9.8 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-85696 SadTalker contains an OS command injection vulnerability in the video muxing pro... |
critical | 9.8 | — | — | 2026-09-04 | 2026-09-10 |
| CVE-2026-71805 An arbitrary file upload and path traversal vulnerability exists in LZ-litchi 1.... |
critical | 9.8 | — | — | 2026-09-09 | 2026-09-10 |
| CVE-2026-54694 SkillTree is a micro-learning gamification platform. |
critical | 9.6 | — | — | 2026-09-09 | 2026-09-10 |
| CVE-2026-36433 An issue in Actions Semiconductor Co. |
critical | 9.8 | — | — | 2026-09-09 | 2026-09-10 |
| CVE-2026-85183 Taipy configures its socket.io server with wildcard CORS origin and credential f... |
critical | 9.3 | — | — | 2026-09-03 | 2026-09-10 |
| CVE-2026-85663 Aim 3.29.1 remote tracking server fails to authenticate requests and dispatches... |
critical | 9.8 | — | — | 2026-09-04 | 2026-09-10 |
| CVE-2026-85667 xiaobei through 5.5.2 fails to implement authentication or signature validation... |
critical | 9.1 | — | — | 2026-09-04 | 2026-09-10 |
| CVE-2026-85695 FastChat contains an authentication bypass vulnerability in the /register_worker... |
critical | 9.4 | — | — | 2026-09-04 | 2026-09-10 |
| CVE-2026-44402 Voltronic Power SNMP Web Pro 1.1 contains an unauthenticated remote code executi... |
critical | 9.8 | — | — | 2026-09-04 | 2026-09-10 |
| CVE-2026-87911 An OS command injection weakness in the read-only enforcement of the SQL validat... |
critical | 9.6 | — | — | 2026-09-09 | 2026-09-10 |
| CVE-2026-84200 Kyverno versions v1.9.0 through v1.12.7 contain a policy exception handling flaw... |
critical | 9.0 | — | — | 2026-09-01 | 2026-09-10 |
| CVE-2026-59679 fs_read_glyphs() in the libXfont2 font-server client (src/fc/fserve.c) indexes t... |
critical | 9.0 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-85982 The Auth0 AD/LDAP Connector is vulnerable to stored Cross-Site Scripting (XSS) i... |
critical | 9.0 | — | — | 2026-09-08 | 2026-09-10 |
| CVE-2026-82533 DeepSeek Harness before 0.1.2-alpha.1 contains an authentication bypass vulnerab... |
critical | 9.6 | — | — | 2026-09-08 | 2026-09-10 |
| CVE-2026-77770 The miniOrange 2FA WordPress plugin before 6.3.1, miniOrange 2FA WordPress plugi... |
critical | 10.0 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-78361 The zipMoney(Zip Co) Payments Plugin for WooCommerce WordPress plugin before 2.4... |
critical | 9.1 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-7188 Improper neutralization of special elements used in an SQL command ('SQL injecti... |
critical | 9.8 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-9163 Improper neutralization of special elements used in an SQL command ('SQL injecti... |
critical | 9.8 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-87931 A vulnerability has been found in Behavioral Technology Group Pavlok Behavioral... |
critical | 9.6 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-18351 The Drag and Drop File Upload for Elementor Forms plugin for WordPress is vulner... |
critical | 9.8 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-4600 Versions of the package jsrsasign before 11.1.1 are vulnerable to Improper Verif... |
critical | 9.1 | — | Kjur / jsrsasign | 2026-03-23 | 2026-09-10 |
| CVE-2026-4601 Versions of the package jsrsasign before 11.1.1 are vulnerable to Missing Crypto... |
critical | 9.1 | — | Kjur / jsrsasign | 2026-03-23 | 2026-09-10 |
| CVE-2026-42044 Axios is a promise based HTTP client for the browser and Node.js. |
critical | 9.1 | — | Axios / axios | 2026-04-24 | 2026-09-10 |
| CVE-2026-42043 Axios is a promise based HTTP client for the browser and Node.js. |
critical | 10.0 | — | Axios / axios | 2026-04-24 | 2026-09-10 |
| CVE-2026-39892 cryptography is a package designed to expose cryptographic primitives and recipe... |
critical | 9.8 | — | Cryptography.io / cryptography | 2026-04-08 | 2026-09-10 |
| CVE-2026-28802 Authlib is a Python library which builds OAuth and OpenID Connect servers. |
critical | 9.8 | — | Authlib / authlib | 2026-03-06 | 2026-09-10 |
| CVE-2026-27606 Rollup is a module bundler for JavaScript. |
critical | 9.8 | — | Rollupjs / rollup | 2026-02-25 | 2026-09-10 |
| CVE-2026-27459 pyOpenSSL is a Python wrapper around the OpenSSL library. |
critical | 9.8 | — | Pyopenssl / pyopenssl | 2026-03-18 | 2026-09-10 |
| CVE-2024-22373 An out-of-bounds write vulnerability exists in the JPEG2000Codec::DecodeByStream... |
critical | 9.8 | — | Malaterre / grassroots dicom | 2024-04-25 | 2026-09-10 |
| CVE-2026-87643 Integer overflow in GPU in Google Chrome on on Android prior to 153.0.8010.36 al... |
critical | 9.6 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87646 Use after free in Web Authentication in Google Chrome prior to 153.0.8010.36 all... |
critical | 9.6 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87650 Out of bounds read in WebGL in Google Chrome prior to 153.0.8010.36 allowed a re... |
critical | 9.6 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87654 Buffer overflow in ANGLE in Google Chrome on on Windows prior to 153.0.8010.36 a... |
critical | 9.6 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87634 Use after free in WebPackaging in Google Chrome prior to 153.0.8010.36 allowed a... |
critical | 9.6 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87637 Use after free in Extensions in Google Chrome on on Mac prior to 153.0.8010.36 a... |
critical | 9.6 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87638 Out of bounds write in Media in Google Chrome prior to 153.0.8010.36 allowed a r... |
critical | 9.6 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87621 Out of bounds write in ANGLE in Google Chrome on on Windows prior to 153.0.8010.... |
critical | 9.6 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87607 Use after free in Device in Google Chrome on on Mac prior to 153.0.8010.36 allow... |
critical | 9.6 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87609 Use after free in Sharing in Google Chrome on on iOS prior to 153.0.8010.36 allo... |
critical | 9.6 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.