September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,321
Critical
1,226
High
4,361
Medium
4,108
Low
460
Severity not reported
1,166
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (964), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-87494 Use after free in Browser in Google Chrome on on Windows prior to 153.0.8010.36... |
critical | 9.6 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-52766 YesWiki is a wiki system written in PHP. |
critical | 9.1 | — | — | 2026-09-05 | 2026-09-09 |
| CVE-2026-79570 mfish-nocode-pro v1.0.0 was discovered to contain a SQL injection vulnerability... |
critical | 9.8 | — | — | 2026-09-08 | 2026-09-09 |
| CVE-2026-78745 An issue in HiDPT/ Weyon HiDPTAndroid Hi3751V350 Hi3751V352E_DMO allows a remote... |
critical | 9.8 | — | — | 2026-09-04 | 2026-09-09 |
| CVE-2026-71624 An issue in esoTalk v.1.0.0g4 allows a remote attacker to execute arbitrary code... |
critical | 9.8 | — | — | 2026-09-04 | 2026-09-09 |
| CVE-2026-79391 No authentication exists in the MQTT service of Trueview 6.0.23.4. |
critical | 9.8 | — | — | 2026-09-04 | 2026-09-09 |
| CVE-2026-79576 An issue in the Single-Sign On (SSO) component of Digital-Infrastructure v9.6.7... |
critical | 9.8 | — | — | 2026-09-08 | 2026-09-09 |
| CVE-2026-79569 Movie_Recommend v1.0.0 was discovered to contain a SQL injection vulnerability i... |
critical | 9.8 | — | — | 2026-09-08 | 2026-09-09 |
| CVE-2026-85978 An unauthenticated remote code execution vulnerability exists in the Policy Mana... |
critical | 9.8 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-86419 Affected versions of MISP contain insufficient validation of server-side outboun... |
critical | 9.1 | — | Misp-project / misp | 2026-09-07 | 2026-09-09 |
| CVE-2026-76201 Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability... |
critical | 9.3 | — | Adobe / commerce | 2026-09-08 | 2026-09-09 |
| CVE-2026-76200 Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability... |
critical | 9.3 | — | Adobe / magento | 2026-09-08 | 2026-09-09 |
| CVE-2026-41242 protobufjs compiles protobuf definitions into JavaScript (JS) functions. |
critical | 9.8 | — | Protobufjs Project / protobufjs | 2026-04-18 | 2026-09-09 |
| CVE-2026-7861 Deserialization of untrusted data vulnerability in Next4Biz Information Technolo... |
critical | 9.8 | — | — | 2026-09-07 | 2026-09-09 |
| CVE-2026-86218 N-able N-central Static Code Injection Vulnerability |
critical | 9.8 | Listed | N-able / N-central | 2026-09-06 | 2026-09-09 |
| CVE-2026-86478 In JetBrains YouTrack before 2025.3.161254,
2026.1.14042 improper authenticatio... |
critical | 9.8 | — | — | 2026-09-07 | 2026-09-09 |
| CVE-2026-86480 In JetBrains Hub before 2026.2.52442 an unauthenticated attacker could register... |
critical | 9.8 | — | — | 2026-09-07 | 2026-09-09 |
| CVE-2026-75650 Adobe Commerce and Magento Improper Neutralization of Special Elements Used in a... |
critical | 10.0 | Listed | Adobe / Commerce and Magento | 2026-09-07 | 2026-09-09 |
| CVE-2026-66768 SAP GUI for Java does not correctly enforce the trust level policy for certain f... |
critical | 9.0 | — | — | 2026-09-08 | 2026-09-09 |
| CVE-2026-58240 SAP NetWeaver Message Server does not sufficiently validate the authenticity of... |
critical | 9.8 | — | — | 2026-09-08 | 2026-09-09 |
| CVE-2025-14733 WatchGuard Firebox Out of Bounds Write Vulnerability |
critical | 9.8 | Listed | WatchGuard / Firebox | 2025-12-19 | 2026-09-09 |
| CVE-2026-8376 Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 befo... |
critical | 9.8 | — | Perl / perl | 2026-05-26 | 2026-09-08 |
| CVE-2023-54391 Proxmox Virtual Environment (VE) 7.0 through 8.0 contains an authentication bypa... |
critical | 9.8 | — | — | 2026-09-01 | 2026-09-08 |
| CVE-2026-84479 WWBN AVideo (current e01e41ecc and earlier) makes three login-time security cont... |
critical | 9.1 | — | — | 2026-09-01 | 2026-09-08 |
| CVE-2026-84480 WWBN AVideo fails to validate password recovery token expiration in userRecoverP... |
critical | 9.8 | — | — | 2026-09-01 | 2026-09-08 |
| CVE-2026-85154 WWBN AVideo contains an authentication failure vulnerability where the video_id_... |
critical | 9.8 | — | — | 2026-09-03 | 2026-09-08 |
| CVE-2026-82526 R2R through 3.6.6 contains a stacked SQL injection vulnerability that allows una... |
critical | 9.8 | — | — | 2026-09-03 | 2026-09-08 |
| CVE-2026-85426 MOOS-IvP uMemWatch through 24.8.1 constructs shell commands from attacker-chosen... |
critical | 9.8 | — | — | 2026-09-03 | 2026-09-08 |
| CVE-2026-86190 WWBN AVideo contains a broken access control vulnerability in videoViewsInfo end... |
critical | 9.1 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-18664 When ranges are used for access control (i.e. |
critical | 9.1 | — | Nlnetlabs / nsd | 2026-08-26 | 2026-09-08 |
| CVE-2026-86542 knowns before 0.30.0 fails to validate import names in the import routes, allowi... |
critical | 9.1 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-52111 An issue in fast-note-sync-service <=2.13.7 allows a remote attacker to escalate... |
critical | 9.8 | — | — | 2026-09-01 | 2026-09-08 |
| CVE-2026-85504 FreeIPMI before 1.6.19 has a stack-based buffer overflow in _ipmi_sel_oem_fujits... |
critical | 9.8 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-85508 ipmi-oem in FreeIPMI before 1.6.19 has a stack-based buffer overflow in _output_... |
critical | 9.8 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-85509 FreeIPMI before 1.6.19 has a stack-based buffer overflow in _read_fru_data in li... |
critical | 9.8 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-75160 An issue in X-Serie Gateway Firmware V6_00_05 allows a remote attacker to escala... |
critical | 9.1 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-75431 PowerJob Server version 5.1.2 (and likely earlier) uses a predictable JWT signin... |
critical | 9.1 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-31020 In DocsGPT 0.15.0 and below, the application provides a custom prompt feature th... |
critical | 9.8 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-75430 PowerJob Worker version 5.1.2 (and likely earlier versions) exposes the /worker/... |
critical | 9.8 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-18221 IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to gain unauthorized... |
critical | 9.8 | — | Ibm / i | 2026-09-04 | 2026-09-08 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.