September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,364
Critical
1,230
High
4,374
Medium
4,126
Low
462
Severity not reported
1,172
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (964), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-0307 Multiple local privilege escalation vulnerabilities in the Palo Alto Networks Gl... |
not reported | — | — | — | 2026-09-10 | 2026-09-11 |
| CVE-2026-0304 A privilege escalation vulnerability in Palo Alto Networks Cortex XDR Broker VM... |
not reported | — | — | — | 2026-09-10 | 2026-09-11 |
| CVE-2026-19820 A vulnerability in the Backblaze Client allows a local user to make the system n... |
not reported | — | — | — | 2026-09-01 | 2026-09-11 |
| CVE-2026-84432 Concrete CMS 9 through 9.5.2 did not validate an anti-CSRF token in the Boards c... |
not reported | — | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-53933 Maravel, a PHP framework oriented towards dependency injection, prior to version... |
not reported | — | — | — | 2026-09-08 | 2026-09-10 |
| CVE-2026-55250 Maravel, a PHP framework oriented towards dependency injection, prior to version... |
not reported | — | — | — | 2026-09-08 | 2026-09-10 |
| CVE-2026-17038 DrEryk Gabinet before 11.5.0 uses hard-coded API credentials in its ticket repor... |
not reported | — | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-68527 Concrete CMS versions 8.3.0 through 9.5.2 are vulnerable to an authorization byp... |
not reported | — | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-65638 Improper escaping of a request URL in ConfigServer Security & Firewall allows an... |
not reported | — | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-65639 OS command injection in the advanced-rule parser of ConfigServer Security & Fire... |
not reported | — | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-15417 In the silabser.sys Windows 8 driver for CP210x devices, a local unprivileged us... |
not reported | — | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-15418 In the silabser.sys driver for CP210x devices v11.5.0 and earlier, a local unpri... |
not reported | — | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-15419 In the silabser.sys driver for CP210x devices v11.5.0 and earlier, a local unpri... |
not reported | — | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-88915 Affected versions of MISP do not consistently enforce the acting user's authoriz... |
not reported | — | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-50165 alf.io is an open source ticket reservation system for conferences, trade shows,... |
not reported | — | — | — | 2026-09-09 | 2026-09-10 |
| CVE-2026-88921 MISP contains an HTML injection vulnerability in the MISPElementHTMLFormatterToo... |
not reported | — | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-85586 phpMyFAQ versions before 4.1.8 fail to validate CAPTCHA when the store parameter... |
not reported | — | — | — | 2026-09-04 | 2026-09-10 |
| CVE-2026-85591 phpMyFAQ versions before 4.1.8 contain an authentication bypass vulnerability in... |
not reported | — | — | — | 2026-09-04 | 2026-09-10 |
| CVE-2026-47156 MantisBT is an open source bug tracker. |
not reported | — | — | — | 2026-09-09 | 2026-09-10 |
| CVE-2026-88069 Pandora contains a path traversal vulnerability in its archive extraction worker... |
not reported | — | — | — | 2026-09-09 | 2026-09-10 |
| CVE-2026-81904 Concrete CMS below 9.5.3 registered view assets for every sub-block of a Stack,... |
not reported | — | — | — | 2026-09-08 | 2026-09-10 |
| CVE-2026-21111 Out-of-bounds write in libsthmbc.so prior to One UI 8.5 allows local attackers t... |
not reported | — | — | — | 2026-09-09 | 2026-09-10 |
| CVE-2026-21106 Improper verification of intent by broadcast receiver in Samsung Cloud Assistant... |
not reported | — | — | — | 2026-09-09 | 2026-09-10 |
| CVE-2026-21109 Improper access control in Watch Plugin prior to Android Watch 17 allows local a... |
not reported | — | — | — | 2026-09-09 | 2026-09-10 |
| CVE-2026-21110 Out-of-bounds write in libsavscmn.so prior to One UI 8.5 allows local attackers... |
not reported | — | — | — | 2026-09-09 | 2026-09-10 |
| CVE-2026-78082 Joomla Extension - joomshaper.com - Unauthenticated SQL Injection in Property Se... |
not reported | — | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-78083 Joomla Extension - joomshaper.com - Missing CSRF Token Verification in Property... |
not reported | — | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-78084 Joomla Extension - joomshaper.com - Missing Access Control in Gallery Image Mana... |
not reported | — | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-78302 Joomla Extension - joomshaper.com - Unauthenticated Stored Cross-Site Scripting... |
not reported | — | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-78303 Joomla Extension - joomshaper.com - Unvalidated Email Destination & Form Manipul... |
not reported | — | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-78374 Joomla Extension - joomlart.com - Open mail relay via contact AJAX endpoint in T... |
not reported | — | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-78085 Joomla Extension - joomshaper.com - Path Traversal in Gallery Image Management i... |
not reported | — | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-0305 An information disclosure vulnerability in the Palo Alto Networks Prisma® Access... |
not reported | — | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-0306 A vulnerability in the EndPoint Data Loss Prevention (DLP) enforcement of Palo A... |
not reported | — | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-0302 An OS command injection vulnerability in Palo Alto Networks Checkov by Prisma® C... |
not reported | — | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-0303 A code execution vulnerability in Palo Alto Networks Checkov by Prisma® Cloud ca... |
not reported | — | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-85546 MISP contains a cross-site request forgery (CSRF) vulnerability in the sharing g... |
not reported | — | — | — | 2026-09-04 | 2026-09-10 |
| CVE-2026-87804 Rejected reason: no security impact |
not reported | — | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-85384 A stack-based buffer overflow vulnerability exists in the httpd component of RE2... |
not reported | — | — | — | 2026-09-08 | 2026-09-10 |
| CVE-2026-8044 CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument I... |
not reported | — | — | — | 2026-09-09 | 2026-09-09 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.