September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,326
Critical
1,227
High
4,361
Medium
4,108
Low
460
Severity not reported
1,170
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (964), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-14297 A buffer overflow in the Bluetooth Continuous Glucose
Monitoring Service (CGMS)... |
not reported | — | — | — | 2026-09-07 | 2026-09-09 |
| CVE-2026-18796 Any application that
uses external QSPI flash for encrypted XIP on nRF5340 and... |
not reported | — | — | — | 2026-09-07 | 2026-09-09 |
| CVE-2026-19614 The API is prone to XML external entity (XXE) injection. |
not reported | — | — | — | 2026-09-08 | 2026-09-09 |
| CVE-2026-79989 The vulnerability allows any authenticated user to change their own password wit... |
not reported | — | — | — | 2026-09-02 | 2026-09-09 |
| CVE-2026-67402 An insecure Apache configuration in ConfigServer Security & Firewall maps /usr/b... |
not reported | — | — | — | 2026-09-04 | 2026-09-09 |
| CVE-2026-79721 Code execution can occur in versions of the MLflow platform running version 0.0.... |
not reported | — | — | — | 2026-09-08 | 2026-09-09 |
| CVE-2026-12858 Improper Privilege Management vulnerability in ESET AV Remover (standalone) allo... |
not reported | — | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-87827 Certain KGUARD DVR devices running vulnerable firmware expose a system command e... |
not reported | — | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-12611 A client may issue HTTP/2 requests to a Jetty server that result in blocking wri... |
not reported | — | — | — | 2026-09-08 | 2026-09-09 |
| CVE-2026-83605 xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser... |
not reported | — | — | — | 2026-09-01 | 2026-09-08 |
| CVE-2026-83606 xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser... |
not reported | — | — | — | 2026-09-01 | 2026-09-08 |
| CVE-2026-83607 xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser... |
not reported | — | — | — | 2026-09-01 | 2026-09-08 |
| CVE-2026-83608 xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser... |
not reported | — | — | — | 2026-09-01 | 2026-09-08 |
| CVE-2026-83609 xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser... |
not reported | — | — | — | 2026-09-01 | 2026-09-08 |
| CVE-2026-83610 xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser... |
not reported | — | — | — | 2026-09-01 | 2026-09-08 |
| CVE-2026-83611 xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser... |
not reported | — | — | — | 2026-09-01 | 2026-09-08 |
| CVE-2026-83612 xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser... |
not reported | — | — | — | 2026-09-01 | 2026-09-08 |
| CVE-2026-83613 xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser... |
not reported | — | — | — | 2026-09-01 | 2026-09-08 |
| CVE-2026-83614 xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser... |
not reported | — | — | — | 2026-09-01 | 2026-09-08 |
| CVE-2026-83615 xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser... |
not reported | — | — | — | 2026-09-01 | 2026-09-08 |
| CVE-2026-83616 xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser... |
not reported | — | — | — | 2026-09-01 | 2026-09-08 |
| CVE-2026-83617 xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser... |
not reported | — | — | — | 2026-09-01 | 2026-09-08 |
| CVE-2026-83618 xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser... |
not reported | — | — | — | 2026-09-01 | 2026-09-08 |
| CVE-2026-83619 xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser... |
not reported | — | — | — | 2026-09-01 | 2026-09-08 |
| CVE-2026-53757 Emlog is an open source website building system. |
not reported | — | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-73848 Emlog is an open source website building system. |
not reported | — | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-53602 nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. |
not reported | — | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-53603 nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. |
not reported | — | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-53604 nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. |
not reported | — | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-52762 YesWiki is a wiki system written in PHP. |
not reported | — | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-52777 YesWiki is a wiki system written in PHP. |
not reported | — | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-84193 LibreNMS through 26.2.0 contains a stored cross-site scripting vulnerability in... |
not reported | — | — | — | 2026-09-01 | 2026-09-08 |
| CVE-2026-84194 LibreNMS versions >= 23.10.0 and < 26.2.0 (fixed in 26.4.0) contain an authentic... |
not reported | — | — | — | 2026-09-01 | 2026-09-08 |
| CVE-2026-84481 WWBN AVideo through 30.0 contains an information disclosure vulnerability in the... |
not reported | — | — | — | 2026-09-01 | 2026-09-08 |
| CVE-2026-85587 phpMyFAQ before 4.1.8 enforces incorrect permission checks on admin content page... |
not reported | — | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-85589 phpMyFAQ before 4.2.0-alpha.2 contains a missing authorization vulnerability in... |
not reported | — | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-85590 phpMyFAQ before 4.1.8 contains an authentication bypass vulnerability in its two... |
not reported | — | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-86193 grav-plugin-api before 1.0.20 fails to validate group-inherited super permission... |
not reported | — | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-86195 grav-plugin-api versions before 1.0.20 contain a privilege escalation vulnerabil... |
not reported | — | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-86196 Grav API plugin versions before 1.0.20 build password reset links from the untru... |
not reported | — | — | — | 2026-09-05 | 2026-09-08 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.