September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,321
Critical
1,226
High
4,361
Medium
4,108
Low
460
Severity not reported
1,166
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (964), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-86304 MojoX::Authentication versions before 0.006 for Perl allow SAML authentication b... |
critical | 9.8 | — | — | 2026-09-06 | 2026-09-08 |
| CVE-2026-86219 Authen::SASL::Perl::DIGEST_MD5 versions before 2.2100 for Perl accept replayed a... |
critical | 9.8 | — | — | 2026-09-06 | 2026-09-08 |
| CVE-2026-86149 A weakness has been identified in Tenda CP3 27.5.57.101. |
critical | 9.1 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-80181 Apache Allura's webhooks are vulnerable to Server-Side Request Forgery (SSRF). |
critical | 9.1 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-78327 An Improper Neutralization of Special Elements used in an OS Command ('OS Comman... |
critical | 9.1 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-78328 A missing authorization vulnerability in the SonicWall Network Security Manager... |
critical | 9.1 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-81939 A Zip Slip vulnerability in the SonicWall Network Security Manager (NSM) On-Prem... |
critical | 9.1 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-76969 @sap/cds-mtxs NPM library does not perform sufficient checks on certain function... |
critical | 9.4 | — | — | 2026-09-08 | 2026-09-08 |
| CVE-2026-85146 SmartIT Desktop Manager developed by Lightstar has a Use of Hard-coded Credentia... |
critical | 9.8 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-85148 SmartIT Desktop Manager developed by Lightstar has a Use of Hard-coded Credentia... |
critical | 9.8 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-82923 The AI Website Builder WordPress plugin (GitHub build) 1.0.0 does not perform an... |
critical | 9.8 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-78362 The SEO Flow by LupsOnline WordPress plugin before 3.0.3 does not correctly vali... |
critical | 9.8 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-78234 A flaw was found in hawtio-operator. |
critical | 9.9 | — | — | 2026-09-08 | 2026-09-08 |
| CVE-2025-67038 Lantronix EDS5000 Code Injection Vulnerability |
critical | 9.8 | Listed | Lantronix / EDS5000 | 2026-03-11 | 2026-09-08 |
| CVE-2026-50093 A vulnerability has been identified in Siveillance Control Pro V3.0 (All version... |
critical | 9.0 | — | — | 2026-09-08 | 2026-09-08 |
| CVE-2026-62645 A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). |
critical | 9.8 | — | — | 2026-09-08 | 2026-09-08 |
| CVE-2026-62928 XING CPTrans-ME-X contains an OS Command Injection (CWE-78). |
critical | 9.8 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-69657 XING CPTrans-ME-X contains a Use of Default Password (CWE-1393). |
critical | 9.8 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-70403 XING CPTrans-ME-X contains a Use of Hard-coded Password (CWE-259). |
critical | 9.8 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-26084 A improper access control vulnerability in Fortinet FortiSandbox 5.0.0 through 5... |
critical | 9.9 | — | — | 2026-09-08 | 2026-09-08 |
| CVE-2026-86148 A security flaw has been discovered in Tenda CP3 27.5.57.101. |
critical | 9.1 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-86153 A vulnerability has been found in Tenda CP3 27.5.57.101. |
critical | 9.1 | — | — | 2026-09-06 | 2026-09-08 |
| CVE-2026-86167 A vulnerability was identified in Tenda HG10 300001138. |
critical | 9.9 | — | — | 2026-09-06 | 2026-09-08 |
| CVE-2026-17057 IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of... |
critical | 9.1 | — | Ibm / i | 2026-09-04 | 2026-09-08 |
| CVE-2026-80098 Improper verification of cryptographic signature in Copilot Studio allows an una... |
critical | 10.0 | — | Microsoft / copilot studio | 2026-09-03 | 2026-09-08 |
| CVE-2026-84333 Use after free in Dawn in Google Chrome on on Android prior to 152.0.7977.75 all... |
critical | 9.6 | — | Google / chrome | 2026-09-02 | 2026-09-08 |
| CVE-2026-65818 Server-side request forgery (ssrf) in Power Automate allows an authorized attack... |
critical | 9.9 | — | Microsoft / power platform | 2026-09-03 | 2026-09-08 |
| CVE-2026-84352 Use after free in WebGL in Google Chrome on on Android prior to 152.0.7977.75 al... |
critical | 9.6 | — | Google / chrome | 2026-09-02 | 2026-09-08 |
| CVE-2026-84353 Use after free in Shared Tab Groups in Google Chrome on on Android prior to 152.... |
critical | 9.6 | — | Google / chrome | 2026-09-02 | 2026-09-08 |
| CVE-2026-17207 IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of... |
critical | 9.1 | — | Ibm / i | 2026-09-04 | 2026-09-08 |
| CVE-2026-86296 A vulnerability was determined in D-Link DIR-822A A_101. |
critical | 10.0 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-86510 A vulnerability has been found in D-Link DIR-822A A_101. |
critical | 9.9 | — | — | 2026-09-08 | 2026-09-08 |
| CVE-2026-62916 Authentication bypass using an alternate path or channel in Microsoft Entra ID a... |
critical | 9.8 | — | Microsoft / entra id | 2026-09-03 | 2026-09-08 |
| CVE-2026-85042 Use after free in DevTools in Google Chrome prior to 152.0.7977.82 allowed a rem... |
critical | 9.6 | — | Google / chrome | 2026-09-03 | 2026-09-08 |
| CVE-2026-85043 Incomplete cleanup in Network in Google Chrome prior to 152.0.7977.82 allowed a... |
critical | 9.1 | — | Google / chrome | 2026-09-03 | 2026-09-08 |
| CVE-2026-85047 Improper input validation in Transactions Platform in Google Chrome on on iOS pr... |
critical | 9.6 | — | Google / chrome | 2026-09-03 | 2026-09-08 |
| CVE-2026-85050 Out of bounds write in WebGL in Google Chrome on on Android prior to 152.0.7977.... |
critical | 9.6 | — | Google / chrome | 2026-09-03 | 2026-09-08 |
| CVE-2026-78012 An issue in the NetStaX EtherNet/IP Stack prior to v5.6.1 could allow a large Cl... |
critical | 9.8 | — | — | 2026-09-01 | 2026-09-08 |
| CVE-2026-75925 Improper neutralization of CRLF sequences in IXON VPN Client before version 1.4.... |
critical | 9.6 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-73475 Incorrect Authorization vulnerability in Drupal Commerce PayPal allows Forceful... |
critical | 9.1 | — | Centarro / commerce paypal | 2026-09-02 | 2026-09-08 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.