September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,321
Critical
1,226
High
4,361
Medium
4,108
Low
460
Severity not reported
1,166
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (964), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-71374 Deserialization of untrusted data vulnerability in Cosminexus Component Containe... |
critical | 9.8 | — | — | 2026-09-08 | 2026-09-08 |
| CVE-2026-71376 OS command injection vulnerability in Cosminexus Component Container. |
critical | 9.8 | — | — | 2026-09-08 | 2026-09-08 |
| CVE-2026-71377 Command Argument Injection Vulnerability in Cosminexus Component Container. |
critical | 9.8 | — | — | 2026-09-08 | 2026-09-08 |
| CVE-2026-86165 A vulnerability was found in Tenda HG10 300001138. |
critical | 9.8 | — | — | 2026-09-06 | 2026-09-08 |
| CVE-2026-79697 A vulnerability was determined in Advantech WISE-6610-NB, WISE-6610-EB, WISE-661... |
critical | 9.9 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-19274 IBM Observability with Instana (Agent) Build 1.0.303 through 1.0.323 IBM Instana... |
critical | 9.6 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-85085 The Canva Android App before 2.376.0 allowed an external origin to be loaded in... |
critical | 9.6 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-13447 The Mstore Api plugin for WordPress is vulnerable to Authentication Bypass via J... |
critical | 9.8 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-83627 The Hummingbird – Speed Optimization, Caching, Minify, Compress & CDN plugin for... |
critical | 9.8 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-10196 The Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emai... |
critical | 9.8 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-16310 The MemberDash plugin for WordPress is vulnerable to Insecure Direct Object Refe... |
critical | 9.8 | — | — | 2026-09-06 | 2026-09-08 |
| CVE-2026-75816 The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Authentic... |
critical | 9.8 | — | — | 2026-09-06 | 2026-09-08 |
| CVE-2026-33211 Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style... |
critical | 9.6 | — | Linuxfoundation / tekton pipelines | 2026-03-24 | 2026-09-07 |
| CVE-2026-84238 Unauthenticated Broken Access Control in YITH Request a Quote for WooCommerce Pr... |
critical | 9.8 | — | — | 2026-09-03 | 2026-09-07 |
| CVE-2026-84834 Unauthenticated PHP Object Injection in JobSearch <= 3.2.0 versions. |
critical | 9.8 | — | — | 2026-09-03 | 2026-09-07 |
| CVE-2026-11613 The Divi Ajax Filter plugin for WordPress is vulnerable to Local File Inclusion... |
critical | 9.8 | — | — | 2026-09-04 | 2026-09-07 |
| CVE-2026-84753 Unauthenticated PHP Object Injection in Mail Mint <= 1.31.0 versions. |
critical | 9.8 | — | — | 2026-09-03 | 2026-09-05 |
| CVE-2026-72676 Improper Control of Generation of Code ('Code Injection') (CWE-94) in Fleet Serv... |
critical | 9.1 | — | Elastic / kibana | 2026-08-13 | 2026-09-04 |
| CVE-2026-19766 An authentication bypass vulnerability exists in the underlying operating system... |
critical | 9.6 | — | Arubanetworks / fabric composer | 2026-09-01 | 2026-09-04 |
| CVE-2025-15379 A command injection vulnerability exists in MLflow's model serving container ini... |
critical | 10.0 | — | Lfprojects / mlflow | 2026-03-30 | 2026-09-04 |
| CVE-2026-47837 Missing Authentication for Critical Function vulnerability in Spring Spring Clou... |
critical | 9.8 | — | Vmware / spring cloud config | 2026-08-26 | 2026-09-04 |
| CVE-2026-85224 A vulnerability was determined in D-Link DNS-320 ShareCenter 2.06B01. |
critical | 9.1 | — | — | 2026-09-03 | 2026-09-04 |
| CVE-2026-85223 A vulnerability was found in D-Link DNS-340L 1.01B04. |
critical | 9.9 | — | — | 2026-09-03 | 2026-09-04 |
| CVE-2026-84813 Unauthenticated SQL Injection in GeoDirectory <= 2.8.174 versions. |
critical | 9.3 | — | — | 2026-09-03 | 2026-09-04 |
| CVE-2026-85222 A vulnerability has been found in D-Link DNS-340L 1.01B04. |
critical | 9.1 | — | — | 2026-09-03 | 2026-09-04 |
| CVE-2019-3773 Spring Web Services, versions 2.4.3, 3.0.4, and older unsupported versions of al... |
critical | 9.8 | — | Broadcom / spring web services | 2019-01-18 | 2026-09-04 |
| CVE-2026-33228 flatted is a circular JSON parser. |
critical | 9.8 | — | Webreflection / flatted | 2026-03-20 | 2026-09-04 |
| CVE-2026-81286 Unauthenticated SQL Injection in WCFM Marketplace <= 3.8.1 versions. |
critical | 9.3 | — | — | 2026-09-02 | 2026-09-04 |
| CVE-2026-84637 Malicious calendar invitations could use file URI attachments to launch local or... |
critical | 9.8 | — | Mozilla / thunderbird | 2026-09-01 | 2026-09-03 |
| CVE-2026-84639 Triggering an error condition in certain MIME bodies would cause uninitialized m... |
critical | 9.1 | — | Mozilla / thunderbird | 2026-09-01 | 2026-09-03 |
| CVE-2026-84133 Site isolation issue in the DOM: Push Subscriptions component. |
critical | 9.8 | — | Mozilla / firefox | 2026-09-01 | 2026-09-03 |
| CVE-2026-84134 Other issue in the Profile Backup component. |
critical | 9.8 | — | Mozilla / firefox | 2026-09-01 | 2026-09-03 |
| CVE-2026-84814 Subscriber Privilege Escalation in Bricksforge <= 3.1.8.8 versions. |
critical | 9.8 | — | — | 2026-09-03 | 2026-09-03 |
| CVE-2026-84768 Unauthenticated SQL Injection in VikAppointments Services Booking Calendar <= 1.... |
critical | 9.3 | — | — | 2026-09-03 | 2026-09-03 |
| CVE-2026-84143 Internally found bugs present in Thunderbird 154, Thunderbird ESR 153.1 and Thun... |
critical | 9.8 | — | Mozilla / firefox | 2026-09-01 | 2026-09-03 |
| CVE-2026-84140 Site isolation issue in the DOM: Navigation component. |
critical | 9.8 | — | Mozilla / firefox | 2026-09-01 | 2026-09-03 |
| CVE-2026-84141 Integer overflow in the Graphics: ImageLib component. |
critical | 9.8 | — | Mozilla / firefox | 2026-09-01 | 2026-09-03 |
| CVE-2026-84142 Internally found bugs present in Thunderbird 154. |
critical | 9.8 | — | Mozilla / firefox | 2026-09-01 | 2026-09-03 |
| CVE-2026-84135 Other issue in Firefox Focus for Android. |
critical | 9.8 | — | Mozilla / firefox mobile | 2026-09-01 | 2026-09-03 |
| CVE-2026-51754 Incorrect access control in the updateSlaveIpList function of TOTOLINK T6 4.1.5c... |
critical | 9.8 | — | — | 2026-09-01 | 2026-09-03 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.