September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,364
Critical
1,230
High
4,374
Medium
4,126
Low
462
Severity not reported
1,172
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (964), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-72507 The "reportType" parameter in the product summary report feature within the bala... |
critical | 9.0 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-72510 The "supplier_no" parameter used in the business allocation search feature is vu... |
critical | 9.0 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-95277 Use after free in Views in Google Chrome prior to 154.0.8037.57 allowed a remote... |
critical | 9.6 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-102306 Use after free in Bluetooth in Google Chrome prior to 154.0.8037.92 allowed a re... |
critical | 9.6 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-102455 EasyFlow .NET developed by Digiwin has a Insecure Deserialization vulnerability. |
critical | 9.8 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-102458 EasyFlow .NET developed by Digiwin has a Missing Authentication vulnerability. |
critical | 9.8 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-95313 Use after free in Fullscreen in Google Chrome prior to 154.0.8037.57 allowed a r... |
critical | 9.6 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-95318 Buffer overflow in Video in Google Chrome prior to 154.0.8037.57 allowed a remot... |
critical | 9.6 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-75873 The Zella Theme WordPress theme before 2.6.3 does not perform any capability or... |
critical | 9.8 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-95325 Use after free in ANGLE in Google Chrome prior to 154.0.8037.57 allowed a remote... |
critical | 9.6 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-95331 Out of bounds write in ANGLE in Google Chrome prior to 154.0.8037.57 allowed a r... |
critical | 9.6 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-95339 Use after free in ServiceWorker in Google Chrome prior to 154.0.8037.57 allowed... |
critical | 9.6 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-95347 Use after free in Updater in Google Chrome on on Mac prior to 154.0.8037.57 allo... |
critical | 9.6 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-95356 Use after free in WindowDialog in Google Chrome prior to 154.0.8037.57 allowed a... |
critical | 9.6 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-102308 Use after free in Views in Google Chrome prior to 154.0.8037.92 allowed a remote... |
critical | 9.6 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-102309 Use after free in FullScreen in Google Chrome prior to 154.0.8037.92 allowed a r... |
critical | 9.6 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-82307 Improper neutralization of special elements used in an SQL command ('SQL injecti... |
critical | 9.8 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-18782 Improper neutralization of special elements used in an SQL command ('SQL injecti... |
critical | 9.8 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-94052 A missing check in LdapPasswordAuthenticator in component sshd-ldap in Apache MI... |
critical | 9.1 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-94053 Authentication bypass via LDAP injection in component sshd-ldap in Apache MINA S... |
critical | 9.1 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-102316 Use after free in Views in Google Chrome prior to 154.0.8037.92 allowed a remote... |
critical | 9.6 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-76183 Authentication Bypass by Alternate Name vulnerability in Apache Tomcat allowed t... |
critical | 9.8 | — | — | 2026-09-23 | 2026-09-30 |
| CVE-2026-103040 LightLLM through 1.2.0 contains a remote code execution vulnerability in the rou... |
critical | 9.8 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-95283 Buffer overflow in Tint in Google Chrome on on Android prior to 154.0.8037.57 al... |
critical | 9.6 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-95329 Out of bounds write in WebGL in Google Chrome on on Android prior to 154.0.8037.... |
critical | 9.6 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-97274 Unauthenticated Bypass Vulnerability in OAuth Single Sign On – SSO (OAuth Client... |
critical | 9.8 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-97248 Unauthenticated PHP Object Injection in Booking Activities <= 1.18.7.1 versions. |
critical | 9.8 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-97196 Improper Validation of Unsafe Equivalence in Input vulnerability in Liquid Web /... |
critical | 9.1 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-96822 Unauthenticated SQL Injection in Books Gallery <= 4.8.3 versions. |
critical | 9.3 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-96349 Unauthenticated Remote Code Execution (RCE) in SiteSkite <= 2.1.8 versions. |
critical | 10.0 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-96350 Subscriber Privilege Escalation in Estatik <= 4.3.5 versions. |
critical | 9.8 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-94389 Unauthenticated Remote Code Execution (RCE) in AcyMailing SMTP Newsletter <= 11.... |
critical | 9.0 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-6223 Improper restriction of excessive authentication attempts vulnerability in Bahçe... |
critical | 9.4 | — | — | 2026-09-07 | 2026-09-30 |
| CVE-2026-103041 LightLLM through 1.2.0 multimodal deployments expose an unauthenticated RPyC cac... |
critical | 9.8 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-102794 A vulnerability has been found in Ziroom ZHOME A0101 1.0.1.0. |
critical | 9.1 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-95350 Buffer overflow in ANGLE in Google Chrome on on Android prior to 154.0.8037.57 a... |
critical | 9.6 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-95357 Out of bounds write in GPU in Google Chrome on on Android prior to 154.0.8037.57... |
critical | 9.6 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-95349 Buffer overflow in WebGL in Google Chrome on on Android prior to 154.0.8037.57 a... |
critical | 9.6 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-102331 Buffer overflow in ANGLE in Google Chrome on on Android prior to 154.0.8037.92 a... |
critical | 9.6 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-69356 Improper neutralization of input during web page generation ('cross-site scripti... |
critical | 9.3 | — | Microsoft / exchange server | 2026-09-08 | 2026-09-30 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.