September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,321
Critical
1,226
High
4,361
Medium
4,108
Low
460
Severity not reported
1,166
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (964), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-51762 Incorrect access control in the meshInfoKick function of TOTOLINK T6 4.1.5cu.748... |
critical | 9.8 | — | — | 2026-09-01 | 2026-09-03 |
| CVE-2026-51767 Incorrect access control in the recvClearPairCfg function of TOTOLINK T6 4.1.5cu... |
critical | 9.8 | — | — | 2026-09-01 | 2026-09-03 |
| CVE-2026-51741 Incorrect access control in the clearDiagnosisLog function of TOTOLINK T6 4.1.5c... |
critical | 9.8 | — | — | 2026-09-01 | 2026-09-03 |
| CVE-2026-51747 Incorrect access control in the keepAlive function of TOTOLINK T6 4.1.5cu.748_B2... |
critical | 9.8 | — | — | 2026-09-01 | 2026-09-03 |
| CVE-2026-4357 The Embed HTML5 Game WordPress plugin through 1.3 does not properly restrict who... |
critical | 10.0 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-77009 The WatchMan-Site7 WordPress plugin through 4.2.0 does not restrict access to it... |
critical | 9.9 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-84354 Incorrect authorization in FileSystem in Google Chrome prior to 152.0.7977.75 al... |
critical | 9.6 | — | Google / chrome | 2026-09-02 | 2026-09-03 |
| CVE-2026-85031 A vulnerability was found in TOTOLINK CP450 4.1.0. |
critical | 9.9 | — | — | 2026-09-03 | 2026-09-03 |
| CVE-2026-85109 A vulnerability was determined in Tenda HG10 300001138. |
critical | 9.8 | — | — | 2026-09-03 | 2026-09-03 |
| CVE-2026-51744 Incorrect access control in the recv_mesh_info_sync function of TOTOLINK T6 4.1.... |
critical | 9.8 | — | — | 2026-09-01 | 2026-09-03 |
| CVE-2026-51750 Incorrect access control in the updatePriChannel function of TOTOLINK T6 4.1.5cu... |
critical | 9.8 | — | — | 2026-09-01 | 2026-09-03 |
| CVE-2026-51751 Incorrect access control in the delSlaveDevice function of TOTOLINK T6 4.1.5cu.7... |
critical | 9.8 | — | — | 2026-09-01 | 2026-09-03 |
| CVE-2026-51757 Incorrect access control in the meshSlaveUpdate function of TOTOLINK T6 4.1.5cu.... |
critical | 9.8 | — | — | 2026-09-01 | 2026-09-03 |
| CVE-2026-51760 Incorrect access control in the informSyncUpgfw function of TOTOLINK T6 4.1.5cu.... |
critical | 9.8 | — | — | 2026-09-01 | 2026-09-03 |
| CVE-2026-51763 Incorrect access control in the freeStaClient function of TOTOLINK T6 4.1.5cu.74... |
critical | 9.8 | — | — | 2026-09-01 | 2026-09-03 |
| CVE-2026-51764 Incorrect access control in the recvSlaveCloudCheckStatus function of TOTOLINK T... |
critical | 9.8 | — | — | 2026-09-01 | 2026-09-03 |
| CVE-2026-84324 Use after free in Proxy in Google Chrome prior to 152.0.7977.75 allowed a remote... |
critical | 9.0 | — | Google / chrome | 2026-09-02 | 2026-09-03 |
| CVE-2026-84325 Improper input validation in DataTransfer in Google Chrome prior to 152.0.7977.7... |
critical | 9.8 | — | Google / chrome | 2026-09-02 | 2026-09-03 |
| CVE-2026-19117 Under specific conditions, an attacker can register an attacker-controlled FIDO2... |
critical | 9.8 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-9698 DBI versions before 1.648 for Perl saved errors in a limited-sized buffer. |
critical | 9.8 | — | Perl / dbi | 2026-06-09 | 2026-09-03 |
| CVE-2026-83548 SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability |
critical | 10.0 | Listed | SonicWall / SMA1000 Appliances | 2026-09-01 | 2026-09-03 |
| CVE-2026-82329 JFrog Artifactory Improper Authentication Vulnerability |
critical | 9.8 | Listed | JFrog / Artifactory | 2026-08-28 | 2026-09-03 |
| CVE-2026-20212 A vulnerability in the Silicon One integration for Cisco Nexus 9000 Series Switc... |
critical | 9.8 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-84129 Site isolation issue in the DOM: Navigation component. |
critical | 9.8 | — | Mozilla / firefox | 2026-09-01 | 2026-09-03 |
| CVE-2023-7299 A vulnerability was found in DataGear up to 4.60. |
critical | 9.8 | — | Datagear / datagear | 2024-11-23 | 2026-09-03 |
| CVE-2023-7249 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') v... |
critical | 9.8 | — | Opentext / directory services | 2024-08-12 | 2026-09-03 |
| CVE-2026-51769 Incorrect access control in the remoteCloudUpdateCheck function of TOTOLINK T6 4... |
critical | 9.8 | — | — | 2026-09-01 | 2026-09-02 |
| CVE-2026-51765 Incorrect access control in the recvIndirectMeshInfo function of TOTOLINK T6 4.1... |
critical | 9.8 | — | — | 2026-09-01 | 2026-09-02 |
| CVE-2026-51770 Incorrect access control in the sendToMasterQosConfig function of TOTOLINK T6 4.... |
critical | 9.8 | — | — | 2026-09-01 | 2026-09-02 |
| CVE-2026-18550 The Nokri - Job Board WordPress Theme for WordPress is vulnerable to Privilege E... |
critical | 9.8 | — | — | 2026-09-01 | 2026-09-02 |
| CVE-2026-84119 Sandbox escape due to use-after-free in the DOM: Navigation component. |
critical | 9.6 | — | Mozilla / firefox | 2026-09-01 | 2026-09-02 |
| CVE-2026-84121 Sandbox escape due to use-after-free in the DOM: Security component. |
critical | 9.6 | — | Mozilla / firefox | 2026-09-01 | 2026-09-02 |
| CVE-2026-73700 A vulnerability in the web-based management interface of HPE Networking Fabric C... |
critical | 9.0 | — | Arubanetworks / fabric composer | 2026-09-01 | 2026-09-02 |
| CVE-2026-73701 An unauthenticated remote code execution vulnerability exists in the underlying... |
critical | 9.0 | — | Arubanetworks / fabric composer | 2026-09-01 | 2026-09-02 |
| CVE-2026-51934 Buffer Overflow vulnerability in Shenzhen Jixiang Tengda Technology Co., Ltd. |
critical | 9.8 | — | — | 2026-09-01 | 2026-09-02 |
| CVE-2026-47864 SerializingHttpMessageConverter deserializes the body of incoming HTTP requests... |
critical | 9.8 | — | Vmware / spring integration | 2026-08-27 | 2026-09-02 |
| CVE-2026-47875 Applications that deserialize execution contexts with Jackson2ExecutionContextSt... |
critical | 9.8 | — | Broadcom / spring batch | 2026-08-27 | 2026-09-02 |
| CVE-2026-76657 Vulnerabilities have been identified in the API of HPE Networking Fabric Compose... |
critical | 10.0 | — | Arubanetworks / fabric composer | 2026-09-01 | 2026-09-02 |
| CVE-2026-76658 A vulnerability has been identified in the SSH daemon of HPE Networking Fabric C... |
critical | 10.0 | — | Arubanetworks / fabric composer | 2026-09-01 | 2026-09-02 |
| CVE-2026-58062 In Bouncy Castle for Java before 1.85, Stapled OCSP response accepted without bi... |
critical | 9.1 | — | Bouncycastle / bc-java | 2026-08-03 | 2026-09-02 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.