September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,293
Critical
1,225
High
4,345
Medium
4,103
Low
460
Severity not reported
1,160
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-101053 A vulnerability was determined in Thinkware U3000 up to 1.02.04. |
high | 7.3 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-101014 A vulnerability was detected in Trusted Domain Project OpenDMARC up to 1.4.2. |
high | 7.3 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-83330 Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Web... |
high | 7.5 | — | Oracle / helidon | 2026-09-15 | 2026-09-28 |
| CVE-2026-83281 Vulnerability in the Helidon product of Oracle Fusion Middleware (component: hel... |
high | 7.5 | — | Oracle / helidon | 2026-09-15 | 2026-09-28 |
| CVE-2026-83280 Vulnerability in the Helidon product of Oracle Fusion Middleware (component: hel... |
high | 7.5 | — | Oracle / helidon | 2026-09-15 | 2026-09-28 |
| CVE-2026-83276 Vulnerability in the Helidon product of Oracle Fusion Middleware (component: hel... |
high | 7.5 | — | Oracle / helidon | 2026-09-15 | 2026-09-28 |
| CVE-2026-49850 InvoicePlane is a self-hosted open source application for managing invoices, cli... |
high | 7.5 | — | — | 2026-09-25 | 2026-09-28 |
| CVE-2026-50547 InvoicePlane is a self-hosted open source application for managing invoices, cli... |
high | 7.5 | — | — | 2026-09-25 | 2026-09-28 |
| CVE-2026-77246 MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (C... |
high | 8.6 | — | Mcp-atlassian / mcp atlassian | 2026-09-22 | 2026-09-28 |
| CVE-2026-85134 Unrestricted upload of file with dangerous type vulnerability in Bimser Solution... |
high | 8.8 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-82323 Authorization bypass through User-Controlled key vulnerability in Enocta Educati... |
high | 8.1 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-82375 Server-Side Request Forgery (SSRF) in Apache Roller 6.1.5 allows an authenticate... |
high | 7.4 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-82380 Cross-Site Request Forgery (CSRF) in Apache Roller 6.1.5 allows a remote attacke... |
high | 8.1 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-82383 Missing Authentication for Critical Function in Apache Roller 6.1.5 allows an un... |
high | 8.2 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-100419 gitoxide gix-fs before 0.23.0 contains a path validation bypass vulnerability in... |
high | 7.0 | — | — | 2026-09-25 | 2026-09-28 |
| CVE-2024-14029 Tornado before 6.4.1 ignores duplicate Transfer-Encoding: chunked headers, treat... |
high | 7.5 | — | — | 2026-09-15 | 2026-09-28 |
| CVE-2026-76715 A vulnerability in an administrative component of Analytics and Location Engine... |
high | 7.1 | — | Arubanetworks / analytics and location engine | 2026-09-22 | 2026-09-28 |
| CVE-2026-76714 Vulnerabilities in the Analytics and Location Engine web interface allows remote... |
high | 7.2 | — | Arubanetworks / analytics and location engine | 2026-09-22 | 2026-09-28 |
| CVE-2026-69472 Use after free in Windows Devices Human Interface allows an authorized attacker... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-28 |
| CVE-2026-76713 A vulnerability exists in the maintenance restore functionality of Analytics and... |
high | 7.2 | — | Arubanetworks / analytics and location engine | 2026-09-22 | 2026-09-28 |
| CVE-2026-76712 A vulnerability exists in the Analytics and Location Engine (ALE) that may allow... |
high | 7.3 | — | Arubanetworks / analytics and location engine | 2026-09-22 | 2026-09-28 |
| CVE-2026-76710 A vulnerability exists in the Analytics and Location Engine (ALE) management int... |
high | 7.5 | — | Arubanetworks / analytics and location engine | 2026-09-22 | 2026-09-28 |
| CVE-2026-76711 A vulnerability exists in an Analytics and Location Engine (ALE) component where... |
high | 7.5 | — | Arubanetworks / analytics and location engine | 2026-09-22 | 2026-09-28 |
| CVE-2026-69478 Heap-based buffer overflow in Windows Device Association Service allows an autho... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-28 |
| CVE-2026-76685 A vulnerability exists in the proxy packet processing logic of the affected comp... |
high | 8.1 | — | Arubanetworks / edgeconnect sd-wan orchestrator | 2026-09-15 | 2026-09-28 |
| CVE-2026-76689 A vulnerability exists in the configuration processing logic of the affected com... |
high | 7.2 | — | Arubanetworks / edgeconnect sd-wan orchestrator | 2026-09-15 | 2026-09-28 |
| CVE-2026-76682 A vulnerability in the network security monitoring component of intrusion detect... |
high | 8.2 | — | Arubanetworks / edgeconnect sd-wan orchestrator | 2026-09-15 | 2026-09-28 |
| CVE-2026-76686 A vulnerability exists in the underlying operating system of HPE Networking Edge... |
high | 7.5 | — | Arubanetworks / edgeconnect sd-wan orchestrator | 2026-09-15 | 2026-09-28 |
| CVE-2026-76690 A vulnerability exists in a component of the HPE Networking EdgeConnect SD-WAN G... |
high | 7.2 | — | Arubanetworks / edgeconnect sd-wan orchestrator | 2026-09-15 | 2026-09-28 |
| CVE-2026-76691 Buffer overflow vulnerabilities exist in the API endpoint of HPE Networking Edge... |
high | 7.2 | — | Arubanetworks / edgeconnect sd-wan orchestrator | 2026-09-15 | 2026-09-28 |
| CVE-2026-69480 Heap-based buffer overflow in Windows Partition Management Driver allows an auth... |
high | 7.8 | — | Microsoft / windows 10 21h2 | 2026-09-08 | 2026-09-28 |
| CVE-2026-76683 Buffer overflow vulnerabilities exist in the API endpoint of HPE Networking Edge... |
high | 8.1 | — | Arubanetworks / edgeconnect sd-wan orchestrator | 2026-09-15 | 2026-09-28 |
| CVE-2026-69481 Heap-based buffer overflow in Windows Enterprise App Management allows an author... |
high | 8.0 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-28 |
| CVE-2026-76679 Vulnerabilities in HPE Networking EdgeConnect SD-WAN Gateways could allow an una... |
high | 8.6 | — | Arubanetworks / edgeconnect sd-wan orchestrator | 2026-09-15 | 2026-09-28 |
| CVE-2026-76678 A vulnerability in the API endpoint of HPE Networking EdgeConnect SD-WAN Gateway... |
high | 8.8 | — | Arubanetworks / edgeconnect sd-wan orchestrator | 2026-09-15 | 2026-09-28 |
| CVE-2026-76677 A privilege escalation vulnerability exists in the API of EdgeConnect SD-WAN Gat... |
high | 8.8 | — | Arubanetworks / edgeconnect sd-wan orchestrator | 2026-09-15 | 2026-09-28 |
| CVE-2026-76676 Buffer overflow vulnerabilities exist in the underlying operating system of Edge... |
high | 8.8 | — | Arubanetworks / edgeconnect sd-wan orchestrator | 2026-09-15 | 2026-09-28 |
| CVE-2026-69482 Creation of temporary file in directory with insecure permissions in Windows Err... |
high | 7.1 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-28 |
| CVE-2026-76693 A vulnerability in HPE Networking EdgeConnect SD-WAN Gateways could allow an una... |
high | 7.0 | — | Arubanetworks / edgeconnect sd-wan orchestrator | 2026-09-15 | 2026-09-28 |
| CVE-2026-76692 A vulnerability in HPE Networking EdgeConnect SD-WAN Gateways could allow an una... |
high | 7.1 | — | Arubanetworks / edgeconnect sd-wan orchestrator | 2026-09-15 | 2026-09-28 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.