September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,364
Critical
1,230
High
4,374
Medium
4,126
Low
462
Severity not reported
1,172
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (964), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-77244 MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (C... |
critical | 10.0 | — | Mcp-atlassian / mcp atlassian | 2026-09-22 | 2026-09-29 |
| CVE-2026-69431 Heap-based buffer overflow in Telnet Client allows an unauthorized attacker to e... |
critical | 9.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-29 |
| CVE-2026-6928 IBM Concert 1.0.0 through 3.0.0 references or accesses memory after it has been... |
critical | 9.8 | — | Ibm / concert | 2026-09-23 | 2026-09-29 |
| CVE-2026-57228 Suricata is a network Intrusion Detection System, Intrusion Prevention System an... |
critical | 9.1 | — | Oisf / suricata | 2026-09-18 | 2026-09-29 |
| CVE-2026-88771 Citrix NetScaler Improper Input Validation Vulnerability |
critical | 9.8 | Listed | Citrix / NetScaler | 2026-09-27 | 2026-09-29 |
| CVE-2026-87799 Improper link resolution in the migration receive path in Canonical LXD versions... |
critical | 9.9 | — | — | 2026-09-28 | 2026-09-29 |
| CVE-2026-82384 Deserialization of Untrusted Data in Apache Roller 6.1.5 allows an unauthenticat... |
critical | 9.8 | — | — | 2026-09-28 | 2026-09-29 |
| CVE-2026-85526 Path traversal in the Btrfs storage driver (unpackVolume) in Canonical LXD on Li... |
critical | 9.9 | — | — | 2026-09-28 | 2026-09-29 |
| CVE-2026-97359 HFS2 version 2.4.0 and earlier contains a template injection vulnerability in th... |
critical | 10.0 | — | — | 2026-09-24 | 2026-09-29 |
| CVE-2026-88378 QuickJS commit 04be24600 contains a heap out-of-bounds write condition in JS_Rea... |
critical | 9.8 | — | — | 2026-09-24 | 2026-09-29 |
| CVE-2026-88365 minimp3 commit ea99364f contains an integer overflow vulnerability in mp3dec_ski... |
critical | 9.8 | — | — | 2026-09-24 | 2026-09-29 |
| CVE-2026-79766 Termix is a web-based server management platform with SSH terminal, tunneling, a... |
critical | 9.1 | — | — | 2026-09-24 | 2026-09-29 |
| CVE-2026-77602 OpenC3 COSMOS provides the functionality needed to send commands to and receive... |
critical | 9.9 | — | — | 2026-09-23 | 2026-09-29 |
| CVE-2026-96754 orval versions before 8.29.0 contain a code injection vulnerability in the @orva... |
critical | 9.8 | — | — | 2026-09-23 | 2026-09-29 |
| CVE-2026-96759 orval before 8.29.0 fails to escape the operationId parameter when emitting it i... |
critical | 9.8 | — | — | 2026-09-23 | 2026-09-29 |
| CVE-2026-101081 A security flaw has been discovered in D-Link DI-8400 16.07. |
critical | 9.1 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-101090 Nezha 2.2.3 contains a Host header injection regression in the OAuth2 redirect e... |
critical | 9.8 | — | — | 2026-09-27 | 2026-09-28 |
| CVE-2026-101074 A weakness has been identified in Netcore NR289-GE 1.4.5102. |
critical | 9.8 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-101075 A security vulnerability has been detected in Netcore NR289-GE 1.4.5102. |
critical | 10.0 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-101077 A flaw has been found in Netcore NR289-GE 1.4.5102. |
critical | 10.0 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-97063 X-SpringBoot through 6.0 returns login verification codes in HTTP responses from... |
critical | 9.1 | — | — | 2026-09-25 | 2026-09-28 |
| CVE-2026-6721 IBM Concert 1.0.0 through 3.0.0 allows an unauthenticated remote attacker can su... |
critical | 9.8 | — | Ibm / concert | 2026-09-23 | 2026-09-28 |
| CVE-2026-87719 GitLab has remediated an issue in GitLab EE affecting all versions from 18.3 bef... |
critical | 9.9 | — | Gitlab / gitlab | 2026-09-12 | 2026-09-28 |
| CVE-2026-94083 Suricata before 8.0.7 has a DoH2 type confusion that can cause an invalid free,... |
critical | 9.4 | — | Oisf / suricata | 2026-09-20 | 2026-09-28 |
| CVE-2026-94084 Suricata before 8.0.7 has an Http2ThreadMultiBuf use-after-free when a transacti... |
critical | 9.4 | — | Oisf / suricata | 2026-09-20 | 2026-09-28 |
| CVE-2026-90924 Use of default credentials vulnerability in Innotim Software, Telecommunications... |
critical | 9.8 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-85185 Path traversal in the btrfs storage driver in Canonical LXD versions 4.0.2 and l... |
critical | 9.6 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-100721 vm2 before 3.12.2 contains an authorization bypass in the NodeVM external-module... |
critical | 9.0 | — | — | 2026-09-27 | 2026-09-28 |
| CVE-2026-100715 Froxlor through 2.3.10 is vulnerable to arbitrary file deletion via symlink foll... |
critical | 9.6 | — | — | 2026-09-26 | 2026-09-28 |
| CVE-2026-70756 Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware... |
critical | 9.8 | — | Oracle / weblogic server | 2026-09-15 | 2026-09-28 |
| CVE-2026-70757 Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware... |
critical | 9.8 | — | Oracle / weblogic server | 2026-09-15 | 2026-09-28 |
| CVE-2026-95848 Moquette is a lightweight Java MQTT broker. |
critical | 9.1 | — | Moquette / moquette | 2026-09-23 | 2026-09-28 |
| CVE-2026-89078 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2... |
critical | 9.9 | — | Gitlab / gitlab | 2026-09-24 | 2026-09-28 |
| CVE-2026-93577 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2... |
critical | 9.9 | — | Gitlab / gitlab | 2026-09-24 | 2026-09-28 |
| CVE-2026-100706 kyverno before 1.19.1 fails to properly validate URL-encoded path segments in Po... |
critical | 9.9 | — | — | 2026-09-26 | 2026-09-28 |
| CVE-2026-42322 Piwigo is a full featured open source photo gallery application for the web. |
critical | 9.1 | — | — | 2026-09-25 | 2026-09-28 |
| CVE-2026-100716 Froxlor is a server administration panel. |
critical | 9.9 | — | — | 2026-09-26 | 2026-09-28 |
| CVE-2026-100740 A vulnerability was detected in D-Link DIR-895L A1_102b07. |
critical | 9.9 | — | — | 2026-09-27 | 2026-09-28 |
| CVE-2026-18143 The Request a Quote for WooCommerce plugin for WordPress is vulnerable to Arbitr... |
critical | 9.8 | — | — | 2026-09-26 | 2026-09-28 |
| CVE-2026-85984 The miniOrange OTP Login, Verification and SMS Notifications plugin for WordPres... |
critical | 9.8 | — | — | 2026-09-26 | 2026-09-28 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.