September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,293
Critical
1,225
High
4,345
Medium
4,103
Low
460
Severity not reported
1,160
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-77271 MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (C... |
high | 8.8 | — | Mcp-atlassian / mcp atlassian | 2026-09-22 | 2026-09-28 |
| CVE-2026-69488 Use after free in Windows Device Association Service allows an authorized attack... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-28 |
| CVE-2026-69492 Heap-based buffer overflow in Windows Partition Management Driver allows an auth... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-28 |
| CVE-2026-77274 MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (C... |
high | 8.2 | — | Mcp-atlassian / mcp atlassian | 2026-09-22 | 2026-09-28 |
| CVE-2026-69494 Out-of-bounds read in Windows Event Logging Service allows an unauthorized attac... |
high | 8.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-28 |
| CVE-2026-69495 Heap-based buffer overflow in Windows Event Logging Service allows an unauthoriz... |
high | 8.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-28 |
| CVE-2026-77248 MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (C... |
high | 8.6 | — | Mcp-atlassian / mcp atlassian | 2026-09-22 | 2026-09-28 |
| CVE-2026-79708 GitLab has remediated an issue in GitLab EE affecting all versions from 19.0 bef... |
high | 8.5 | — | Gitlab / gitlab | 2026-09-16 | 2026-09-28 |
| CVE-2026-1168 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.4.... |
high | 7.5 | — | Gitlab / gitlab | 2026-09-16 | 2026-09-28 |
| CVE-2026-77253 MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (C... |
high | 7.1 | — | Mcp-atlassian / mcp atlassian | 2026-09-22 | 2026-09-28 |
| CVE-2026-101066 A vulnerability was determined in dbgate up to 7.3.1. |
high | 7.3 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-101052 A security vulnerability has been detected in refly-ai refly up to 1.1.0. |
high | 7.3 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-76425 A vulnerability in the APIs of Cisco ISE could allow an authenticated, remote at... |
high | 7.6 | — | Cisco / identity services engine | 2026-09-16 | 2026-09-28 |
| CVE-2026-76424 A vulnerability in the REST API of Cisco ISE could allow an authenticated, remot... |
high | 7.2 | — | Cisco / identity services engine | 2026-09-16 | 2026-09-28 |
| CVE-2026-88772 Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memor... |
high | 8.1 | Listed | Citrix / NetScaler | 2026-09-27 | 2026-09-28 |
| CVE-2026-87902 WordPress Core Remote File Inclusion Vulnerability |
high | 8.1 | Listed | WordPress / Core | 2026-09-22 | 2026-09-28 |
| CVE-2026-97520 In the Linux kernel, the following vulnerability has been resolved:
gfs2: move... |
high | 7.1 | — | — | 2026-09-24 | 2026-09-28 |
| CVE-2026-97474 In the Linux kernel, the following vulnerability has been resolved:
wifi: iwlwi... |
high | 7.4 | — | — | 2026-09-24 | 2026-09-28 |
| CVE-2026-84549 An out-of-bounds read was addressed with improved bounds checking. |
high | 7.5 | — | Apple / macos | 2026-09-14 | 2026-09-27 |
| CVE-2026-92126 Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier does not reject... |
high | 8.5 | — | Jenkins / script security | 2026-09-16 | 2026-09-27 |
| CVE-2026-83311 Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component:... |
high | 8.5 | — | — | 2026-09-15 | 2026-09-27 |
| CVE-2026-83964 Adobe Connect is affected by an Improper Certificate Validation vulnerability th... |
high | 7.5 | — | Adobe / connect | 2026-09-22 | 2026-09-26 |
| CVE-2026-84499 A flaw was found in Red Hat Ansible Automation Platform's automation-
controller... |
high | 7.7 | — | — | 2026-09-23 | 2026-09-26 |
| CVE-2026-84706 A flaw was found in Ansible Automation Platform's automation-controller. |
high | 7.6 | — | — | 2026-09-23 | 2026-09-26 |
| CVE-2026-82003 Adobe Campaign Classic (ACC) is affected by an Improper Input Validation vulnera... |
high | 8.5 | — | Adobe / campaign | 2026-09-22 | 2026-09-26 |
| CVE-2026-16591 The WP Directory Kit WordPress plugin before 1.5.8 does not sanitize and escape... |
high | 7.2 | — | — | 2026-09-26 | 2026-09-26 |
| CVE-2026-100713 Froxlor 2.3.10 and earlier contain a time-of-check time-of-use (TOCTOU) race con... |
high | 7.8 | — | — | 2026-09-26 | 2026-09-26 |
| CVE-2026-100718 Froxlor through 2.3.10 does not enforce the mail.allow_external_domains policy i... |
high | 7.1 | — | — | 2026-09-26 | 2026-09-26 |
| CVE-2026-100720 Froxlor 2.0.0 through 2.3.10 is vulnerable to stored cross-site scripting. |
high | 8.7 | — | — | 2026-09-26 | 2026-09-26 |
| CVE-2026-80149 Lantronix SLC8000 before firmware v9.7.0.3, SLC9000 before firmware v9.7.0.2, EM... |
high | 8.6 | — | — | 2026-09-22 | 2026-09-26 |
| CVE-2026-80150 Lantronix SLC8000 before firmware v9.7.0.3, SLC9000 before firmware v9.7.0.2, EM... |
high | 7.5 | — | — | 2026-09-22 | 2026-09-26 |
| CVE-2026-80148 Lantronix SLC8000 before firmware v9.7.0.3, SLC9000 before firmware v9.7.0.2, EM... |
high | 8.6 | — | — | 2026-09-22 | 2026-09-26 |
| CVE-2026-94367 OpenEye Apex Network Video Recorder (NVR) firmware 3.2.9.376 contains an OS comm... |
high | 7.2 | — | — | 2026-09-23 | 2026-09-26 |
| CVE-2026-96749 An integer overflow in the BSON document encoding component of the MongoDB Pytho... |
high | 8.4 | — | — | 2026-09-24 | 2026-09-26 |
| CVE-2026-89325 An uncontrolled search path element in InsightVM assessment content in Rapid7 In... |
high | 7.8 | — | — | 2026-09-24 | 2026-09-26 |
| CVE-2026-82164 Dell Trusted Device Client, versions prior to 8.1.359.0, contain an Incorrect Pe... |
high | 7.1 | — | — | 2026-09-24 | 2026-09-26 |
| CVE-2026-95924 A vulnerability has been found in SourceCodester Online Reviewer Management Syst... |
high | 7.3 | — | — | 2026-09-23 | 2026-09-26 |
| CVE-2026-96272 ClipBucket v5 before 5.5.3-#182 contains a blind SQL injection vulnerability in... |
high | 7.5 | — | — | 2026-09-23 | 2026-09-26 |
| CVE-2026-62985 request-filtering-agent is an http(s).Agent implementation that blocks requests... |
high | 7.5 | — | — | 2026-09-22 | 2026-09-26 |
| CVE-2026-95653 Concrete CMS Community Store before 2.7.8 derives digital product download token... |
high | 7.5 | — | — | 2026-09-22 | 2026-09-26 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.