September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,364
Critical
1,230
High
4,374
Medium
4,126
Low
462
Severity not reported
1,172
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (964), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-82901 The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to Arbitr... |
critical | 9.8 | — | — | 2026-09-26 | 2026-09-28 |
| CVE-2026-100896 A weakness has been identified in TOTOLINK N150RT 3.4.0-B20201030. |
critical | 9.9 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-101002 A security flaw has been discovered in Netcore NBR200V2 1.3.241127.071246. |
critical | 9.9 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-101008 A vulnerability was found in aaPanel BaoTa up to 11.8.0. |
critical | 9.1 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-101038 A vulnerability was determined in FAST FAC1200R 5.0_20201119_1.0.2. |
critical | 9.9 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-101039 A vulnerability was identified in FAST FAC1900R 20190827_2.0.2. |
critical | 10.0 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-101072 A vulnerability was identified in Netcore NR289-GE 1.4.5102. |
critical | 10.0 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-101001 A vulnerability was identified in Netcore NBR200V2 1.3.241127.071246. |
critical | 10.0 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-83021 Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware... |
critical | 10.0 | — | Oracle / weblogic server | 2026-09-15 | 2026-09-28 |
| CVE-2026-39353 InvoicePlane is a self-hosted open source application for managing invoices, cli... |
critical | 9.1 | — | — | 2026-09-25 | 2026-09-28 |
| CVE-2024-58385 Yonyou U8 CRM contains an unauthenticated SQL injection vulnerability in the fil... |
critical | 9.8 | — | — | 2026-09-15 | 2026-09-28 |
| CVE-2026-76709 A vulnerability exists in the internal administrative component of Analytics and... |
critical | 9.8 | — | Arubanetworks / analytics and location engine | 2026-09-22 | 2026-09-28 |
| CVE-2026-76675 A command injection vulnerability exists in the command line interface of EdgeCo... |
critical | 9.1 | — | Arubanetworks / edgeconnect sd-wan orchestrator | 2026-09-15 | 2026-09-28 |
| CVE-2026-76674 Buffer overflow vulnerabilities exist in the underlying operating system of HPE... |
critical | 9.8 | — | Arubanetworks / edgeconnect sd-wan orchestrator | 2026-09-15 | 2026-09-28 |
| CVE-2026-69493 Out-of-bounds read in Windows Event Logging Service allows an unauthorized attac... |
critical | 9.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-28 |
| CVE-2026-77254 MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (C... |
critical | 9.1 | — | Mcp-atlassian / mcp atlassian | 2026-09-22 | 2026-09-28 |
| CVE-2026-20234 As part of Cisco's ongoing commitment to proactive security and product quality,... |
critical | 9.9 | — | Cisco / identity services engine | 2026-09-16 | 2026-09-28 |
| CVE-2026-20130 As part of Cisco's ongoing commitment to proactive security and product quality,... |
critical | 10.0 | — | Cisco / identity services engine | 2026-09-16 | 2026-09-28 |
| CVE-2026-20192 As part of Cisco's ongoing commitment to proactive security and product quality,... |
critical | 10.0 | — | Cisco / identity services engine | 2026-09-16 | 2026-09-28 |
| CVE-2025-14664 A vulnerability was identified in Campcodes Supplier Management System 1.0. |
critical | 9.8 | — | Campcodes / supplier management system | 2025-12-14 | 2026-09-28 |
| CVE-2025-14666 A weakness has been identified in itsourcecode COVID Tracking System 1.0. |
critical | 9.8 | — | Angeljudesuarez / covid tracking system | 2025-12-14 | 2026-09-28 |
| CVE-2025-14667 A security vulnerability has been detected in itsourcecode COVID Tracking System... |
critical | 9.8 | — | Angeljudesuarez / covid tracking system | 2025-12-14 | 2026-09-28 |
| CVE-2025-14668 A vulnerability was detected in campcodes Advanced Online Examination System 1.0... |
critical | 9.8 | — | Campcodes / advanced online examination system | 2025-12-14 | 2026-09-28 |
| CVE-2025-14672 A flaw has been found in gmg137 snap7-rs up to 1.142.1. |
critical | 9.8 | — | Gmg137 / snap7-rs | 2025-12-14 | 2026-09-28 |
| CVE-2025-14673 A vulnerability has been found in gmg137 snap7-rs up to 1.142.1. |
critical | 9.8 | — | Gmg137 / snap7-rs | 2025-12-14 | 2026-09-28 |
| CVE-2026-84388 A improper restriction of rendered ui layers or frames vulnerability in Fortinet... |
critical | 9.6 | — | — | 2026-09-22 | 2026-09-27 |
| CVE-2026-93399 The Bookly plugin for WordPress is vulnerable to Insecure Direct Object Referenc... |
critical | 9.1 | — | — | 2026-09-25 | 2026-09-26 |
| CVE-2026-89276 Adobe Campaign Classic (ACC) is affected by an Improper Control of Generation of... |
critical | 9.9 | — | Adobe / campaign | 2026-09-22 | 2026-09-26 |
| CVE-2026-92289 Lemonldap::NG::Portal versions from 2.23.0 before 2.23.4 for Perl allow a PKCE b... |
critical | 9.1 | — | — | 2026-09-25 | 2026-09-26 |
| CVE-2026-82013 Adobe Campaign Classic (ACC) is affected by a Server-Side Request Forgery (SSRF)... |
critical | 9.9 | — | Adobe / campaign | 2026-09-22 | 2026-09-26 |
| CVE-2026-75699 Adobe Campaign Classic (ACC) is affected by an Improper Control of Generation of... |
critical | 10.0 | — | Adobe / campaign | 2026-09-22 | 2026-09-26 |
| CVE-2026-75684 Adobe Connect is affected by a stored Cross-Site Scripting (XSS) vulnerability t... |
critical | 9.3 | — | Adobe / connect | 2026-09-22 | 2026-09-26 |
| CVE-2026-100714 Froxlor before 2.3.12 does not restrict or escape the system.letsencryptchalleng... |
critical | 9.1 | — | — | 2026-09-26 | 2026-09-26 |
| CVE-2024-13342 The Booster for WooCommerce plugin for WordPress is vulnerable to arbitrary file... |
critical | 9.8 | — | Booster / booster for woocommerce | 2025-08-29 | 2026-09-26 |
| CVE-2026-92957 vm2 through 3.11.6 does not normalize `node:`-prefixed builtin specifiers when e... |
critical | 9.9 | — | — | 2026-09-17 | 2026-09-26 |
| CVE-2026-80151 Lantronix SLC8000 before firmware v9.7.0.3, SLC9000 before firmware v9.7.0.2, EM... |
critical | 9.1 | — | — | 2026-09-22 | 2026-09-26 |
| CVE-2026-80152 Lantronix SLC8000 before firmware v9.7.0.3, SLC9000 before firmware v9.7.0.2, EM... |
critical | 9.1 | — | — | 2026-09-22 | 2026-09-26 |
| CVE-2026-75745 Adobe Experience Manager Forms JEE is affected by an Incorrect Authorization vul... |
critical | 10.0 | — | — | 2026-09-22 | 2026-09-26 |
| CVE-2026-75689 Adobe Connect is affected by a stored Cross-Site Scripting (XSS) vulnerability t... |
critical | 9.3 | — | Adobe / connect | 2026-09-22 | 2026-09-26 |
| CVE-2026-83660 Adobe Campaign Classic (ACC) is affected by a Server-Side Request Forgery (SSRF)... |
critical | 10.0 | — | Adobe / campaign | 2026-09-22 | 2026-09-26 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.