September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,291
Critical
1,223
High
4,345
Medium
4,103
Low
460
Severity not reported
1,160
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-86678 ZohoCorp ManageEngine Applications Manager versions 182000 and below allowed a l... |
high | 8.8 | — | — | 2026-09-23 | 2026-09-24 |
| CVE-2026-86683 ZohoCorp ManageEngine Applications Manager versions 182000 and below allowed a l... |
high | 8.1 | — | — | 2026-09-23 | 2026-09-24 |
| CVE-2026-84787 ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.710 and belo... |
high | 8.1 | — | — | 2026-09-23 | 2026-09-24 |
| CVE-2026-76978 ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.709 and belo... |
high | 8.8 | — | — | 2026-09-23 | 2026-09-24 |
| CVE-2026-75825 ZohoCorp ManageEngine OpManager versions 12.8.710 and below with the Application... |
high | 8.8 | — | — | 2026-09-23 | 2026-09-24 |
| CVE-2026-49810 Dell Command Powershell Provider (DCPP), versions prior to 2.10.2 contain an Ins... |
high | 7.8 | — | — | 2026-09-21 | 2026-09-24 |
| CVE-2026-14913 ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.669 and belo... |
high | 8.8 | — | — | 2026-09-23 | 2026-09-24 |
| CVE-2026-70915 Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware... |
high | 8.8 | — | Oracle / identity manager | 2026-09-15 | 2026-09-23 |
| CVE-2026-96756 orval versions before 8.30.0 contain a code injection vulnerability in the @orva... |
high | 8.1 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-96514 A weakness has been identified in Neethuharii CafeManagement. |
high | 7.3 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-95603 Shop manager PHP Object Injection in Reycob Product Import Export <= 2.3.0 versi... |
high | 7.2 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-95513 Unauthenticated Broken Access Control in Online Booking & Scheduling Calendar fo... |
high | 7.5 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-95522 Shop manager SQL Injection in Easy Digital Downloads <= 3.7.0 versions. |
high | 7.6 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-95528 Unauthenticated Cross Site Scripting (XSS) in Core Web Vitals & PageSpeed Booste... |
high | 7.1 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-93774 Unauthenticated Cross Site Scripting (XSS) in WP Photo Album Plus <= 9.3.02.002... |
high | 7.1 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-94179 Unauthenticated Cross Site Scripting (XSS) in Razorpay Payment Button <= 2.4.9 v... |
high | 7.1 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-92708 Svelte devalue is a JavaScript library that serializes values into strings when... |
high | 7.5 | — | — | 2026-09-18 | 2026-09-23 |
| CVE-2026-93526 Unauthenticated Cross Site Scripting (XSS) in Event Tickets <= 5.29.4 versions. |
high | 7.1 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-88830 A unit confusion in BusyBox TLS Montgomery reduction buffer allocation causes a... |
high | 7.5 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-86064 Klever-Go is the Go implementation of the Klever blockchain protocol. |
high | 8.6 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-77601 OpenC3 COSMOS provides the functionality needed to send commands to and receive... |
high | 8.8 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-77394 OpenC3 COSMOS provides the functionality needed to send commands to and receive... |
high | 7.6 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-54506 Vvveb is a powerful and easy to use CMS with page builder to build websites, blo... |
high | 7.6 | — | — | 2026-09-17 | 2026-09-23 |
| CVE-2026-55610 InvoiceShelf is an open-source web & mobile app that helps track expenses, payme... |
high | 8.7 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-69528 Missing authentication for critical function in Windows Shell allows an authoriz... |
high | 7.8 | — | Microsoft / windows 11 23h2 | 2026-09-08 | 2026-09-23 |
| CVE-2026-69517 Use after free in Windows Wireless Networking allows an authorized attacker to e... |
high | 7.0 | — | Microsoft / windows 10 1809 | 2026-09-08 | 2026-09-23 |
| CVE-2026-69512 Heap-based buffer overflow in Windows Spaceport.sys allows an authorized attacke... |
high | 8.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-23 |
| CVE-2026-69508 Stack-based buffer overflow in Windows MIDI Service Module allows an authorized... |
high | 7.8 | — | Microsoft / windows 11 24h2 | 2026-09-08 | 2026-09-23 |
| CVE-2026-80225 In NLnetLabs Unbound up to and including 1.26.0, a degradation of service vulner... |
high | 7.5 | — | Nlnetlabs / unbound | 2026-09-16 | 2026-09-23 |
| CVE-2026-81349 Improper neutralization of special elements used in an os command ('os command i... |
high | 7.2 | — | Microsoft / azure hdinsight | 2026-09-08 | 2026-09-23 |
| CVE-2026-81634 In NLnet Labs Unbound up to and including 1.26.0, a 255 length query name with a... |
high | 7.5 | — | Nlnetlabs / unbound | 2026-09-16 | 2026-09-23 |
| CVE-2026-83998 Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attac... |
high | 8.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-23 |
| CVE-2026-54646 CubeCart is an ecommerce software solution. |
high | 7.2 | — | — | 2026-09-17 | 2026-09-23 |
| CVE-2026-28663 In buildIntentSenderForUser of LauncherAppsService.java, there is a possible way... |
high | 7.8 | — | Google / android | 2026-09-08 | 2026-09-23 |
| CVE-2026-91018 lwIP (Lightweight IP) has a double free vulnerability, which could crash the sys... |
high | 8.8 | — | — | 2026-09-22 | 2026-09-23 |
| CVE-2026-95626 Tauri's Content Security Policy hardening, which injects a random nonce to restr... |
high | 8.3 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-95627 When a Tauri application uses the dialog plugin's file or folder picker, an atta... |
high | 7.7 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-96454 Pake turns a website into a desktop application built on Tauri. |
high | 8.2 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-96455 The Reachy Mini daemon exposes an HTTP API for managing the robot. |
high | 8.8 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-28664 In WriteImageToDisk of runtime_image.cc, there is a possible file tampering due... |
high | 7.8 | — | Google / android | 2026-09-08 | 2026-09-23 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.