September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,364
Critical
1,230
High
4,374
Medium
4,126
Low
462
Severity not reported
1,172
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (964), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-88414 MCMS 6.1.1 through 6.2.1 contains a SQL injection vulnerability in the PageActio... |
critical | 9.8 | — | — | 2026-09-22 | 2026-09-26 |
| CVE-2026-80146 Lantronix SLC8000/SLC9000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmw... |
critical | 9.9 | — | — | 2026-09-22 | 2026-09-26 |
| CVE-2026-82009 Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Specia... |
critical | 9.1 | — | Adobe / campaign | 2026-09-22 | 2026-09-26 |
| CVE-2026-75721 Adobe Campaign Classic (ACC) is affected by an Improper Control of Generation of... |
critical | 10.0 | — | Adobe / campaign | 2026-09-22 | 2026-09-26 |
| CVE-2025-57819 Sangoma FreePBX Authentication Bypass Vulnerability |
critical | 9.8 | Listed | Sangoma / FreePBX | 2025-08-28 | 2026-09-26 |
| CVE-2025-34520 An authentication bypass vulnerability in Arcserve Unified Data Protection (UDP)... |
critical | 9.8 | — | Arcserve / udp | 2025-08-27 | 2026-09-26 |
| CVE-2025-34523 A heap-based buffer overflow vulnerability exists in the network-facing input ha... |
critical | 9.8 | — | Arcserve / udp | 2025-08-27 | 2026-09-26 |
| CVE-2025-9581 A vulnerability was detected in Comfast CF-N1 2.6.0. |
critical | 9.8 | — | Comfast / cf-n1 firmware | 2025-08-28 | 2026-09-26 |
| CVE-2025-9582 A flaw has been found in Comfast CF-N1 2.6.0. |
critical | 9.8 | — | Comfast / cf-n1 firmware | 2025-08-28 | 2026-09-26 |
| CVE-2025-9592 A vulnerability was detected in itsourcecode Apartment Management System 1.0. |
critical | 9.8 | — | Admerc / apartment management system | 2025-08-28 | 2026-09-26 |
| CVE-2025-9593 A flaw has been found in itsourcecode Apartment Management System 1.0. |
critical | 9.8 | — | Admerc / apartment management system | 2025-08-28 | 2026-09-26 |
| CVE-2025-9594 A vulnerability has been found in itsourcecode Apartment Management System 1.0. |
critical | 9.8 | — | Admerc / apartment management system | 2025-08-28 | 2026-09-26 |
| CVE-2025-9765 A vulnerability has been found in itsourcecode Sports Management System 1.0. |
critical | 9.8 | — | Angeljudesuarez / sports management system | 2025-09-01 | 2026-09-26 |
| CVE-2025-9766 A vulnerability was found in itsourcecode Sports Management System 1.0. |
critical | 9.8 | — | Angeljudesuarez / sports management system | 2025-09-01 | 2026-09-26 |
| CVE-2025-9767 A vulnerability was determined in itsourcecode Sports Management System 1.0. |
critical | 9.8 | — | Angeljudesuarez / sports management system | 2025-09-01 | 2026-09-26 |
| CVE-2025-9770 A weakness has been identified in Campcodes Hospital Management System 1.0. |
critical | 9.8 | — | Campcodes / hospital management system | 2025-09-01 | 2026-09-26 |
| CVE-2025-9791 A weakness has been identified in Tenda AC20 16.03.08.05. |
critical | 9.8 | — | Tenda / ac20 firmware | 2025-09-01 | 2026-09-26 |
| CVE-2025-10156 An Improper Handling of Exceptional Conditions vulnerability in the ZIP archive... |
critical | 9.8 | — | Mmaitre314 / picklescan | 2025-09-17 | 2026-09-26 |
| CVE-2025-10596 A vulnerability was found in SourceCodester Online Exam Form Submission 1.0. |
critical | 9.8 | — | Janobe / online exam form submission | 2025-09-17 | 2026-09-26 |
| CVE-2025-10597 A vulnerability was determined in kidaze CourseSelectionSystem up to 42cd892b40a... |
critical | 9.8 | — | Kidaze / courseselectionsystem | 2025-09-17 | 2026-09-26 |
| CVE-2025-10598 A vulnerability was identified in SourceCodester Pet Grooming Management Softwar... |
critical | 9.8 | — | Mayurik / pet grooming management software | 2025-09-17 | 2026-09-26 |
| CVE-2025-10599 A security flaw has been discovered in itsourcecode Web-Based Internet Laborator... |
critical | 9.8 | — | Itsourcecode / web-based internet laboratory management system | 2025-09-17 | 2026-09-26 |
| CVE-2025-10600 A flaw has been found in SourceCodester Online Exam Form Submission 1.0. |
critical | 9.8 | — | Janobe / online exam form submission | 2025-09-17 | 2026-09-26 |
| CVE-2025-10601 A vulnerability has been found in SourceCodester Online Exam Form Submission 1.0... |
critical | 9.8 | — | Janobe / online exam form submission | 2025-09-17 | 2026-09-26 |
| CVE-2025-10604 A vulnerability was identified in PHPGurukul Online Discussion Forum 1.0. |
critical | 9.8 | — | Emiloi / online discussion forum | 2025-09-17 | 2026-09-26 |
| CVE-2025-10621 A vulnerability was determined in SourceCodester Hotel Reservation System 1.0. |
critical | 9.8 | — | Fabian / hotel reservation system | 2025-09-17 | 2026-09-26 |
| CVE-2025-10623 A vulnerability was identified in SourceCodester Hotel Reservation System 1.0. |
critical | 9.8 | — | Fabian / hotel reservation system | 2025-09-17 | 2026-09-26 |
| CVE-2025-10624 A security flaw has been discovered in PHPGurukul User Management System 1.0. |
critical | 9.8 | — | Phpgurukul / user management system | 2025-09-17 | 2026-09-26 |
| CVE-2025-13806 A security vulnerability has been detected in nutzam NutzBoot up to 2.6.0-SNAPSH... |
critical | 9.8 | — | Nutzam / nutzboot | 2025-12-01 | 2026-09-26 |
| CVE-2025-13814 A security flaw has been discovered in moxi159753 Mogu Blog v2 up to 5.2. |
critical | 9.8 | — | Mogublog Project / mogublog | 2025-12-01 | 2026-09-26 |
| CVE-2025-13815 A weakness has been identified in moxi159753 Mogu Blog v2 up to 5.2. |
critical | 9.8 | — | Mogublog Project / mogublog | 2025-12-01 | 2026-09-26 |
| CVE-2025-3500 Integer Overflow or Wraparound vulnerability in Avast Antivirus (25.1.981.6) on... |
critical | 9.8 | — | Avast / antivirus | 2025-12-01 | 2026-09-26 |
| CVE-2025-66301 Grav is a file-based Web platform. |
critical | 9.6 | — | Getgrav / grav | 2025-12-01 | 2026-09-26 |
| CVE-2025-13872 Blind Server-Side Request Forgery (SSRF) in the survey-import feature of
Objec... |
critical | 9.1 | — | Objectplanet / opinio | 2025-12-02 | 2026-09-26 |
| CVE-2025-11779 Stack-based buffer overflow vulnerability in CircutorSGE-PLC1000/SGE-PLC50 v9.0.... |
critical | 9.8 | — | Circutor / sge-plc1000 firmware | 2025-12-02 | 2026-09-26 |
| CVE-2025-11782 Stack-based buffer overflow vulnerability in Circutor SGE-PLC1000/SGE-PLC50 v9.0... |
critical | 9.8 | — | Circutor / sge-plc1000 firmware | 2025-12-02 | 2026-09-26 |
| CVE-2025-11783 Stack-based buffer overflow vulnerability in Circutor SGE-PLC1000/SGE-PLC50 v9.0... |
critical | 9.8 | — | Circutor / sge-plc1000 firmware | 2025-12-02 | 2026-09-26 |
| CVE-2025-11784 Stack-based buffer overflow vulnerability in Circutor SGE-PLC1000/SGE-PLC50 v9.0... |
critical | 9.8 | — | Circutor / sge-plc1000 firmware | 2025-12-02 | 2026-09-26 |
| CVE-2025-11786 Stack-based buffer overflow vulnerability in Circutor SGE-PLC1000/SGE-PLC50 v9.0... |
critical | 9.8 | — | Circutor / sge-plc1000 firmware | 2025-12-02 | 2026-09-26 |
| CVE-2025-11788 Heap-based buffer overflow vulnerability in Circutor SGE-PLC1000/SGE-PLC50 v9.0.... |
critical | 9.8 | — | Circutor / sge-plc1000 firmware | 2025-12-02 | 2026-09-26 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.