September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,291
Critical
1,223
High
4,345
Medium
4,103
Low
460
Severity not reported
1,160
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-88415 MCMS 6.1.1 through 6.2.1 is vulnerable to stored Cross-Site Scripting (XSS). |
high | 8.7 | — | — | 2026-09-22 | 2026-09-23 |
| CVE-2026-70584 Access of resource using incompatible type ('type confusion') in Windows Core Me... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-23 |
| CVE-2026-87268 Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (comp... |
high | 7.8 | — | Oracle / vm virtualbox | 2026-09-15 | 2026-09-23 |
| CVE-2026-87269 Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (comp... |
high | 7.8 | — | Oracle / vm virtualbox | 2026-09-15 | 2026-09-23 |
| CVE-2026-87270 Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (comp... |
high | 7.8 | — | Oracle / vm virtualbox | 2026-09-15 | 2026-09-23 |
| CVE-2026-87271 Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (comp... |
high | 7.8 | — | Oracle / vm virtualbox | 2026-09-15 | 2026-09-23 |
| CVE-2026-87272 Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (comp... |
high | 7.8 | — | Oracle / vm virtualbox | 2026-09-15 | 2026-09-23 |
| CVE-2026-87273 Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (comp... |
high | 8.6 | — | Oracle / vm virtualbox | 2026-09-15 | 2026-09-23 |
| CVE-2026-87276 Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (comp... |
high | 7.5 | — | Oracle / vm virtualbox | 2026-09-15 | 2026-09-23 |
| CVE-2026-87277 Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (comp... |
high | 7.5 | — | Oracle / vm virtualbox | 2026-09-15 | 2026-09-23 |
| CVE-2026-73014 Missing authorization in Data Sharing Service Client allows an authorized attack... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-23 |
| CVE-2026-92456 yshop-crm through 2.1.3 fails to enforce authorization on the saveRedisSet and g... |
high | 7.1 | — | — | 2026-09-16 | 2026-09-23 |
| CVE-2026-92465 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
high | 7.6 | — | — | 2026-09-16 | 2026-09-23 |
| CVE-2026-6285 Weak Password Recovery Mechanism for Forgotten Password vulnerability in Ankaref... |
high | 7.5 | — | — | 2026-09-10 | 2026-09-23 |
| CVE-2026-84395 Premiere Pro is affected by a Server-Side Request Forgery (SSRF) vulnerability t... |
high | 7.1 | — | — | 2026-09-22 | 2026-09-23 |
| CVE-2026-81999 Adobe Experience Manager Forms JEE is affected by a Server-Side Request Forgery... |
high | 8.7 | — | — | 2026-09-22 | 2026-09-23 |
| CVE-2026-18730 A server-side request forgery (SSRF) vulnerability was identified in GitHub Ente... |
high | 7.4 | — | Github / enterprise server | 2026-09-01 | 2026-09-22 |
| CVE-2026-73750 Vulnerabilities exist in the authentication module that may improperly process m... |
high | 8.8 | — | Hpe / arubaos-cx | 2026-09-01 | 2026-09-22 |
| CVE-2026-73751 An authenticated user with low-privileged access could submit crafted input thro... |
high | 8.8 | — | Hpe / arubaos-cx | 2026-09-01 | 2026-09-22 |
| CVE-2026-73752 An unauthenticated arbitrary file write vulnerability exists in an API endpoint... |
high | 8.8 | — | Hpe / arubaos-cx | 2026-09-01 | 2026-09-22 |
| CVE-2026-91996 lamp-cloud through 5.10.0 whitelists the path pattern /*/anno/** for anonymous a... |
high | 7.5 | — | — | 2026-09-15 | 2026-09-22 |
| CVE-2026-92793 GoAdmin through 1.2.26 fails to properly anchor the logout pattern when checking... |
high | 8.1 | — | — | 2026-09-16 | 2026-09-22 |
| CVE-2026-92796 Manticore Search versions 27.0.0 before 28.4.4 fail to validate permissions for... |
high | 8.8 | — | — | 2026-09-16 | 2026-09-22 |
| CVE-2026-92815 changedetection.io through 0.60.6 fails to validate the Goto URL action in brows... |
high | 7.5 | — | — | 2026-09-16 | 2026-09-22 |
| CVE-2026-92816 ComfyUI before 0.30.0 fails to sanitize folder_name input in dataset save nodes,... |
high | 7.8 | — | — | 2026-09-16 | 2026-09-22 |
| CVE-2026-92918 admin3 through 3.0.0 persists user session tokens in the audit log event body wh... |
high | 8.8 | — | — | 2026-09-17 | 2026-09-22 |
| CVE-2026-92919 admin3 through 3.0.0 fails to sanitize client-supplied filenames in the upload h... |
high | 8.1 | — | — | 2026-09-17 | 2026-09-22 |
| CVE-2026-92970 HUBzero CMS through 2.2.32 contains a path traversal vulnerability in project fi... |
high | 8.8 | — | — | 2026-09-17 | 2026-09-22 |
| CVE-2026-92971 InternLM LMDeploy through 0.17.0 contains a reachable assertion vulnerability in... |
high | 7.5 | — | — | 2026-09-17 | 2026-09-22 |
| CVE-2026-92983 InternLM LMDeploy through 0.17.0 in DistServe prefill/decode disaggregation mode... |
high | 7.5 | — | — | 2026-09-17 | 2026-09-22 |
| CVE-2026-92984 HUBzero CMS through 2.2.32 accepts session identifiers from query strings and re... |
high | 8.1 | — | — | 2026-09-17 | 2026-09-22 |
| CVE-2026-92980 HortusFox-Web prior to version 6.1 contains a remote code execution vulnerabilit... |
high | 7.2 | — | — | 2026-09-17 | 2026-09-22 |
| CVE-2026-93456 django-page-cms through 2.0.13 exempts five admin mutation views from CSRF prote... |
high | 8.2 | — | — | 2026-09-18 | 2026-09-22 |
| CVE-2026-77929 ClipBucket v5 before 5.5.3-#182 contains a file upload vulnerability that allows... |
high | 8.8 | — | — | 2026-09-18 | 2026-09-22 |
| CVE-2026-93657 hickory-resolver versions before 0.26.2 fail to propagate bogus DNSSEC proof sta... |
high | 7.5 | — | — | 2026-09-18 | 2026-09-22 |
| CVE-2026-93868 Cotonti through 1.0.0 derives password recovery validation tokens from md5(micro... |
high | 8.1 | — | — | 2026-09-18 | 2026-09-22 |
| CVE-2026-93872 Cotonti 1.0.0 passes the base64-decoded cb parameter to unserialize() without al... |
high | 7.5 | — | — | 2026-09-18 | 2026-09-22 |
| CVE-2026-94534 lamp-cloud through 5.10.0 fails to validate user identity in PUT /anyone/baseInf... |
high | 7.1 | — | — | 2026-09-21 | 2026-09-22 |
| CVE-2026-94535 lamp-cloud through 5.10.0 contains an authorization bypass vulnerability in the... |
high | 7.1 | — | — | 2026-09-21 | 2026-09-22 |
| CVE-2026-63104 Kaneo versions 2.3.12 before 2.12.2 contain a missing authorization vulnerabilit... |
high | 8.1 | — | — | 2026-09-22 | 2026-09-22 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.