September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,291
Critical
1,223
High
4,345
Medium
4,103
Low
460
Severity not reported
1,160
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2023-46273 Bonjour Gateway in Extreme Networks IQ Engine before 10.6r1a, and through 10.6r4... |
high | 8.8 | — | — | 2026-09-14 | 2026-09-22 |
| CVE-2023-50461 An issue was discovered in the direct_mail (aka Direct Mail) extension through 9... |
high | 8.8 | — | — | 2026-09-14 | 2026-09-22 |
| CVE-2026-79425 An authenticated Server-Side Request Forgery (SSRF) in the /adminapi/file/online... |
high | 8.1 | — | — | 2026-09-15 | 2026-09-22 |
| CVE-2026-79551 Tenda Technology Co., Ltd NVR_4H CH3 v2.1 V27.5.58.6 was discovered to contain a... |
high | 7.5 | — | — | 2026-09-15 | 2026-09-22 |
| CVE-2026-88616 An issue in RuoYi-Vue-Plus 6.0.0 allows a remote attacker to execute arbitrary c... |
high | 8.8 | — | — | 2026-09-15 | 2026-09-22 |
| CVE-2026-88619 1024-lab SmartAdmin v3.30.0 contains a missing authorization vulnerability in th... |
high | 8.1 | — | — | 2026-09-15 | 2026-09-22 |
| CVE-2026-52484 An issue in MitraStar GPT-2742GX4X5v6-SV GL_g2.5_100XNT0b23_3 allows an authenti... |
high | 8.8 | — | — | 2026-09-15 | 2026-09-22 |
| CVE-2026-79410 Improper validation of the quantity parameter in the add-to-cart path of Webkul... |
high | 8.1 | — | — | 2026-09-15 | 2026-09-22 |
| CVE-2026-79411 Incorrect privilege assignment in the admin user-management component of Webkul... |
high | 8.8 | — | — | 2026-09-15 | 2026-09-22 |
| CVE-2026-51134 The C-MOR Video Surveillance web interface (up to version 6.0104) is vulnerable... |
high | 7.5 | — | — | 2026-09-15 | 2026-09-22 |
| CVE-2026-38999 A Null Pointer Dereference in the mk_sched_event_close function (mk_server/mk_sc... |
high | 7.5 | — | — | 2026-09-16 | 2026-09-22 |
| CVE-2026-79298 An issue in Howyar Technologies Inc SysReturn Versions prior to 11.3.034 and fix... |
high | 8.4 | — | — | 2026-09-16 | 2026-09-22 |
| CVE-2026-52483 The ping diagnostics and other similar functions of the MitraStar GPT-2741GNAC-N... |
high | 8.8 | — | — | 2026-09-17 | 2026-09-22 |
| CVE-2026-88622 NUUO Network Video Recorder 2.0.0 is vulnerable to Command Injection in handle_i... |
high | 8.8 | — | — | 2026-09-18 | 2026-09-22 |
| CVE-2026-36467 Unrestricted Upload of File with Dangerous Type in core/modules/media.php in Cut... |
high | 7.2 | — | — | 2026-09-21 | 2026-09-22 |
| CVE-2026-79316 An improper access control vulnerability exists in x-ui 0.3.2. |
high | 7.6 | — | — | 2026-09-21 | 2026-09-22 |
| CVE-2026-88406 FalkorDB (Redis module) v4.20.1 to v4.20.4 was discovered to contain a stack ove... |
high | 7.5 | — | — | 2026-09-21 | 2026-09-22 |
| CVE-2026-88409 FalkorDB (Redis module) v4.20.1 to v4.20.4 was discovered to contain a buffer ov... |
high | 8.8 | — | — | 2026-09-21 | 2026-09-22 |
| CVE-2026-88411 Improper error handling in the GRAPH.EFFECT component (/effects/effects_apply.c)... |
high | 7.5 | — | — | 2026-09-21 | 2026-09-22 |
| CVE-2026-88746 idccms V1.70 is vulnerable to Cross Site Scripting (XSS) in /admin/makeDiy_deal.... |
high | 7.1 | — | — | 2026-09-21 | 2026-09-22 |
| CVE-2026-79079 An issue in CrossWire Xiphos <= 4.3.2 allows a local attacker to execute arbitra... |
high | 7.8 | — | — | 2026-09-21 | 2026-09-22 |
| CVE-2026-89407 NumberInput.looksLikeValidNumber() in FasterXML jackson-core pre-validates "stri... |
high | 7.5 | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-78807 An issue in wpa_supplicant all versions before v.2.12 allows a local attacker to... |
high | 7.1 | — | — | 2026-09-11 | 2026-09-22 |
| CVE-2026-90616 In Flatpak before 1.18.1, a malicious sandboxed app can obtain arbitrary read an... |
high | 7.4 | — | — | 2026-09-12 | 2026-09-22 |
| CVE-2026-90678 An issue was discovered in HAProxy 3.3.0 through 3.4.4 and in 3.5-dev1 through 3... |
high | 7.5 | — | — | 2026-09-13 | 2026-09-22 |
| CVE-2026-23789 An issue was discovered in MFC in Samsung Mobile Processor and Wearable Processo... |
high | 7.8 | — | — | 2026-09-14 | 2026-09-22 |
| CVE-2026-33963 An issue was discovered in camera in Samsung Mobile Processor Exynos 1330, 1380,... |
high | 7.5 | — | — | 2026-09-14 | 2026-09-22 |
| CVE-2023-28148 A bodyclass XSS issue was discovered in Paessler PRTG before 23.3.86.1520. |
high | 7.2 | — | — | 2026-09-14 | 2026-09-22 |
| CVE-2023-32803 The ca-certificates package before ca-certificates-2021.2.50-72 for Amazon Linux... |
high | 7.5 | — | — | 2026-09-14 | 2026-09-22 |
| CVE-2023-45858 A directory traversal was identified in Paessler PRTG before 23.4.88.1429 that m... |
high | 8.6 | — | — | 2026-09-14 | 2026-09-22 |
| CVE-2025-56565 DD-WRT firmware, as deployed on TP-Link TL-WR740N v1 through v4 hardware, stores... |
high | 7.6 | — | — | 2026-09-16 | 2026-09-22 |
| CVE-2026-94488 Telegram Desktop before 6.9.4 allows XSS in the HTML exporter. |
high | 8.2 | — | — | 2026-09-21 | 2026-09-22 |
| CVE-2026-69775 Use after free in Windows DWM Core Library allows an authorized attacker to elev... |
high | 7.5 | — | Microsoft / windows 11 23h2 | 2026-09-08 | 2026-09-22 |
| CVE-2026-71047 Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware... |
high | 8.8 | — | Oracle / identity manager | 2026-09-15 | 2026-09-22 |
| CVE-2026-73942 Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware... |
high | 8.8 | — | Oracle / identity manager | 2026-09-15 | 2026-09-22 |
| CVE-2026-69784 Use after free in Windows Hello allows an authorized attacker to elevate privile... |
high | 8.8 | — | Microsoft / windows 10 21h2 | 2026-09-08 | 2026-09-22 |
| CVE-2026-73943 Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware... |
high | 7.6 | — | Oracle / identity manager | 2026-09-15 | 2026-09-22 |
| CVE-2026-73949 Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware... |
high | 8.8 | — | Oracle / webcenter portal | 2026-09-15 | 2026-09-22 |
| CVE-2026-73951 Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware... |
high | 8.1 | — | Oracle / webcenter portal | 2026-09-15 | 2026-09-22 |
| CVE-2026-83004 Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusio... |
high | 7.2 | — | Oracle / webcenter enterprise capture | 2026-09-15 | 2026-09-22 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.