September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,364
Critical
1,230
High
4,374
Medium
4,126
Low
462
Severity not reported
1,172
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (964), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2025-59374 ASUS Live Update Embedded Malicious Code Vulnerability |
critical | 9.8 | Listed | ASUS / Live Update | 2025-12-17 | 2026-09-25 |
| CVE-2025-41013 SQL injection vulnerability in TCMAN GIM v11 in version 20250304. |
critical | 9.8 | — | Tcman / gim | 2025-12-02 | 2026-09-25 |
| CVE-2025-12995 Medtronic CareLink Network allows an unauthenticated remote attacker to perform... |
critical | 9.8 | — | Medtronic / carelink network | 2025-12-04 | 2026-09-25 |
| CVE-2025-66562 TUUI is a desktop MCP client designed as a tool unitary utility integration. |
critical | 9.6 | — | Aiql / tuui | 2025-12-05 | 2026-09-25 |
| CVE-2025-66039 FreePBX Endpoint Manager is a module for managing telephony endpoints in FreePBX... |
critical | 9.8 | — | Sangoma / freepbx | 2025-12-09 | 2026-09-25 |
| CVE-2025-67791 An issue was discovered in DriveLock 24.1 through 24.1.*, 24.2 through 24.2.*, a... |
critical | 9.8 | — | Drivelock / drivelock | 2025-12-17 | 2026-09-25 |
| CVE-2025-15012 A vulnerability was determined in code-projects Refugee Food Management System 1... |
critical | 9.8 | — | Fabian / refugee food management system | 2025-12-22 | 2026-09-25 |
| CVE-2026-69399 Azure Arc Elevation of Privilege Vulnerability |
critical | 9.8 | — | Microsoft / azure arc | 2026-09-17 | 2026-09-25 |
| CVE-1999-0199 manual/search.texi in the GNU C Library (aka glibc) before 2.2 lacks a statement... |
critical | 9.8 | — | Gnu / glibc | 2020-10-06 | 2026-09-25 |
| CVE-2026-70200 Improper limitation of a pathname to a restricted directory ('path traversal') i... |
critical | 9.8 | — | Microsoft / azure logic apps | 2026-09-17 | 2026-09-25 |
| CVE-2026-83944 Improper access control in Azure Logic Apps allows an unauthorized attacker to e... |
critical | 9.1 | — | Microsoft / azure logic apps | 2026-09-17 | 2026-09-25 |
| CVE-2026-69843 Authentication bypass by spoofing in Microsoft Fabric allows an unauthorized att... |
critical | 10.0 | — | Microsoft / fabric | 2026-09-18 | 2026-09-25 |
| CVE-2026-84719 A flaw was found in the Ansible Automation Platform automation-controller. |
critical | 9.9 | — | — | 2026-09-23 | 2026-09-25 |
| CVE-2026-51994 mcp-remote versions 0.1.32 through 0.1.38 are vulnerable to Server-Side Request... |
critical | 9.1 | — | — | 2026-09-24 | 2026-09-25 |
| CVE-2026-75682 Adobe Connect is affected by an Improper Neutralization of Special Elements used... |
critical | 9.9 | — | Adobe / connect | 2026-09-22 | 2026-09-25 |
| CVE-2026-75686 Adobe Connect is affected by an Improper Input Validation vulnerability that cou... |
critical | 9.3 | — | Adobe / connect | 2026-09-22 | 2026-09-25 |
| CVE-2026-88351 An integer overflow vulnerability exists in the MPack Node API in MPack 1.1.1 on... |
critical | 9.8 | — | — | 2026-09-24 | 2026-09-25 |
| CVE-2026-33824 Microsoft Internet Key Exchange (IKE) Service Extensions Double Free Vulnerabili... |
critical | 9.8 | Listed | Microsoft / Internet Key Exchange (IKE) Service Extensions | 2026-04-14 | 2026-09-25 |
| CVE-2026-75697 Adobe Connect is affected by a stored Cross-Site Scripting (XSS) vulnerability t... |
critical | 9.3 | — | Adobe / connect | 2026-09-22 | 2026-09-25 |
| CVE-2026-75698 Adobe Connect is affected by a reflected Cross-Site Scripting (XSS) vulnerabilit... |
critical | 9.3 | — | Adobe / connect | 2026-09-22 | 2026-09-25 |
| CVE-2026-76708 A vulnerability exists in the Analytics and Location Engine (ALE) where the appl... |
critical | 9.8 | — | Arubanetworks / analytics and location engine | 2026-09-22 | 2026-09-25 |
| CVE-2026-95699 Prior to 9/18/2026, the iSteamX mobile application's AWS policy could grant auth... |
critical | 9.6 | — | — | 2026-09-24 | 2026-09-25 |
| CVE-2026-97230 IO::Socket::SSL::SelfCertificate versions 1.00 for Perl contains malware which e... |
critical | 9.8 | — | — | 2026-09-24 | 2026-09-25 |
| CVE-2026-92288 Lemonldap::NG::Portal versions from 2.20.0 before 2.21.6, from 2.22.0 before 2.2... |
critical | 9.1 | — | — | 2026-09-25 | 2026-09-25 |
| CVE-2026-73242 FreeRDP is a free implementation of the Remote Desktop Protocol. |
critical | 9.1 | — | Freerdp / freerdp | 2026-08-11 | 2026-09-25 |
| CVE-2026-67278 MikroTik RouterOS accepts malformed RSA/PKCS#1 v1.5 signatures across RSA-based... |
critical | 9.1 | — | Mikrotik / routeros | 2026-09-05 | 2026-09-25 |
| CVE-2026-70009 Improper limitation of a pathname to a restricted directory ('path traversal') i... |
critical | 9.8 | — | Microsoft / azure arc | 2026-09-17 | 2026-09-25 |
| CVE-2026-85889 Missing authentication for critical function in Azure AI Foundry allows an unaut... |
critical | 9.8 | — | Microsoft / azure ai foundry | 2026-09-17 | 2026-09-25 |
| CVE-2026-85878 Improper authorization in Azure Database for PostgreSQL allows an authorized att... |
critical | 9.9 | — | Microsoft / azure horizondb | 2026-09-18 | 2026-09-25 |
| CVE-2026-53581 OPNsense is a FreeBSD based firewall and routing platform. |
critical | 9.0 | — | — | 2026-09-08 | 2026-09-25 |
| CVE-2026-62379 Open Access Management (OpenAM) is an access management solution. |
critical | 9.8 | — | — | 2026-09-15 | 2026-09-25 |
| CVE-2026-89055 The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to autho... |
critical | 9.1 | — | — | 2026-09-25 | 2026-09-25 |
| CVE-2026-93765 Mongoid contains an unsafe reflection weakness in the document persistence layer... |
critical | 9.1 | — | Mongodb / mongoid | 2026-09-18 | 2026-09-25 |
| CVE-2026-86473 Apache Airflow: the Core API logout endpoint revokes only a session token presen... |
critical | 9.1 | — | Apache / airflow | 2026-09-21 | 2026-09-25 |
| CVE-2026-25254 Improper authorization leads to Remote Code Execution via SocketIO interface. |
critical | 9.8 | — | Qualcomm / software center | 2026-09-22 | 2026-09-25 |
| CVE-2026-85724 Moquette is a lightweight Java MQTT broker. |
critical | 9.6 | — | Moquette / moquette | 2026-09-23 | 2026-09-25 |
| CVE-2026-14281 The Automation Web Platform – Notifications and OTP for WooCommerce, Advanced Co... |
critical | 9.8 | — | — | 2026-09-25 | 2026-09-25 |
| CVE-2026-76669 Privilege escalation vulnerabilities exist in the API of HPE Networking EdgeConn... |
critical | 9.9 | — | Arubanetworks / edgeconnect sd-wan orchestrator | 2026-09-15 | 2026-09-25 |
| CVE-2026-76670 Privilege escalation vulnerabilities exist in the API of HPE Networking EdgeConn... |
critical | 9.9 | — | Arubanetworks / edgeconnect sd-wan orchestrator | 2026-09-15 | 2026-09-25 |
| CVE-2026-76673 Vulnerabilities have been identified in the API of EdgeConnect SD-WAN Orchestrat... |
critical | 9.8 | — | Arubanetworks / edgeconnect sd-wan orchestrator | 2026-09-15 | 2026-09-25 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.