September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,290
Critical
1,223
High
4,344
Medium
4,103
Low
460
Severity not reported
1,160
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-92958 vm2 through 3.11.6 contains a builtin-module denylist bypass in NodeVM. |
high | 8.5 | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-93331 A vulnerability was identified in GPAC 26.08-DEV. |
high | 7.3 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-92942 vm2 before 3.11.7 (affected versions <= 3.11.6) does not enforce the VM({ timeou... |
high | 7.5 | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-81179 SysReptor is a fully customizable pentest reporting platform. |
high | 8.1 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-6205 An external control of file name or path vulnerability in Upload API in Synology... |
high | 8.1 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-54612 Vvveb is a powerful and easy to use CMS with page builder to build websites, blo... |
high | 8.8 | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-20336 As part of Cisco's ongoing commitment to proactive security and product quality,... |
high | 8.8 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-20333 As part of Cisco's ongoing commitment to proactive security and product quality,... |
high | 8.8 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-20334 As part of Cisco's ongoing commitment to proactive security and product quality,... |
high | 8.4 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-20335 As part of Cisco's ongoing commitment to proactive security and product quality,... |
high | 8.1 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-18911 ManageEngine DataSecurity Plus versions before 6310 are vulnerable to an agent a... |
high | 7.5 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-18405 The Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates f... |
high | 7.2 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-13673 An incorrect permission assignment for critical resource vulnerability in LDAP A... |
high | 8.8 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-13285 IBM MQ is vulnerable to an XML external entity injection (XXE) attack when proce... |
high | 7.1 | — | — | 2026-09-14 | 2026-09-18 |
| CVE-2026-12384 Authorization bypass through User-Controlled key vulnerability in TECHIN2B TECHI... |
high | 8.8 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-56986 In multiple files, there is a possible out-of-bounds read due to type confusion. |
high | 8.4 | — | Google / android | 2026-09-15 | 2026-09-18 |
| CVE-2026-56970 In multiple locations, there is a possible permission bypass due to a missing pe... |
high | 8.4 | — | Google / android | 2026-09-15 | 2026-09-18 |
| CVE-2026-56974 In Start of AudioRtpPayloadEncoderNode.cpp, there is a possible out-of-bounds wr... |
high | 8.8 | — | Google / android | 2026-09-15 | 2026-09-18 |
| CVE-2026-56978 In get_global_config_item_addr of gc.c, there is a possible out-of-bounds read d... |
high | 8.4 | — | Google / android | 2026-09-15 | 2026-09-18 |
| CVE-2026-56982 In VPU, there is a possible permission bypass due to a missing permission check. |
high | 7.8 | — | Google / android | 2026-09-15 | 2026-09-18 |
| CVE-2026-56985 In multiple files, there is a possible way to obtain signatures due to type conf... |
high | 8.4 | — | Google / android | 2026-09-15 | 2026-09-18 |
| CVE-2026-57012 In the Setup Wizard, there is a possible remote package install due to a missing... |
high | 8.4 | — | Google / android | 2026-09-15 | 2026-09-18 |
| CVE-2026-92838 A DLL hijacking
vulnerability exists in the GeoVision GV-Remote E-Map desktop
ap... |
high | 7.8 | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-38058 The endpoint on the iDirect iQ200 VSAT terminal returns the complete device conf... |
high | 8.1 | — | — | 2026-09-11 | 2026-09-18 |
| CVE-2026-78224 The XSLT Transformer Step builds a bare TransformerFactory without the proper se... |
high | 8.2 | — | — | 2026-09-11 | 2026-09-18 |
| CVE-2026-82578 When XML batch processing is turned on and the XPath option is selected, the raw... |
high | 7.5 | — | — | 2026-09-11 | 2026-09-18 |
| CVE-2026-82583 NextGen Connect (Mirth Connect) versions 4.7.1 and earlier allow an authenticate... |
high | 8.3 | — | — | 2026-09-11 | 2026-09-18 |
| CVE-2026-87020 An integer overflow in a specified pitch and buffer-size computation leads to a... |
high | 8.1 | — | — | 2026-09-11 | 2026-09-18 |
| CVE-2026-68070 The affected products are missing authentication for a critical function, which... |
high | 8.8 | — | — | 2026-09-15 | 2026-09-18 |
| CVE-2026-68950 The affected products use hard-coded credentials, which could allow an attacker... |
high | 8.8 | — | — | 2026-09-15 | 2026-09-18 |
| CVE-2026-84507 A race condition was addressed with improved state handling. |
high | 7.8 | — | Apple / ipados | 2026-09-14 | 2026-09-18 |
| CVE-2026-38056 A local privilege escalation vulnerability exists in the iDirect iQ200 VSAT term... |
high | 8.8 | — | — | 2026-09-11 | 2026-09-18 |
| CVE-2026-68497 jackson-databind binds a JSON string to a javax.xml.datatype.Duration or javax.x... |
high | 7.5 | — | — | 2026-09-11 | 2026-09-18 |
| CVE-2026-19624 A flaw was found in NetworkManager-l2tp. |
high | 7.8 | — | — | 2026-09-14 | 2026-09-18 |
| CVE-2026-19816 A flaw was found in PackageKit. |
high | 7.1 | — | — | 2026-09-14 | 2026-09-18 |
| CVE-2026-40058 CrowdStrike released a security update to address a vulnerability in the Falcon... |
high | 8.8 | — | — | 2026-09-15 | 2026-09-18 |
| CVE-2026-76154 A stored cross-site scripting vulnerability in the Geomap panel's MapLibre base... |
high | 7.3 | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-93652 Integer overflow in µD3TN v0.15.0 TCPCLv3 handshake causes heap overflow, allowi... |
high | 7.5 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-90894 Parallels Desktop runs prl_disp_service as root. |
high | 7.8 | — | — | 2026-09-14 | 2026-09-18 |
| CVE-2026-89212 A flaw resulting in XML external entity (XXE) was found in Akana API Platform in... |
high | 8.6 | — | — | 2026-09-11 | 2026-09-18 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.