September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,290
Critical
1,223
High
4,344
Medium
4,103
Low
460
Severity not reported
1,160
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-92135 Jenkins Coverage Plugin 3.3358.v9487dde48783 and earlier does not validate the c... |
high | 8.0 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-92136 Jenkins OWASP Dependency-Check Plugin 5.6.4 and earlier does not escape CWE valu... |
high | 8.0 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-92137 Jenkins Robot Framework Plugin 6.2.2 and earlier does not check that the archive... |
high | 8.8 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-84620 An integer overflow was addressed with improved input validation. |
high | 7.3 | — | Apple / ipados | 2026-09-14 | 2026-09-18 |
| CVE-2026-20135 A vulnerability in the TLS 1.3 implementation in Cisco Secure Firewall Threat De... |
high | 8.6 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-20222 A vulnerability in the EIGRP implementation in Cisco Secure Firewall Adaptive Se... |
high | 7.4 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-20247 A vulnerability in Cisco ISE could allow an unauthenticated, remote attacker to... |
high | 7.5 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-20250 A vulnerability in Datagram TLS (DTLS) message handling of Cisco Secure Firewall... |
high | 8.6 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-20295 A vulnerability in the sftunnel inter-device communication protocol of Cisco Sec... |
high | 8.6 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-20323 A vulnerability in the sftunnel inter-device communication protocol of Cisco Sec... |
high | 8.3 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-20340 A vulnerability in Cisco Secure FMC Software could allow an authenticated, remot... |
high | 8.8 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-20342 A vulnerability in a specific file download API of Cisco Secure FMC Software cou... |
high | 7.7 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-20352 A vulnerability in the RADIUS feature of Cisco Identity Services Engine (ISE) co... |
high | 8.6 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-20360 As part of Cisco's ongoing commitment to proactive security and product quality,... |
high | 8.8 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-76412 A vulnerability in the remote diagnostics debugger of Cisco Secure FMC Software... |
high | 8.5 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-76413 A vulnerability in Cisco Adaptive Security Device Manager (ASDM) single sign-on... |
high | 8.2 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-83561 The Complianz GDPR/CCPA Cookie Consent Banner plugin for WordPress is vulnerable... |
high | 7.2 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-54671 WeGIA is a web manager for charitable institutions. |
high | 8.8 | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-20280 As part of Cisco's ongoing commitment to proactive security and product quality,... |
high | 8.8 | — | Cisco / ios xr | 2026-09-02 | 2026-09-18 |
| CVE-2026-20276 As part of Cisco's ongoing commitment to proactive security and product quality,... |
high | 8.6 | — | Cisco / ios xr | 2026-09-02 | 2026-09-18 |
| CVE-2026-20277 As part of Cisco's ongoing commitment to proactive security and product quality,... |
high | 8.2 | — | — | 2026-09-02 | 2026-09-18 |
| CVE-2026-20278 As part of Cisco's ongoing commitment to proactive security and product quality,... |
high | 8.8 | — | — | 2026-09-02 | 2026-09-18 |
| CVE-2026-20275 As part of Cisco's ongoing commitment to proactive security and product quality,... |
high | 8.8 | — | — | 2026-09-02 | 2026-09-18 |
| CVE-2026-58699 In Vp9DecEndOfStream of vp9hwd_output.cc, there is a possible out-of-bounds read... |
high | 8.4 | — | Google / android | 2026-09-15 | 2026-09-18 |
| CVE-2026-58701 In trusty_dputc of generic-arm64-smcall.c, there is a possible out-of-bounds wri... |
high | 7.0 | — | Google / android | 2026-09-15 | 2026-09-18 |
| CVE-2026-58710 In DecodeFilmGrainParams of film_grain_dec.cc, there is a possible out-of-bounds... |
high | 8.8 | — | Google / android | 2026-09-15 | 2026-09-18 |
| CVE-2026-58766 In multiple functions of arm-smmu-v3.c, there is a possible escalation of privil... |
high | 7.8 | — | Google / android | 2026-09-15 | 2026-09-18 |
| CVE-2026-58744 In multiple locations, there is a possible escalation of privilege due to improp... |
high | 7.8 | — | Google / android | 2026-09-15 | 2026-09-18 |
| CVE-2026-58734 In google_mba_recv_msg of google_mba_poll.c, there is a possible out-of-bounds w... |
high | 7.0 | — | Google / android | 2026-09-15 | 2026-09-18 |
| CVE-2026-58728 In ARM64_TLBI of mmu.h, there is a possible memory corruption due to a race cond... |
high | 7.0 | — | Google / android | 2026-09-15 | 2026-09-18 |
| CVE-2026-58724 In multiple locations, there is a possible use-after-free due to a race conditio... |
high | 7.0 | — | Google / android | 2026-09-15 | 2026-09-18 |
| CVE-2026-84578 A logic issue was addressed with improved checks. |
high | 8.8 | — | Apple / macos | 2026-09-14 | 2026-09-18 |
| CVE-2026-43815 A buffer overflow was addressed with improved bounds checking. |
high | 8.8 | — | Apple / macos | 2026-09-14 | 2026-09-18 |
| CVE-2026-20361 As part of Cisco's ongoing commitment to proactive security and product quality,... |
high | 8.8 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-84565 An out-of-bounds read was addressed with improved bounds checking. |
high | 7.1 | — | Apple / macos | 2026-09-14 | 2026-09-17 |
| CVE-2026-84544 An integer overflow was addressed with improved input validation. |
high | 7.5 | — | Apple / macos | 2026-09-14 | 2026-09-17 |
| CVE-2026-63460 Vendure is an open-source headless commerce platform. |
high | 7.5 | — | — | 2026-09-17 | 2026-09-17 |
| CVE-2026-66571 Unauthenticated Cross Site Request Forgery (CSRF) in Asset CleanUp: Page Speed B... |
high | 7.1 | — | — | 2026-09-17 | 2026-09-17 |
| CVE-2026-66580 Contributor SQL Injection in Product Feed Manager <= 7.12.0 versions. |
high | 8.5 | — | — | 2026-09-17 | 2026-09-17 |
| CVE-2026-66618 Administrator SQL Injection in WP Maps <= 4.9.9 versions. |
high | 7.6 | — | — | 2026-09-17 | 2026-09-17 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.