September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,826
Low
527
Severity not reported
2,544
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), apache (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-90822 FatPipe MPVPN, WARP, and IPVPN appliances running the end-of-life firmware versi... |
critical | 9.8 | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-90823 FatPipe MPVPN, WARP, and IPVPN appliances running the end-of-life firmware versi... |
critical | 9.8 | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-81440 Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Use... |
critical | 9.8 | — | Dell / openmanage server administrator | 2026-09-17 | 2026-10-01 |
| CVE-2026-81475 Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Mis... |
critical | 9.8 | — | Dell / openmanage server administrator | 2026-09-17 | 2026-10-01 |
| CVE-2026-81476 Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains an Im... |
critical | 9.8 | — | Dell / openmanage server administrator | 2026-09-17 | 2026-10-01 |
| CVE-2026-81478 Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Use... |
critical | 9.8 | — | Dell / openmanage server administrator | 2026-09-17 | 2026-10-06 |
| CVE-2026-88795 The wpShopGermany IT-RECHT KANZLEI WordPress plugin before 2.4 does not generate... |
critical | 9.0 | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-86707 The Private Feed Key WordPress plugin through 0.1 does not verify that the key u... |
critical | 9.8 | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-86709 The Pressengine WordPress plugin through 1.0 does not stop its login handler fro... |
critical | 9.8 | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-86710 The Login with QR WordPress plugin through 1.0.0 does not verify that the code u... |
critical | 9.8 | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-87796 The Multi Uploader for Gravity Forms plugin for WordPress is vulnerable to Arbit... |
critical | 9.8 | — | — | 2026-09-17 | 2026-09-19 |
| CVE-2026-61594 djust provides Phoenix LiveView-style reactive server-side rendering for Django... |
critical | 9.1 | — | — | 2026-09-16 | 2026-09-30 |
| CVE-2026-92812 Decap CMS before 3.11.0 contains a path traversal vulnerability in the local pro... |
critical | 9.8 | — | — | 2026-09-16 | 2026-10-22 |
| CVE-2026-92805 UVdesk Community Skeleton through 1.1.8 fails to authenticate or validate instal... |
critical | 9.8 | — | — | 2026-09-16 | 2026-09-22 |
| CVE-2026-92787 Feast through 0.66.0 fails to verify JWT token signatures before establishing us... |
critical | 9.8 | — | — | 2026-09-16 | 2026-09-24 |
| CVE-2026-76460 Cisco Identity Services Engine Incorrect Use of Privileged APIs Vulnerability |
critical | 10.0 | Listed | Cisco / Identity Services Engine | 2026-09-16 | 2026-10-07 |
| CVE-2026-75513 Marten is a .NET Transactional Document DB and Event Store on PostgreSQL. |
critical | 9.1 | — | — | 2026-09-16 | 2026-09-19 |
| CVE-2026-20332 As part of Cisco's ongoing commitment to proactive security and product quality,... |
critical | 9.9 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-20284 A vulnerability in the SXP REST API of Cisco ISE could allow an authenticated, r... |
critical | 9.1 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2025-56563 A Server-Side Request Forgery vulnerability exists in sat_proxy.php in Zenith Sa... |
critical | 9.8 | — | — | 2026-09-16 | 2026-10-28 |
| CVE-2026-88592 kkFileView >= 4.2.0 is vulnerable to Server-Side Request Forgery (SSRF). |
critical | 9.1 | — | — | 2026-09-16 | 2026-09-22 |
| CVE-2026-76423 A vulnerability in the REST API of Cisco ISE and Cisco ISE-PIC could allow an un... |
critical | 10.0 | — | — | 2026-09-16 | 2026-09-17 |
| CVE-2026-20341 A vulnerability in the sftunnel inter-device communication protocol of Cisco Sec... |
critical | 9.1 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-20322 As part of Cisco's ongoing commitment to proactive security and product quality,... |
critical | 9.9 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-20324 A vulnerability in the sftunnel inter-device communication protocol of Cisco Sec... |
critical | 9.9 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-20325 As part of Cisco's ongoing commitment to proactive security and product quality,... |
critical | 9.9 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-20326 As part of Cisco's ongoing commitment to proactive security and product quality,... |
critical | 9.8 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-20329 As part of Cisco's ongoing commitment to proactive security and product quality,... |
critical | 9.9 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-20330 As part of Cisco's ongoing commitment to proactive security and product quality,... |
critical | 9.9 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-20194 As part of Cisco's ongoing commitment to proactive security and product quality,... |
critical | 9.1 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-20211 A vulnerability in Cisco ISE could allow an authenticated, remote attacker to ex... |
critical | 9.1 | — | — | 2026-09-16 | 2026-09-17 |
| CVE-2026-20237 As part of Cisco's ongoing commitment to proactive security and product quality,... |
critical | 9.1 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-20242 A vulnerability in the External Database Access feature of Cisco Secure Firewall... |
critical | 9.8 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-20130 As part of Cisco's ongoing commitment to proactive security and product quality,... |
critical | 10.0 | — | Cisco / identity services engine | 2026-09-16 | 2026-09-28 |
| CVE-2026-20176 A vulnerability in Cisco ISE could allow an authenticated, remote attacker to ex... |
critical | 9.1 | — | — | 2026-09-16 | 2026-09-17 |
| CVE-2026-20192 As part of Cisco's ongoing commitment to proactive security and product quality,... |
critical | 10.0 | — | Cisco / identity services engine | 2026-09-16 | 2026-09-28 |
| CVE-2026-91102 HP has identified and remediated multiple externally reported vulnerabilities wi... |
critical | 9.8 | — | Hp / linux imaging and printing | 2026-09-16 | 2026-09-21 |
| CVE-2026-91103 HP has identified and remediated multiple externally reported vulnerabilities wi... |
critical | 9.8 | — | Hp / linux imaging and printing | 2026-09-16 | 2026-09-21 |
| CVE-2026-91104 HP has identified and remediated multiple externally reported vulnerabilities wi... |
critical | 9.8 | — | Hp / linux imaging and printing | 2026-09-16 | 2026-09-21 |
| CVE-2026-91105 HP has identified and remediated multiple externally reported vulnerabilities wi... |
critical | 9.8 | — | Hp / linux imaging and printing | 2026-09-16 | 2026-09-21 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.