September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,833
Low
527
Severity not reported
2,537
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), linux (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-84694 Coolify before 4.2.0 fails to properly escape environment variable key names in... |
high | 8.8 | — | — | 2026-09-02 | 2026-09-10 |
| CVE-2026-84695 BookStack before 26.05.4 contains a stored cross-site scripting vulnerability in... |
high | 8.7 | — | — | 2026-09-02 | 2026-09-08 |
| CVE-2026-84696 Phison PS3111-S11 controller firmware versions through SBFQT1.3 expose privilege... |
high | 8.2 | — | — | 2026-09-02 | 2026-09-10 |
| CVE-2026-84334 Incorrect authorization in Chromoting in Google Chrome on on Windows prior to 15... |
high | 8.1 | — | Google / chrome | 2026-09-02 | 2026-09-03 |
| CVE-2026-84335 Incorrect authorization in TabStrip in Google Chrome prior to 152.0.7977.75 allo... |
high | 8.3 | — | Google / chrome | 2026-09-02 | 2026-09-03 |
| CVE-2026-84347 Use after free in WebRTC in Google Chrome prior to 152.0.7977.75 allowed a remot... |
high | 8.8 | — | Google / chrome | 2026-09-02 | 2026-09-03 |
| CVE-2026-84349 Use after free in Browser in Google Chrome prior to 152.0.7977.75 allowed a remo... |
high | 8.3 | — | Google / chrome | 2026-09-02 | 2026-09-03 |
| CVE-2026-84350 Use after free in TabStrip in Google Chrome prior to 152.0.7977.75 allowed a rem... |
high | 8.8 | — | Google / chrome | 2026-09-02 | 2026-09-03 |
| CVE-2026-84351 Buffer overflow in GPU in Google Chrome on on Windows prior to 152.0.7977.75 all... |
high | 8.3 | — | Google / chrome | 2026-09-02 | 2026-09-03 |
| CVE-2026-84326 Uninitialized resource in V8 in Google Chrome prior to 152.0.7977.75 allowed a r... |
high | 8.8 | — | Google / chrome | 2026-09-02 | 2026-09-03 |
| CVE-2026-81928 Net::DNS versions before 1.57 for Perl allow memory exhaustion via unbounded rec... |
high | 7.5 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-84482 WWBN AVideo through commit 9c39d8c8 contains a cross-site request forgery vulner... |
high | 8.8 | — | — | 2026-09-01 | 2026-09-08 |
| CVE-2026-84208 AVideo through version 29.0 contains an unauthenticated SQL injection vulnerabil... |
high | 7.5 | — | — | 2026-09-01 | 2026-09-08 |
| CVE-2026-84423 A vulnerability has been found in Casdoor up to 4.0.0. |
high | 7.3 | — | — | 2026-09-01 | 2026-09-03 |
| CVE-2026-84476 WWBN AVideo fails to validate trusted proxies before accepting X-Real-IP and X-F... |
high | 7.5 | — | — | 2026-09-01 | 2026-09-08 |
| CVE-2026-84478 WWBN AVideo contains a path traversal vulnerability in the API get_api_login_cod... |
high | 7.3 | — | — | 2026-09-01 | 2026-09-08 |
| CVE-2026-84642 The values of the mail.allowed_attachment_hostnames advanced config setting were... |
high | 7.5 | — | Mozilla / thunderbird | 2026-09-01 | 2026-09-03 |
| CVE-2026-84374 Laravel Excel provides supercharged Excel exports and imports in Laravel. |
high | 7.5 | — | — | 2026-09-01 | 2026-09-09 |
| CVE-2026-84375 js-yaml is a JavaScript YAML parser and dumper. |
high | 7.5 | — | — | 2026-09-01 | 2026-09-28 |
| CVE-2026-84640 A maliciously constructed mail header could lead to a one byte read past the end... |
high | 7.5 | — | Mozilla / thunderbird | 2026-09-01 | 2026-09-03 |
| CVE-2026-84641 A malicious IMAP server can trigger use-after-free and heap-memory disclosure by... |
high | 7.5 | — | Mozilla / thunderbird | 2026-09-01 | 2026-09-03 |
| CVE-2026-83549 SonicWall SMA1000 Appliances OS Command Injection Vulnerability |
high | 7.8 | Listed | SonicWall / SMA1000 Appliances | 2026-09-01 | 2026-09-21 |
| CVE-2026-76851 A Server-Side Request Forgery (SSRF) vulnerability was identified in GitHub Ente... |
high | 8.8 | — | Github / enterprise server | 2026-09-01 | 2026-09-08 |
| CVE-2026-19118 A time-of-check time-of-use race condition vulnerability was identified in GitHu... |
high | 7.5 | — | Github / enterprise server | 2026-09-01 | 2026-09-08 |
| CVE-2026-18730 A server-side request forgery (SSRF) vulnerability was identified in GitHub Ente... |
high | 7.4 | — | Github / enterprise server | 2026-09-01 | 2026-09-22 |
| CVE-2026-84370 SVGO, short for SVG Optimizer, is a Node.js library and command-line application... |
high | 8.2 | — | — | 2026-09-01 | 2026-09-09 |
| CVE-2026-84366 Scrapy is a high-level web crawling and scraping framework for Python. |
high | 7.4 | — | — | 2026-09-01 | 2026-09-09 |
| CVE-2026-73782 A format string vulnerability exists in the command line interface of AOS-CX tha... |
high | 8.8 | — | Hpe / arubaos-cx | 2026-09-01 | 2026-09-04 |
| CVE-2026-73773 An unauthenticated Denial-of-Service (DoS) vulnerability exists in the API endpo... |
high | 7.5 | — | Hpe / arubaos-cx | 2026-09-01 | 2026-09-04 |
| CVE-2026-73774 A buffer overflow vulnerability exists in the underlying operating system of AOS... |
high | 7.6 | — | Hpe / arubaos-cx | 2026-09-01 | 2026-09-04 |
| CVE-2026-73775 Vulnerabilities in the API endpoint of AOS-CX could allow a remote attacker auth... |
high | 7.7 | — | Hpe / arubaos-cx | 2026-09-01 | 2026-09-04 |
| CVE-2026-73776 A signature verification bypass vulnerability exists in the command line interfa... |
high | 7.9 | — | Hpe / arubaos-cx | 2026-09-01 | 2026-09-04 |
| CVE-2026-73777 Vulnerabilities have been identified in the API endpoint of AOS-CX switches that... |
high | 8.1 | — | Hpe / arubaos-cx | 2026-09-01 | 2026-09-04 |
| CVE-2026-73779 Vulnerabilities have been identified in the operating system of AOS-CX switches... |
high | 8.2 | — | Hpe / arubaos-cx | 2026-09-01 | 2026-09-04 |
| CVE-2026-73780 A vulnerability in the web-based management interface of AOS-CX switches exposes... |
high | 8.3 | — | Hpe / arubaos-cx | 2026-09-01 | 2026-09-22 |
| CVE-2026-73781 A vulnerability in the web-based management interface of AOS-CX could allow an a... |
high | 8.4 | — | Hpe / arubaos-cx | 2026-09-01 | 2026-09-04 |
| CVE-2026-73763 A vulnerability exists in a management component that could allow an unauthentic... |
high | 8.8 | — | Hpe / arubaos-cx | 2026-09-01 | 2026-09-10 |
| CVE-2026-73764 Vulnerabilities have been identified in the operating system of AOS-CX switches... |
high | 7.1 | — | Hpe / arubaos-cx | 2026-09-01 | 2026-09-04 |
| CVE-2026-73765 Authenticated path traversal vulnerabilities exist in API endpoints of AOS-CX. |
high | 7.2 | — | Hpe / arubaos-cx | 2026-09-01 | 2026-09-04 |
| CVE-2026-73766 Command injection vulnerabilities in the API endpoint of AOS-CX could allow an a... |
high | 7.2 | — | Hpe / arubaos-cx | 2026-09-01 | 2026-09-04 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.