September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,826
Low
527
Severity not reported
2,544
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), apache (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-82999 Vulnerability in the Service Delivery Platform product of Oracle Fusion Middlewa... |
critical | 9.9 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-83000 Vulnerability in the Service Delivery Platform product of Oracle Fusion Middlewa... |
critical | 9.8 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-83001 Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (... |
critical | 9.1 | — | Oracle / access manager | 2026-09-15 | 2026-09-21 |
| CVE-2026-82994 Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion... |
critical | 9.8 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-76673 Vulnerabilities have been identified in the API of EdgeConnect SD-WAN Orchestrat... |
critical | 9.8 | — | Arubanetworks / edgeconnect sd-wan orchestrator | 2026-09-15 | 2026-09-25 |
| CVE-2026-76674 Buffer overflow vulnerabilities exist in the underlying operating system of HPE... |
critical | 9.8 | — | Arubanetworks / edgeconnect sd-wan orchestrator | 2026-09-15 | 2026-09-28 |
| CVE-2026-76675 A command injection vulnerability exists in the command line interface of EdgeCo... |
critical | 9.1 | — | Arubanetworks / edgeconnect sd-wan orchestrator | 2026-09-15 | 2026-09-28 |
| CVE-2026-76669 Privilege escalation vulnerabilities exist in the API of HPE Networking EdgeConn... |
critical | 9.9 | — | Arubanetworks / edgeconnect sd-wan orchestrator | 2026-09-15 | 2026-09-25 |
| CVE-2026-76670 Privilege escalation vulnerabilities exist in the API of HPE Networking EdgeConn... |
critical | 9.9 | — | Arubanetworks / edgeconnect sd-wan orchestrator | 2026-09-15 | 2026-09-25 |
| CVE-2026-76672 A vulnerability exists in the SD-WAN Orchestrator that may lead to the exposure... |
critical | 9.9 | — | Arubanetworks / edgeconnect sd-wan orchestrator | 2026-09-15 | 2026-09-25 |
| CVE-2026-73961 Vulnerability in the Oracle JDeveloper product of Oracle Fusion Middleware (comp... |
critical | 9.8 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-73962 Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (... |
critical | 9.6 | — | Oracle / access manager | 2026-09-15 | 2026-09-21 |
| CVE-2026-73963 Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware... |
critical | 9.8 | — | Oracle / webcenter portal | 2026-09-15 | 2026-09-21 |
| CVE-2026-73950 Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (... |
critical | 9.8 | — | Oracle / access manager | 2026-09-15 | 2026-09-21 |
| CVE-2026-73952 Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware... |
critical | 9.1 | — | Oracle / webcenter portal | 2026-09-15 | 2026-09-22 |
| CVE-2026-73953 Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware... |
critical | 9.8 | — | Oracle / webcenter portal | 2026-09-15 | 2026-09-22 |
| CVE-2026-73956 Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware... |
critical | 9.8 | — | Oracle / webcenter portal | 2026-09-15 | 2026-09-22 |
| CVE-2026-73957 Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware... |
critical | 9.3 | — | Oracle / webcenter portal | 2026-09-15 | 2026-09-22 |
| CVE-2026-73944 Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (... |
critical | 9.1 | — | Oracle / access manager | 2026-09-15 | 2026-09-21 |
| CVE-2026-73945 Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (... |
critical | 9.9 | — | Oracle / access manager | 2026-09-15 | 2026-09-21 |
| CVE-2026-73946 Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (... |
critical | 9.1 | — | Oracle / access manager | 2026-09-15 | 2026-09-21 |
| CVE-2026-73947 Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (... |
critical | 9.8 | — | Oracle / access manager | 2026-09-15 | 2026-09-21 |
| CVE-2026-73948 Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware... |
critical | 9.9 | — | Oracle / webcenter portal | 2026-09-15 | 2026-09-21 |
| CVE-2026-73940 Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (... |
critical | 9.8 | — | Oracle / access manager | 2026-09-15 | 2026-09-21 |
| CVE-2026-71133 Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (... |
critical | 10.0 | — | Oracle / access manager | 2026-09-15 | 2026-09-21 |
| CVE-2026-71163 Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (... |
critical | 9.9 | — | Oracle / access manager | 2026-09-15 | 2026-09-21 |
| CVE-2026-70748 Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware... |
critical | 9.8 | — | Oracle / weblogic server | 2026-09-15 | 2026-09-29 |
| CVE-2026-70756 Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware... |
critical | 9.8 | — | Oracle / weblogic server | 2026-09-15 | 2026-09-28 |
| CVE-2026-70757 Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware... |
critical | 9.8 | — | Oracle / weblogic server | 2026-09-15 | 2026-09-28 |
| CVE-2026-70913 Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware... |
critical | 9.8 | — | Oracle / identity manager | 2026-09-15 | 2026-09-23 |
| CVE-2026-56960 In multiple locations, there is a possible use-after-free due to a logic error i... |
critical | 9.8 | — | Google / android | 2026-09-15 | 2026-09-21 |
| CVE-2026-55366 In IP Multimedia Subsystem, there is a possible authentication bypass due to a l... |
critical | 9.8 | — | Google / android | 2026-09-15 | 2026-09-21 |
| CVE-2026-19773 libwebsockets HTTP/2 HPACK Path Header Parsing Out-Of-Bounds Write Remote Code E... |
critical | 9.8 | — | — | 2026-09-15 | 2026-09-18 |
| CVE-2026-81236 Dell Wyse Management Suite, versions prior to 2605.0.3.683, contain an Unrestric... |
critical | 9.8 | — | Dell / wyse management suite | 2026-09-15 | 2026-09-21 |
| CVE-2026-81238 Dell Wyse Management Suite, versions prior to 2605.0.3.683, contain a Missing Au... |
critical | 9.1 | — | Dell / wyse management suite | 2026-09-15 | 2026-09-21 |
| CVE-2026-81239 Dell Wyse Management Suite, versions prior to 2605.0.3.683, contain an Unrestric... |
critical | 9.8 | — | Dell / wyse management suite | 2026-09-15 | 2026-09-21 |
| CVE-2026-81240 Dell Wyse Management Suite, versions prior to 2605.0.3.683, contain an Unrestric... |
critical | 9.8 | — | Dell / wyse management suite | 2026-09-15 | 2026-09-21 |
| CVE-2026-61667 DIRAC is an interware, meaning a software framework for distributed computing. |
critical | 9.9 | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-45579 DIRAC is an interware, meaning a software framework for distributed computing. |
critical | 9.9 | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-11928 IBM Verify Identity Access is vulnerable to a buffer overflow attack. |
critical | 9.8 | — | — | 2026-09-15 | 2026-09-17 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.