September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,833
Low
527
Severity not reported
2,537
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), linux (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-76854 Netcore NR255-V version 1.5.130703 contains a sensitive information disclosure v... |
medium | 6.5 | — | — | 2026-09-15 | 2026-09-17 |
| CVE-2026-76855 Netcore NR255-V version 1.5.130703 contains a sensitive information disclosure v... |
medium | 6.5 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-76857 Netcore NR255-V firmware version 1.5.130703 contains a sensitive information dis... |
medium | 6.5 | — | — | 2026-09-15 | 2026-09-17 |
| CVE-2026-76858 Netcore NR255-V version 1.5.130703 contains a stored cross-site scripting vulner... |
medium | 4.8 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-73444 On affected platforms running Arista EOS with VRRPv2 IP Authentication Header (I... |
medium | 4.7 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-92234 QloApps through 1.7.0 reflects unescaped child feature names into back-office va... |
medium | 5.4 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-92237 Insertion of sensitive information into log file in the slow query logging featu... |
medium | 6.5 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-91744 Race condition in PlatformIntegration in Google Chrome on on Mac prior to 153.0.... |
medium | 5.3 | — | Google / chrome | 2026-09-15 | 2026-09-17 |
| CVE-2026-91746 Integer overflow in Compositing in Google Chrome prior to 153.0.8010.47 allowed... |
medium | 4.3 | — | Google / chrome | 2026-09-15 | 2026-09-17 |
| CVE-2026-91739 Missing authorization in Transactions Platform in Google Chrome prior to 153.0.8... |
medium | 4.2 | — | Google / chrome | 2026-09-15 | 2026-09-17 |
| CVE-2026-91740 Uninitialized resource in Skia in Google Chrome prior to 153.0.8010.47 allowed a... |
medium | 4.3 | — | Google / chrome | 2026-09-15 | 2026-09-17 |
| CVE-2026-91742 Confused deputy in PriceTracking in Google Chrome on on iOS prior to 153.0.8010.... |
medium | 4.8 | — | Google / chrome | 2026-09-15 | 2026-09-21 |
| CVE-2026-91720 Uninitialized resource in ANGLE in Google Chrome prior to 153.0.8010.47 allowed... |
medium | 4.7 | — | Google / chrome | 2026-09-15 | 2026-09-17 |
| CVE-2026-91725 Observable discrepancy in CSS in Google Chrome prior to 153.0.8010.47 allowed a... |
medium | 5.3 | — | Google / chrome | 2026-09-15 | 2026-09-17 |
| CVE-2026-91726 Out of bounds read in WebGL in Google Chrome on on Android prior to 153.0.8010.4... |
medium | 4.7 | — | Google / chrome | 2026-09-15 | 2026-09-17 |
| CVE-2026-91713 Missing authorization in Browser in Google Chrome prior to 153.0.8010.47 allowed... |
medium | 4.2 | — | Google / chrome | 2026-09-15 | 2026-09-17 |
| CVE-2026-91714 Observable discrepancy in Fonts in Google Chrome prior to 153.0.8010.47 allowed... |
medium | 5.3 | — | Google / chrome | 2026-09-15 | 2026-09-17 |
| CVE-2026-91717 Missing authorization in Android in Google Chrome on on Android prior to 153.0.8... |
medium | 5.1 | — | Google / chrome | 2026-09-15 | 2026-09-17 |
| CVE-2026-81926 Concrete CMS 9.4.0 through 9.5.2 did not escape colliding page paths before rend... |
medium | 6.1 | — | Concretecms / concrete cms | 2026-09-15 | 2026-09-21 |
| CVE-2026-81927 Concrete CMS before 9.5.3 contained a stored cross-site scripting vulnerability... |
medium | 5.4 | — | Concretecms / concrete cms | 2026-09-15 | 2026-09-18 |
| CVE-2026-68953 The affected products are vulnerable to an authentication bypass that allows una... |
medium | 6.5 | — | — | 2026-09-15 | 2026-09-18 |
| CVE-2026-66372 The affected products use insufficiently random values, which allows web session... |
medium | 6.8 | — | — | 2026-09-15 | 2026-09-18 |
| CVE-2026-18426 Concrete CMS 9.0.0 through 9.5.2 did not enforce a block-level edit-permission c... |
medium | 6.5 | — | Concretecms / concrete cms | 2026-09-15 | 2026-09-21 |
| CVE-2026-19655 On affected platforms running Arista EOS with Dynamic Host Configuration Protoco... |
medium | 6.5 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-89027 miniOrange JWT Authentication for WP REST APIs plugin for WordPress before 4.8.0... |
medium | 6.5 | — | — | 2026-09-15 | 2026-09-24 |
| CVE-2026-88742 Bacularis 1.0.0 - 6.5.0 is vulnerable to Stored cross-site scripting (XSS) in th... |
medium | 5.4 | — | — | 2026-09-15 | 2026-09-22 |
| CVE-2026-88743 Bacularis 4.7.0 - 6.5.0 is vulnerable to Stored cross-site scripting (XSS) in di... |
medium | 6.1 | — | — | 2026-09-15 | 2026-09-22 |
| CVE-2026-88922 The go-getter library up to versions 1.8.8 and 2.2.3 is vulnerable to a privileg... |
medium | 6.7 | — | — | 2026-09-15 | 2026-09-20 |
| CVE-2026-87285 Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (comp... |
medium | 6.0 | — | Oracle / vm virtualbox | 2026-09-15 | 2026-09-23 |
| CVE-2026-87282 Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (comp... |
medium | 6.0 | — | Oracle / vm virtualbox | 2026-09-15 | 2026-09-23 |
| CVE-2026-87283 Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (comp... |
medium | 6.0 | — | Oracle / vm virtualbox | 2026-09-15 | 2026-09-23 |
| CVE-2026-87274 Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (comp... |
medium | 4.4 | — | Oracle / vm virtualbox | 2026-09-15 | 2026-09-23 |
| CVE-2026-87275 Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (comp... |
medium | 4.6 | — | Oracle / vm virtualbox | 2026-09-15 | 2026-09-23 |
| CVE-2026-87278 Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (comp... |
medium | 6.1 | — | Oracle / vm virtualbox | 2026-09-15 | 2026-09-23 |
| CVE-2026-87279 Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (comp... |
medium | 6.1 | — | Oracle / vm virtualbox | 2026-09-15 | 2026-09-23 |
| CVE-2026-87280 Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (comp... |
medium | 4.2 | — | Oracle / vm virtualbox | 2026-09-15 | 2026-09-23 |
| CVE-2026-87267 Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (comp... |
medium | 5.3 | — | Oracle / vm virtualbox | 2026-09-15 | 2026-09-23 |
| CVE-2026-87253 Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component:... |
medium | 6.1 | — | Oracle / agile product lifecycle management | 2026-09-15 | 2026-09-23 |
| CVE-2026-87248 Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hype... |
medium | 6.7 | — | Oracle / hyperion financial management | 2026-09-15 | 2026-09-21 |
| CVE-2026-87252 Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component:... |
medium | 6.8 | — | Oracle / agile product lifecycle management | 2026-09-15 | 2026-09-23 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.