September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,833
Low
527
Severity not reported
2,537
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), linux (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-76704 A vulnerability in the web-based management interface of the EdgeConnect SD-WAN... |
medium | 5.5 | — | Arubanetworks / edgeconnect sd-wan orchestrator | 2026-09-15 | 2026-09-25 |
| CVE-2026-76696 A vulnerability in HPE Networking EdgeConnect SD-WAN Gateways could allow an una... |
medium | 6.5 | — | Arubanetworks / edgeconnect sd-wan orchestrator | 2026-09-15 | 2026-09-28 |
| CVE-2026-76697 A vulnerability in the web-based management interface of HPE Networking EdgeConn... |
medium | 6.5 | — | Arubanetworks / edgeconnect sd-wan orchestrator | 2026-09-15 | 2026-09-28 |
| CVE-2026-76694 A privilege escalation vulnerability exists in the command line interface of HPE... |
medium | 6.6 | — | Arubanetworks / edgeconnect sd-wan orchestrator | 2026-09-15 | 2026-09-28 |
| CVE-2026-76695 Buffer overflow vulnerabilities exist in the underlying operating system of HPE... |
medium | 6.5 | — | Arubanetworks / edgeconnect sd-wan orchestrator | 2026-09-15 | 2026-09-28 |
| CVE-2026-73965 Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (compone... |
medium | 6.8 | — | Oracle / siebel crm | 2026-09-15 | 2026-09-22 |
| CVE-2026-70755 Vulnerability in the Oracle Web Applications Desktop Integrator product of Oracl... |
medium | 6.5 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-69206 Http4s is a Scala interface for HTTP services. |
medium | 5.9 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-69215 Http4s is a Scala interface for HTTP services. |
medium | 6.8 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-62597 Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle E... |
medium | 6.5 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-51133 Cross Site Scripting vulnerability in za-internet GmbH C-MOR Video Surveillance... |
medium | 6.1 | — | — | 2026-09-15 | 2026-09-22 |
| CVE-2026-18422 Concrete CMS before 9.5.3 did not enforce a destination-side authorization check... |
medium | 6.5 | — | Concretecms / concrete cms | 2026-09-15 | 2026-09-21 |
| CVE-2026-90969 Improper access control in the vault entry listing feature in Devolutions Server... |
medium | 6.5 | — | — | 2026-09-15 | 2026-09-20 |
| CVE-2026-90971 Server-Side Request Forgery (SSRF) in the VMware synchronization feature in Devo... |
medium | 6.5 | — | — | 2026-09-15 | 2026-09-20 |
| CVE-2026-84850 Improper certificate validation in the shared HTTP client used by synchronizatio... |
medium | 4.8 | — | — | 2026-09-15 | 2026-09-20 |
| CVE-2026-81919 Concrete CMS below 9.5.3 did not validate an anti-CSRF token on the block-arrang... |
medium | 4.3 | — | Concretecms / concrete cms | 2026-09-15 | 2026-09-18 |
| CVE-2026-81920 Concrete CMS below 9.5.3 was vulnerable to Cross-Site Request Forgery in the das... |
medium | 4.3 | — | Concretecms / concrete cms | 2026-09-15 | 2026-09-18 |
| CVE-2026-81921 Concrete CMS 8.5.3 through 9.5.2 enabled the OAuth 2.0 refresh-token grant using... |
medium | 5.4 | — | Concretecms / concrete cms | 2026-09-15 | 2026-09-18 |
| CVE-2026-81924 Concrete CMS before 9.5.3 is vulnerable to Cross-Site Request Forgery (CSRF) in... |
medium | 6.5 | — | Concretecms / concrete cms | 2026-09-15 | 2026-09-21 |
| CVE-2026-73465 On affected platforms running Arista EOS, under certain circumstances plaintext... |
medium | 6.3 | — | — | 2026-09-15 | 2026-09-17 |
| CVE-2026-73466 On affected platforms running Arista EOS, under certain circumstances user passw... |
medium | 6.3 | — | — | 2026-09-15 | 2026-09-17 |
| CVE-2026-73467 On affected platforms running Arista EOS, under certain circumstances plaintext... |
medium | 6.3 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-79409 An issue in Webkul Bagisto 2.4.9 allows a remote attacker to obtain sensitive in... |
medium | 6.5 | — | — | 2026-09-15 | 2026-09-22 |
| CVE-2026-69211 Http4s is a Scala interface for HTTP services. |
medium | 4.8 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-69212 Http4s is a Scala interface for HTTP services. |
medium | 5.9 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-69214 Http4s is a Scala interface for HTTP services. |
medium | 6.8 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-69216 Http4s is a Scala interface for HTTP services. |
medium | 5.4 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-73451 On affected platforms running Arista EOS with dual switch cards and with ingress... |
medium | 4.8 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-69201 Http4s is a Scala interface for HTTP services. |
medium | 5.9 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-58767 In multiple functions of arm-smmu-v3.c, there is a possible escalation of privil... |
medium | 6.7 | — | Google / android | 2026-09-15 | 2026-09-18 |
| CVE-2026-58773 In link_load_gnss_image of link_device.c, there is a possible out-of-bounds writ... |
medium | 6.7 | — | Google / android | 2026-09-15 | 2026-09-18 |
| CVE-2026-58731 In multiple functions of physmem_extmem_linux.c, there is a possible out-of-boun... |
medium | 6.2 | — | Google / android | 2026-09-15 | 2026-09-18 |
| CVE-2026-58739 In platform_msg_handler_init of default_msg_handlers.c, there is a possible conf... |
medium | 6.7 | — | Google / android | 2026-09-15 | 2026-09-18 |
| CVE-2026-58747 In smmu_detach_dev of arm-smmu-v3.c, there is a possible permission bypass due t... |
medium | 6.7 | — | Google / android | 2026-09-15 | 2026-09-18 |
| CVE-2026-58751 In multiple functions of arm-smmu-v3.c, there is a possible use-after-free due t... |
medium | 6.7 | — | Google / android | 2026-09-15 | 2026-09-18 |
| CVE-2026-58755 In smmu_install_nested_ste of arm-smmu-v3.c, there is a possible escalation of p... |
medium | 6.7 | — | Google / android | 2026-09-15 | 2026-09-18 |
| CVE-2026-58765 In GPU, there is a possible permission bypass due to a logic error in the code. |
medium | 6.7 | — | Google / android | 2026-09-15 | 2026-09-18 |
| CVE-2026-58716 In multiple locations, there is a possible time-of-check to time-of-use due to a... |
medium | 6.7 | — | Google / android | 2026-09-15 | 2026-09-18 |
| CVE-2026-58718 In smmu_detach_dev_nested of arm-smmu-v3.c, there is a possible escalation of pr... |
medium | 6.7 | — | Google / android | 2026-09-15 | 2026-09-18 |
| CVE-2026-58721 In multiple locations, there is a possible information disclosure due to uniniti... |
medium | 4.4 | — | Google / android | 2026-09-15 | 2026-09-18 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.