September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,828
Low
527
Severity not reported
2,542
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), linux (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-78629 The Okta Hyperdrive agent plugin returns a success response without a signed SAM... |
medium | 5.5 | — | Okta / hyperdrive | 2026-09-08 | 2026-09-22 |
| CVE-2026-78630 The Okta Access Gateway does not neutralize shell metacharacters in SNMP configu... |
medium | 6.7 | — | Okta / access gateway | 2026-09-08 | 2026-09-22 |
| CVE-2026-78631 The Okta Hyperdrive Agent writes the decoded SAML bearer assertion to a local ap... |
medium | 5.5 | — | Okta / hyperdrive | 2026-09-08 | 2026-09-22 |
| CVE-2026-78635 The Okta Privileged Access client URL handler does not insert an option terminat... |
medium | 5.0 | — | — | 2026-09-08 | 2026-09-10 |
| CVE-2026-78738 Silverpeas Core 6.4.6 is vulnerable to Cross Site Scripting (XSS) via the Docume... |
medium | 6.1 | — | — | 2026-09-08 | 2026-09-09 |
| CVE-2026-78741 Silverpeas Core <=6.4.6 is vulnerable to Cross Site Scripting (XSS) in the wysiw... |
medium | 6.1 | — | — | 2026-09-08 | 2026-09-09 |
| CVE-2026-19625 When a Quarkus application has multiple endpoints secured by individual OIDC pro... |
medium | 5.3 | — | — | 2026-09-08 | 2026-09-10 |
| CVE-2026-85484 HTML::FormHandler versions before 0.410002 for Perl render option group labels a... |
medium | 6.1 | — | — | 2026-09-08 | 2026-09-10 |
| CVE-2026-85485 HTML::FormHandler versions before 0.410002 for Perl render some error messages i... |
medium | 6.1 | — | — | 2026-09-08 | 2026-09-10 |
| CVE-2026-85630 HTML::FormHandler versions before 0.410002 for Perl render field attributes into... |
medium | 6.1 | — | — | 2026-09-08 | 2026-09-10 |
| CVE-2026-79905 Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vuln... |
medium | 5.4 | — | Adobe / experience manager | 2026-09-08 | 2026-09-10 |
| CVE-2026-78626 The Okta Access Gateway improperly handles input sanitization and regular expres... |
medium | 6.5 | — | Okta / access gateway | 2026-09-08 | 2026-09-22 |
| CVE-2026-78627 The Okta Hyperdrive Integration installer does not mask the OAuth client secret... |
medium | 5.5 | — | Okta / hyperdrive | 2026-09-08 | 2026-09-22 |
| CVE-2026-78624 The Okta Access Gateway backup restore function does not validate the filename e... |
medium | 4.9 | — | Okta / access gateway | 2026-09-08 | 2026-09-22 |
| CVE-2026-78625 The Okta Access Gateway does not sanitize dashboard label values before writing... |
medium | 6.7 | — | Okta / access gateway | 2026-09-08 | 2026-09-22 |
| CVE-2026-78552 The Okta Access Gateway does not apply its Lua directive restriction to the appl... |
medium | 4.9 | — | Okta / access gateway | 2026-09-08 | 2026-09-23 |
| CVE-2026-78560 The Okta Access Gateway includes an optional pass-through authentication source... |
medium | 6.5 | — | Okta / access gateway | 2026-09-08 | 2026-09-23 |
| CVE-2026-78574 The Okta Hyperdrive Integration plugin resolves a required assembly using a regi... |
medium | 6.3 | — | Okta / hyperdrive | 2026-09-08 | 2026-09-23 |
| CVE-2026-78579 The Okta Access Gateway does not sanitize SAML assertion attribute values before... |
medium | 6.5 | — | Okta / access gateway | 2026-09-08 | 2026-09-23 |
| CVE-2026-78620 The Okta Access Gateway Kerberos configuration handler does not validate file pa... |
medium | 4.9 | — | Okta / access gateway | 2026-09-08 | 2026-09-22 |
| CVE-2026-76002 ColdFusion is affected by a reflected Cross-Site Scripting (XSS) vulnerability. |
medium | 6.1 | — | Adobe / coldfusion | 2026-09-08 | 2026-09-18 |
| CVE-2026-76000 ColdFusion is affected by an Uncontrolled Resource Consumption vulnerability tha... |
medium | 6.5 | — | Adobe / coldfusion | 2026-09-08 | 2026-09-18 |
| CVE-2026-75742 Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vuln... |
medium | 5.4 | — | Adobe / experience manager | 2026-09-08 | 2026-09-10 |
| CVE-2026-75734 Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vuln... |
medium | 5.4 | — | Adobe / experience manager | 2026-09-08 | 2026-09-10 |
| CVE-2026-75735 Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vuln... |
medium | 5.4 | — | Adobe / experience manager | 2026-09-08 | 2026-09-11 |
| CVE-2026-75736 Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vuln... |
medium | 5.4 | — | Adobe / experience manager | 2026-09-08 | 2026-09-10 |
| CVE-2026-75737 Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vuln... |
medium | 5.4 | — | Adobe / experience manager | 2026-09-08 | 2026-09-10 |
| CVE-2026-75738 Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vuln... |
medium | 5.4 | — | Adobe / experience manager | 2026-09-08 | 2026-09-11 |
| CVE-2026-75739 Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vuln... |
medium | 5.4 | — | Adobe / experience manager | 2026-09-08 | 2026-09-10 |
| CVE-2026-75740 Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vuln... |
medium | 5.4 | — | Adobe / experience manager | 2026-09-08 | 2026-09-11 |
| CVE-2026-75741 Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vuln... |
medium | 5.4 | — | Adobe / experience manager | 2026-09-08 | 2026-09-10 |
| CVE-2026-75722 Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) v... |
medium | 5.4 | — | Adobe / experience manager | 2026-09-08 | 2026-09-11 |
| CVE-2026-75724 Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) v... |
medium | 5.4 | — | Adobe / experience manager | 2026-09-08 | 2026-09-10 |
| CVE-2026-75725 Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) v... |
medium | 5.4 | — | Adobe / experience manager | 2026-09-08 | 2026-09-10 |
| CVE-2026-75727 Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vuln... |
medium | 5.4 | — | Adobe / experience manager | 2026-09-08 | 2026-09-10 |
| CVE-2026-75729 Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vuln... |
medium | 5.4 | — | Adobe / experience manager | 2026-09-08 | 2026-09-11 |
| CVE-2026-75730 Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vuln... |
medium | 5.4 | — | Adobe / experience manager | 2026-09-08 | 2026-09-10 |
| CVE-2026-75731 Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vuln... |
medium | 5.4 | — | Adobe / experience manager | 2026-09-08 | 2026-09-10 |
| CVE-2026-75733 Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vuln... |
medium | 5.4 | — | Adobe / experience manager | 2026-09-08 | 2026-09-11 |
| CVE-2026-75713 Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) v... |
medium | 5.4 | — | Adobe / experience manager | 2026-09-08 | 2026-09-10 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.