September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,826
Low
527
Severity not reported
2,544
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), apache (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-53939 OpenIDC/cjose is a C library implementing the Javascript Object Signing and Encr... |
critical | 9.1 | — | — | 2026-09-09 | 2026-09-10 |
| CVE-2026-53581 OPNsense is a FreeBSD based firewall and routing platform. |
critical | 9.0 | — | — | 2026-09-08 | 2026-09-25 |
| CVE-2026-85982 The Auth0 AD/LDAP Connector is vulnerable to stored Cross-Site Scripting (XSS) i... |
critical | 9.0 | — | — | 2026-09-08 | 2026-09-10 |
| CVE-2026-84869 ConnectWise ScreenConnect Improper Privilege Management and Missing Authorizatio... |
critical | 9.9 | Listed | ConnectWise / ScreenConnect | 2026-09-08 | 2026-09-12 |
| CVE-2026-78623 The Okta Access Gateway does not sanitize SAML assertion values before interpola... |
critical | 9.9 | — | Okta / access gateway | 2026-09-08 | 2026-09-22 |
| CVE-2026-75746 ColdFusion is affected by an Improper Neutralization of Special Elements used in... |
critical | 9.1 | — | Adobe / coldfusion | 2026-09-08 | 2026-09-18 |
| CVE-2026-48273 ColdFusion is affected by an Improper Neutralization of Directives in Dynamicall... |
critical | 9.9 | — | Adobe / coldfusion | 2026-09-08 | 2026-09-14 |
| CVE-2026-19232 Adobe Experience Manager is affected by an Incorrect Authorization vulnerability... |
critical | 9.9 | — | Adobe / experience manager | 2026-09-08 | 2026-09-11 |
| CVE-2026-82004 Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Specia... |
critical | 10.0 | — | Adobe / campaign | 2026-09-08 | 2026-09-11 |
| CVE-2026-76200 Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability... |
critical | 9.3 | — | Adobe / magento | 2026-09-08 | 2026-09-09 |
| CVE-2026-76201 Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability... |
critical | 9.3 | — | Adobe / commerce | 2026-09-08 | 2026-09-09 |
| CVE-2026-66302 External control of file name or path in Skype for Business allows an unauthoriz... |
critical | 9.8 | — | Microsoft / skype for business server | 2026-09-08 | 2026-09-16 |
| CVE-2026-58822 In multiple functions of ftsmooth.c, there is a possible memory safety issue due... |
critical | 9.8 | — | Google / android | 2026-09-08 | 2026-09-24 |
| CVE-2026-49921 In multiple locations, there is a possible memory safety issue due to a heap buf... |
critical | 9.8 | — | Google / android | 2026-09-08 | 2026-09-24 |
| CVE-2026-28606 In handleBondStateChanged of AdapterService.java, there is a possible way to ski... |
critical | 9.8 | — | Google / android | 2026-09-08 | 2026-09-15 |
| CVE-2026-81376 Incomplete comparison with missing factors in Visual Studio Code allows an unaut... |
critical | 9.6 | — | Microsoft / visual studio code | 2026-09-08 | 2026-09-11 |
| CVE-2026-78509 Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized at... |
critical | 9.8 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-17 |
| CVE-2026-78445 Use after free in Windows Services for NFS ONCRPC XDR Driver allows an unauthori... |
critical | 9.8 | — | Microsoft / windows server 2012 | 2026-09-08 | 2026-09-24 |
| CVE-2026-77493 Double free in Microsoft Graphics Component allows an unauthorized attacker to e... |
critical | 9.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-73025 Weak authentication in Windows iSCSI allows an unauthorized attacker to bypass a... |
critical | 9.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-73009 Use after free in Windows Secure Socket Tunneling Protocol (SSTP) allows an unau... |
critical | 9.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-73010 Use after free in Windows Failover Cluster allows an unauthorized attacker to ex... |
critical | 9.8 | — | Microsoft / windows 10 1809 | 2026-09-08 | 2026-09-17 |
| CVE-2026-72983 Use after free in Windows Internet Connection Sharing (ICS) allows an unauthoriz... |
critical | 9.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-72979 Use after free in Windows DHCP Server allows an unauthorized attacker to execute... |
critical | 9.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-72982 Stack-based buffer overflow in Windows Netlogon allows an unauthorized attacker... |
critical | 9.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-72950 Remote Code Execution in Windows Routing and Remote Access Service (RRAS) allows... |
critical | 9.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-70296 Out-of-bounds write in Windows Imaging Component allows an unauthorized attacker... |
critical | 9.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69910 Stack-based buffer overflow in Windows Hyper-V allows an unauthorized attacker t... |
critical | 9.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-16 |
| CVE-2026-69845 Heap-based buffer overflow in Windows DHCP Server allows an unauthorized attacke... |
critical | 9.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69824 Integer underflow (wrap or wraparound) in Microsoft Standard XPS allows an unaut... |
critical | 9.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69829 Heap-based buffer overflow in Windows Shell allows an unauthorized attacker to e... |
critical | 9.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69819 Out-of-bounds write in RPC Runtime allows an unauthorized attacker to execute co... |
critical | 9.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69769 Heap-based buffer overflow in Windows HTTP Print Provider allows an unauthorized... |
critical | 9.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69768 Heap-based buffer overflow in Windows RNDIS allows an unauthorized attacker to e... |
critical | 9.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69730 Use after free in Windows DNS allows an unauthorized attacker to execute code ov... |
critical | 9.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69715 Out-of-bounds read in Windows Direct Show allows an unauthorized attacker to exe... |
critical | 9.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69641 Missing authorization in Microsoft Exchange Server allows an authorized attacker... |
critical | 9.1 | — | Microsoft / exchange server | 2026-09-08 | 2026-09-22 |
| CVE-2026-69595 Use after free in Windows Services for NFS ONCRPC XDR Driver allows an unauthori... |
critical | 9.8 | — | Microsoft / windows server 2012 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69590 Remote Code Execution in Windows Routing and Remote Access Service (RRAS) allows... |
critical | 9.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69586 Integer overflow or wraparound in Microsoft Windows PDF allows an unauthorized a... |
critical | 9.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-21 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.