September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,826
Low
527
Severity not reported
2,544
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), apache (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-86510 A vulnerability has been found in D-Link DIR-822A A_101. |
critical | 9.9 | — | — | 2026-09-08 | 2026-09-08 |
| CVE-2026-76969 @sap/cds-mtxs NPM library does not perform sufficient checks on certain function... |
critical | 9.4 | — | — | 2026-09-08 | 2026-09-08 |
| CVE-2026-86509 A flaw has been found in D-Link DIR-895L A1_102b07. |
critical | 9.6 | — | — | 2026-09-08 | 2026-09-11 |
| CVE-2026-66768 SAP GUI for Java does not correctly enforce the trust level policy for certain f... |
critical | 9.0 | — | — | 2026-09-08 | 2026-09-09 |
| CVE-2026-58240 SAP NetWeaver Message Server does not sufficiently validate the authenticity of... |
critical | 9.8 | — | — | 2026-09-08 | 2026-09-09 |
| CVE-2026-44756 A memory safety vulnerability exists in the Extended Passport Protocol (EPP) pro... |
critical | 10.0 | — | — | 2026-09-08 | 2026-09-22 |
| CVE-2026-86542 knowns before 0.30.0 fails to validate import names in the import routes, allowi... |
critical | 9.1 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-86543 knowns versions before 0.30.0 serve the management API without authentication on... |
critical | 9.8 | — | — | 2026-09-07 | 2026-09-14 |
| CVE-2026-75650 Adobe Commerce and Magento Improper Neutralization of Special Elements Used in a... |
critical | 10.0 | Listed | Adobe / Commerce and Magento | 2026-09-07 | 2026-09-09 |
| CVE-2026-86480 In JetBrains Hub before 2026.2.52442 an unauthenticated attacker could register... |
critical | 9.8 | — | — | 2026-09-07 | 2026-09-09 |
| CVE-2026-86478 In JetBrains YouTrack before 2025.3.161254,
2026.1.14042 improper authenticatio... |
critical | 9.8 | — | — | 2026-09-07 | 2026-09-09 |
| CVE-2026-7861 Deserialization of untrusted data vulnerability in Next4Biz Information Technolo... |
critical | 9.8 | — | — | 2026-09-07 | 2026-09-09 |
| CVE-2026-18922 A flaw was found in 389 Directory Server. |
critical | 9.8 | — | — | 2026-09-07 | 2026-10-08 |
| CVE-2026-80164 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application... |
critical | 9.1 | — | Dell / secure connect gateway | 2026-09-07 | 2026-09-09 |
| CVE-2026-80129 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application... |
critical | 9.8 | — | Dell / secure connect gateway | 2026-09-07 | 2026-09-09 |
| CVE-2026-80131 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application... |
critical | 9.8 | — | Dell / secure connect gateway | 2026-09-07 | 2026-09-09 |
| CVE-2026-86426 LibreNMS before 26.8.0 contains an authentication bypass vulnerability in the RE... |
critical | 9.8 | — | Librenms / librenms | 2026-09-07 | 2026-09-18 |
| CVE-2026-86419 Affected versions of MISP contain insufficient validation of server-side outboun... |
critical | 9.1 | — | Misp-project / misp | 2026-09-07 | 2026-09-09 |
| CVE-2026-80238 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application... |
critical | 9.3 | — | Dell / secure connect gateway | 2026-09-07 | 2026-09-11 |
| CVE-2026-76578 A flaw was found in FreeIPA. |
critical | 9.8 | — | — | 2026-09-07 | 2026-10-26 |
| CVE-2026-61410 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application... |
critical | 9.4 | — | Dell / secure connect gateway | 2026-09-07 | 2026-09-11 |
| CVE-2026-6223 Improper restriction of excessive authentication attempts vulnerability in Bahçe... |
critical | 9.4 | — | — | 2026-09-07 | 2026-09-30 |
| CVE-2026-86299 A vulnerability was detected in Linksys RE7000 2.0.15. |
critical | 9.9 | — | — | 2026-09-07 | 2026-09-11 |
| CVE-2026-86296 A vulnerability was determined in D-Link DIR-822A A_101. |
critical | 10.0 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-79698 A vulnerability was identified in Advantech WISE-6610-NB, WISE-6610-EB, WISE-661... |
critical | 9.9 | — | — | 2026-09-07 | 2026-09-11 |
| CVE-2026-79697 A vulnerability was determined in Advantech WISE-6610-NB, WISE-6610-EB, WISE-661... |
critical | 9.9 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-86304 MojoX::Authentication versions before 0.006 for Perl allow SAML authentication b... |
critical | 9.8 | — | — | 2026-09-06 | 2026-09-08 |
| CVE-2026-86219 Authen::SASL::Perl::DIGEST_MD5 versions before 2.2100 for Perl accept replayed a... |
critical | 9.8 | — | — | 2026-09-06 | 2026-09-08 |
| CVE-2026-18924 A flaw in libcurl's handling of HTTP/2 Server Push streams, when the parent
hand... |
critical | 9.1 | — | Haxx / curl | 2026-09-06 | 2026-09-15 |
| CVE-2026-19931 A flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given
ho... |
critical | 9.8 | — | Haxx / curl | 2026-09-06 | 2026-09-15 |
| CVE-2026-86167 A vulnerability was identified in Tenda HG10 300001138. |
critical | 9.9 | — | — | 2026-09-06 | 2026-09-08 |
| CVE-2026-86165 A vulnerability was found in Tenda HG10 300001138. |
critical | 9.8 | — | — | 2026-09-06 | 2026-09-08 |
| CVE-2026-86218 N-able N-central Static Code Injection Vulnerability |
critical | 9.8 | Listed | N-able / N-central | 2026-09-06 | 2026-09-09 |
| CVE-2026-75816 The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Authentic... |
critical | 9.8 | — | — | 2026-09-06 | 2026-09-08 |
| CVE-2026-16310 The MemberDash plugin for WordPress is vulnerable to Insecure Direct Object Refe... |
critical | 9.8 | — | — | 2026-09-06 | 2026-09-08 |
| CVE-2026-86152 A flaw has been found in Tenda CP3 27.5.57.101. |
critical | 10.0 | — | — | 2026-09-06 | 2026-09-10 |
| CVE-2026-86153 A vulnerability has been found in Tenda CP3 27.5.57.101. |
critical | 9.1 | — | — | 2026-09-06 | 2026-09-08 |
| CVE-2026-86151 A vulnerability was detected in Tenda CP3 27.5.57.101. |
critical | 9.1 | — | — | 2026-09-06 | 2026-09-11 |
| CVE-2026-86148 A security flaw has been discovered in Tenda CP3 27.5.57.101. |
critical | 9.1 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-86149 A weakness has been identified in Tenda CP3 27.5.57.101. |
critical | 9.1 | — | — | 2026-09-05 | 2026-09-08 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.