September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,826
Low
527
Severity not reported
2,544
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), apache (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-83711 Authorization bypass through user-controlled key in Microsoft Azure Active Direc... |
critical | 10.0 | — | Microsoft / azure active directory b2c | 2026-09-03 | 2026-10-14 |
| CVE-2026-62916 Authentication bypass using an alternate path or channel in Microsoft Entra ID a... |
critical | 9.8 | — | Microsoft / entra id | 2026-09-03 | 2026-09-08 |
| CVE-2026-65818 Server-side request forgery (ssrf) in Power Automate allows an authorized attack... |
critical | 9.9 | — | Microsoft / power platform | 2026-09-03 | 2026-09-08 |
| CVE-2026-85223 A vulnerability was found in D-Link DNS-340L 1.01B04. |
critical | 9.9 | — | — | 2026-09-03 | 2026-09-04 |
| CVE-2026-85224 A vulnerability was determined in D-Link DNS-320 ShareCenter 2.06B01. |
critical | 9.1 | — | — | 2026-09-03 | 2026-09-04 |
| CVE-2026-85061 MapLibre GL JS is an interactive vector tile map library for web browsers. |
critical | 10.0 | — | — | 2026-09-03 | 2026-09-09 |
| CVE-2026-85222 A vulnerability has been found in D-Link DNS-340L 1.01B04. |
critical | 9.1 | — | — | 2026-09-03 | 2026-09-04 |
| CVE-2026-85050 Out of bounds write in WebGL in Google Chrome on on Android prior to 152.0.7977.... |
critical | 9.6 | — | Google / chrome | 2026-09-03 | 2026-09-08 |
| CVE-2026-85047 Improper input validation in Transactions Platform in Google Chrome on on iOS pr... |
critical | 9.6 | — | Google / chrome | 2026-09-03 | 2026-09-08 |
| CVE-2026-85043 Incomplete cleanup in Network in Google Chrome prior to 152.0.7977.82 allowed a... |
critical | 9.1 | — | Google / chrome | 2026-09-03 | 2026-09-08 |
| CVE-2026-85042 Use after free in DevTools in Google Chrome prior to 152.0.7977.82 allowed a rem... |
critical | 9.6 | — | Google / chrome | 2026-09-03 | 2026-09-08 |
| CVE-2026-85394 python-jose through 3.5.0 fails to properly validate asymmetric keys in HMAC ini... |
critical | 9.1 | — | — | 2026-09-03 | 2026-09-24 |
| CVE-2026-85391 Peppermint through 0.5.5 contains a hardcoded JWT signing secret in docker-compo... |
critical | 9.8 | — | — | 2026-09-03 | 2026-09-09 |
| CVE-2026-82526 R2R through 3.6.6 contains a stacked SQL injection vulnerability that allows una... |
critical | 9.8 | — | — | 2026-09-03 | 2026-09-08 |
| CVE-2026-58400 GeoNetwork is a catalog application to manage spatially referenced resources. |
critical | 9.1 | — | — | 2026-09-03 | 2026-09-09 |
| CVE-2026-84813 Unauthenticated SQL Injection in GeoDirectory <= 2.8.174 versions. |
critical | 9.3 | — | — | 2026-09-03 | 2026-09-04 |
| CVE-2026-84814 Subscriber Privilege Escalation in Bricksforge <= 3.1.8.8 versions. |
critical | 9.8 | — | — | 2026-09-03 | 2026-09-03 |
| CVE-2026-84834 Unauthenticated PHP Object Injection in JobSearch <= 3.2.0 versions. |
critical | 9.8 | — | — | 2026-09-03 | 2026-09-07 |
| CVE-2026-84768 Unauthenticated SQL Injection in VikAppointments Services Booking Calendar <= 1.... |
critical | 9.3 | — | — | 2026-09-03 | 2026-09-03 |
| CVE-2026-84238 Unauthenticated Broken Access Control in YITH Request a Quote for WooCommerce Pr... |
critical | 9.8 | — | — | 2026-09-03 | 2026-09-07 |
| CVE-2026-84753 Unauthenticated PHP Object Injection in Mail Mint <= 1.31.0 versions. |
critical | 9.8 | — | — | 2026-09-03 | 2026-09-05 |
| CVE-2026-85221 MISP contains an improper TLS certificate validation vulnerability in CurlClient... |
critical | 9.1 | — | Misp-project / misp | 2026-09-03 | 2026-09-10 |
| CVE-2026-85216 MISP contains an authentication bypass vulnerability in its LDAP and LinOTP auth... |
critical | 9.8 | — | Misp-project / misp | 2026-09-03 | 2026-09-10 |
| CVE-2026-85181 CAT uses Java String.hashCode as the sole integrity check for session cookies wi... |
critical | 9.8 | — | — | 2026-09-03 | 2026-09-23 |
| CVE-2026-85183 Taipy configures its socket.io server with wildcard CORS origin and credential f... |
critical | 9.3 | — | — | 2026-09-03 | 2026-09-10 |
| CVE-2026-85109 A vulnerability was determined in Tenda HG10 300001138. |
critical | 9.8 | — | — | 2026-09-03 | 2026-09-03 |
| CVE-2026-85165 n8n versions before 2.36.2 contain an expression sandbox bypass vulnerability wh... |
critical | 9.9 | — | N8n / n8n | 2026-09-03 | 2026-09-10 |
| CVE-2026-85154 WWBN AVideo contains an authentication failure vulnerability where the video_id_... |
critical | 9.8 | — | — | 2026-09-03 | 2026-09-08 |
| CVE-2026-85031 A vulnerability was found in TOTOLINK CP450 4.1.0. |
critical | 9.9 | — | — | 2026-09-03 | 2026-09-03 |
| CVE-2026-19117 Under specific conditions, an attacker can register an attacker-controlled FIDO2... |
critical | 9.8 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-66786 A flaw was found in submariner. |
critical | 9.1 | — | — | 2026-09-02 | 2026-10-19 |
| CVE-2026-53649 Joro is a web exploitation framework. |
critical | 9.6 | — | — | 2026-09-02 | 2026-09-09 |
| CVE-2026-20279 As part of Cisco's ongoing commitment to proactive security and product quality,... |
critical | 9.8 | — | — | 2026-09-02 | 2026-09-18 |
| CVE-2026-20274 As part of Cisco's ongoing commitment to proactive security and product quality,... |
critical | 9.8 | — | Cisco / ios xr | 2026-09-02 | 2026-09-17 |
| CVE-2026-20212 A vulnerability in the Silicon One integration for Cisco Nexus 9000 Series Switc... |
critical | 9.8 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-53611 Looking Glass is a modern, stateless network-diagnostic platform — a single self... |
critical | 9.8 | — | — | 2026-09-02 | 2026-09-09 |
| CVE-2026-77009 The WatchMan-Site7 WordPress plugin through 4.2.0 does not restrict access to it... |
critical | 9.9 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-4357 The Embed HTML5 Game WordPress plugin through 1.3 does not properly restrict who... |
critical | 10.0 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2025-9314 The Developer Tools WordPress plugin through 1.1.3 contains an unauthenticated a... |
critical | 9.8 | — | — | 2026-09-02 | 2026-10-19 |
| CVE-2026-73475 Incorrect Authorization vulnerability in Drupal Commerce PayPal allows Forceful... |
critical | 9.1 | — | Centarro / commerce paypal | 2026-09-02 | 2026-09-08 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.