September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,826
Low
527
Severity not reported
2,544
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), apache (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-84803 SiYuan before v3.8.2 contains a stored cross-site scripting vulnerability in ass... |
critical | 9.0 | — | — | 2026-09-02 | 2026-09-02 |
| CVE-2026-84795 Craft CMS before 5.10.11 fails to validate the admin flag during user registrati... |
critical | 9.8 | — | — | 2026-09-02 | 2026-09-02 |
| CVE-2026-81286 Unauthenticated SQL Injection in WCFM Marketplace <= 3.8.1 versions. |
critical | 9.3 | — | — | 2026-09-02 | 2026-09-04 |
| CVE-2026-81294 Unauthenticated Privilege Escalation in Authorizer <= 3.15.1 versions. |
critical | 9.8 | — | — | 2026-09-02 | 2026-09-02 |
| CVE-2026-78657 The SigmaForms Pro – AI Generated Forms plugin for WordPress is vulnerable to ar... |
critical | 9.8 | — | — | 2026-09-02 | 2026-09-02 |
| CVE-2026-9055 The Booking for Appointments and Events Calendar – Amelia (Premium) plugin for W... |
critical | 9.8 | — | — | 2026-09-02 | 2026-09-02 |
| CVE-2026-84699 Team Password Manager before 14.184.308 fails to enforce authentication requirem... |
critical | 9.1 | — | — | 2026-09-02 | 2026-09-23 |
| CVE-2026-84352 Use after free in WebGL in Google Chrome on on Android prior to 152.0.7977.75 al... |
critical | 9.6 | — | Google / chrome | 2026-09-02 | 2026-09-08 |
| CVE-2026-84353 Use after free in Shared Tab Groups in Google Chrome on on Android prior to 152.... |
critical | 9.6 | — | Google / chrome | 2026-09-02 | 2026-09-08 |
| CVE-2026-84354 Incorrect authorization in FileSystem in Google Chrome prior to 152.0.7977.75 al... |
critical | 9.6 | — | Google / chrome | 2026-09-02 | 2026-09-03 |
| CVE-2026-84333 Use after free in Dawn in Google Chrome on on Android prior to 152.0.7977.75 all... |
critical | 9.6 | — | Google / chrome | 2026-09-02 | 2026-09-08 |
| CVE-2026-84324 Use after free in Proxy in Google Chrome prior to 152.0.7977.75 allowed a remote... |
critical | 9.0 | — | Google / chrome | 2026-09-02 | 2026-09-03 |
| CVE-2026-84325 Improper input validation in DataTransfer in Google Chrome prior to 152.0.7977.7... |
critical | 9.8 | — | Google / chrome | 2026-09-02 | 2026-09-03 |
| CVE-2026-84479 WWBN AVideo (current e01e41ecc and earlier) makes three login-time security cont... |
critical | 9.1 | — | — | 2026-09-01 | 2026-09-08 |
| CVE-2026-84480 WWBN AVideo fails to validate password recovery token expiration in userRecoverP... |
critical | 9.8 | — | — | 2026-09-01 | 2026-09-08 |
| CVE-2026-84637 Malicious calendar invitations could use file URI attachments to launch local or... |
critical | 9.8 | — | Mozilla / thunderbird | 2026-09-01 | 2026-09-03 |
| CVE-2026-84639 Triggering an error condition in certain MIME bodies would cause uninitialized m... |
critical | 9.1 | — | Mozilla / thunderbird | 2026-09-01 | 2026-09-03 |
| CVE-2026-84372 Predis is a flexible and feature-complete Redis and Valkey client for PHP. |
critical | 9.8 | — | — | 2026-09-01 | 2026-09-09 |
| CVE-2026-83548 SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability |
critical | 10.0 | Listed | SonicWall / SMA1000 Appliances | 2026-09-01 | 2026-09-03 |
| CVE-2026-75604 Next.js is a React framework for building full-stack web applications. |
critical | 9.0 | — | — | 2026-09-01 | 2026-09-09 |
| CVE-2023-54391 Proxmox Virtual Environment (VE) 7.0 through 8.0 contains an authentication bypa... |
critical | 9.8 | — | — | 2026-09-01 | 2026-09-08 |
| CVE-2026-73778 A vulnerability exists in the Credential Manager component that may allow for un... |
critical | 9.8 | — | Hpe / arubaos-cx | 2026-09-01 | 2026-09-10 |
| CVE-2026-73749 Multiple vulnerabilities exist in a daemon of AOS-CX that may allow for improper... |
critical | 9.8 | — | Hpe / arubaos-cx | 2026-09-01 | 2026-09-22 |
| CVE-2026-76658 A vulnerability has been identified in the SSH daemon of HPE Networking Fabric C... |
critical | 10.0 | — | Arubanetworks / fabric composer | 2026-09-01 | 2026-09-02 |
| CVE-2026-76657 Vulnerabilities have been identified in the API of HPE Networking Fabric Compose... |
critical | 10.0 | — | Arubanetworks / fabric composer | 2026-09-01 | 2026-09-02 |
| CVE-2026-73700 A vulnerability in the web-based management interface of HPE Networking Fabric C... |
critical | 9.0 | — | Arubanetworks / fabric composer | 2026-09-01 | 2026-09-02 |
| CVE-2026-73701 An unauthenticated remote code execution vulnerability exists in the underlying... |
critical | 9.0 | — | Arubanetworks / fabric composer | 2026-09-01 | 2026-09-02 |
| CVE-2026-19766 An authentication bypass vulnerability exists in the underlying operating system... |
critical | 9.6 | — | Arubanetworks / fabric composer | 2026-09-01 | 2026-09-04 |
| CVE-2026-52111 An issue in fast-note-sync-service <=2.13.7 allows a remote attacker to escalate... |
critical | 9.8 | — | — | 2026-09-01 | 2026-09-08 |
| CVE-2026-19593 OpenAI Codex Desktop for Windows and macOS automatically inspected Git metadata... |
critical | 9.8 | — | — | 2026-09-01 | 2026-10-15 |
| CVE-2026-51934 Buffer Overflow vulnerability in Shenzhen Jixiang Tengda Technology Co., Ltd. |
critical | 9.8 | — | — | 2026-09-01 | 2026-09-02 |
| CVE-2026-79687 Dell PowerStore SDNAS contains a Missing Authentication for Critical Function vu... |
critical | 10.0 | — | Dell / powerstoreos | 2026-09-01 | 2026-10-02 |
| CVE-2026-51769 Incorrect access control in the remoteCloudUpdateCheck function of TOTOLINK T6 4... |
critical | 9.8 | — | — | 2026-09-01 | 2026-09-02 |
| CVE-2026-51770 Incorrect access control in the sendToMasterQosConfig function of TOTOLINK T6 4.... |
critical | 9.8 | — | — | 2026-09-01 | 2026-09-02 |
| CVE-2026-51767 Incorrect access control in the recvClearPairCfg function of TOTOLINK T6 4.1.5cu... |
critical | 9.8 | — | — | 2026-09-01 | 2026-09-03 |
| CVE-2026-18931 Use of Hard-coded Credentials vulnerability in TMT Machine Industry and Trade Lt... |
critical | 9.1 | — | — | 2026-09-01 | 2026-09-01 |
| CVE-2026-78012 An issue in the NetStaX EtherNet/IP Stack prior to v5.6.1 could allow a large Cl... |
critical | 9.8 | — | — | 2026-09-01 | 2026-09-08 |
| CVE-2026-51754 Incorrect access control in the updateSlaveIpList function of TOTOLINK T6 4.1.5c... |
critical | 9.8 | — | — | 2026-09-01 | 2026-09-03 |
| CVE-2026-51757 Incorrect access control in the meshSlaveUpdate function of TOTOLINK T6 4.1.5cu.... |
critical | 9.8 | — | — | 2026-09-01 | 2026-09-03 |
| CVE-2026-51760 Incorrect access control in the informSyncUpgfw function of TOTOLINK T6 4.1.5cu.... |
critical | 9.8 | — | — | 2026-09-01 | 2026-09-03 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.