September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,826
Low
527
Severity not reported
2,544
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), apache (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-51762 Incorrect access control in the meshInfoKick function of TOTOLINK T6 4.1.5cu.748... |
critical | 9.8 | — | — | 2026-09-01 | 2026-09-03 |
| CVE-2026-51763 Incorrect access control in the freeStaClient function of TOTOLINK T6 4.1.5cu.74... |
critical | 9.8 | — | — | 2026-09-01 | 2026-09-03 |
| CVE-2026-51764 Incorrect access control in the recvSlaveCloudCheckStatus function of TOTOLINK T... |
critical | 9.8 | — | — | 2026-09-01 | 2026-09-03 |
| CVE-2026-51765 Incorrect access control in the recvIndirectMeshInfo function of TOTOLINK T6 4.1... |
critical | 9.8 | — | — | 2026-09-01 | 2026-09-02 |
| CVE-2026-51750 Incorrect access control in the updatePriChannel function of TOTOLINK T6 4.1.5cu... |
critical | 9.8 | — | — | 2026-09-01 | 2026-09-03 |
| CVE-2026-51751 Incorrect access control in the delSlaveDevice function of TOTOLINK T6 4.1.5cu.7... |
critical | 9.8 | — | — | 2026-09-01 | 2026-09-03 |
| CVE-2026-18808 Improper Control of Generation of Code ('Code Injection') vulnerability in Klems... |
critical | 9.8 | — | — | 2026-09-01 | 2026-09-01 |
| CVE-2026-18210 Improper neutralization of special elements used in an SQL command ('SQL injecti... |
critical | 9.8 | — | — | 2026-09-01 | 2026-09-01 |
| CVE-2026-84140 Site isolation issue in the DOM: Navigation component. |
critical | 9.8 | — | Mozilla / firefox | 2026-09-01 | 2026-09-03 |
| CVE-2026-84141 Integer overflow in the Graphics: ImageLib component. |
critical | 9.8 | — | Mozilla / firefox | 2026-09-01 | 2026-09-03 |
| CVE-2026-84142 Internally found bugs present in Thunderbird 154. |
critical | 9.8 | — | Mozilla / firefox | 2026-09-01 | 2026-09-03 |
| CVE-2026-84143 Internally found bugs present in Thunderbird 154, Thunderbird ESR 153.1 and Thun... |
critical | 9.8 | — | Mozilla / firefox | 2026-09-01 | 2026-09-03 |
| CVE-2026-84133 Site isolation issue in the DOM: Push Subscriptions component. |
critical | 9.8 | — | Mozilla / firefox | 2026-09-01 | 2026-09-03 |
| CVE-2026-84134 Other issue in the Profile Backup component. |
critical | 9.8 | — | Mozilla / firefox | 2026-09-01 | 2026-09-03 |
| CVE-2026-84135 Other issue in Firefox Focus for Android. |
critical | 9.8 | — | Mozilla / firefox mobile | 2026-09-01 | 2026-09-03 |
| CVE-2026-84129 Site isolation issue in the DOM: Navigation component. |
critical | 9.8 | — | Mozilla / firefox | 2026-09-01 | 2026-09-03 |
| CVE-2026-84119 Sandbox escape due to use-after-free in the DOM: Navigation component. |
critical | 9.6 | — | Mozilla / firefox | 2026-09-01 | 2026-09-02 |
| CVE-2026-84121 Sandbox escape due to use-after-free in the DOM: Security component. |
critical | 9.6 | — | Mozilla / firefox | 2026-09-01 | 2026-09-02 |
| CVE-2026-51741 Incorrect access control in the clearDiagnosisLog function of TOTOLINK T6 4.1.5c... |
critical | 9.8 | — | — | 2026-09-01 | 2026-09-03 |
| CVE-2026-51743 Incorrect access control in the guest_wifi_sync function of TOTOLINK T6 4.1.5cu.... |
critical | 9.1 | — | — | 2026-09-01 | 2026-09-01 |
| CVE-2026-51744 Incorrect access control in the recv_mesh_info_sync function of TOTOLINK T6 4.1.... |
critical | 9.8 | — | — | 2026-09-01 | 2026-09-03 |
| CVE-2026-51747 Incorrect access control in the keepAlive function of TOTOLINK T6 4.1.5cu.748_B2... |
critical | 9.8 | — | — | 2026-09-01 | 2026-09-03 |
| CVE-2026-18765 Improper neutralization of special elements used in an SQL command ('SQL injecti... |
critical | 9.8 | — | — | 2026-09-01 | 2026-09-01 |
| CVE-2026-84200 Kyverno versions v1.9.0 through v1.12.7 contain a policy exception handling flaw... |
critical | 9.0 | — | — | 2026-09-01 | 2026-09-10 |
| CVE-2026-18550 The Nokri - Job Board WordPress Theme for WordPress is vulnerable to Privilege E... |
critical | 9.8 | — | — | 2026-09-01 | 2026-09-02 |
| CVE-2026-83772 A vulnerability was detected in Cobham SATCOM VSAT7090 Maritime Satellite Router... |
critical | 9.9 | — | — | 2026-09-01 | 2026-09-01 |
| CVE-2026-75865 The WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Go... |
critical | 9.8 | — | — | 2026-09-01 | 2026-09-01 |
| CVE-2026-103591 DeepWiki-Open through commit d92819a contains an unauthenticated arbitrary file... |
high | 7.5 | — | — | 2026-09-30 | 2026-10-02 |
| CVE-2026-92172 Prior to v66.0.0.733.524 of Meta Horizon OS, OVRMediaService could be induced to... |
high | 8.8 | — | — | 2026-09-30 | 2026-10-01 |
| CVE-2026-51860 bisheng 2.3.0, 2.4.0, and 2.4.0-beta1 is vulnerable to Directory Traversal in sr... |
high | 7.5 | — | — | 2026-09-30 | 2026-10-01 |
| CVE-2026-51570 modelscope Agentscope v1.0.0-v1.0.8 is vulnerable to Path Traversal in insert_te... |
high | 8.1 | — | — | 2026-09-30 | 2026-10-02 |
| CVE-2026-51852 agent-zero 1.7, 1.8, 1.9, and 1.10 is vulnerable to Directory Traversal in pytho... |
high | 7.5 | — | — | 2026-09-30 | 2026-10-07 |
| CVE-2026-51853 agent-zero 1.7, 1.8, 1.9, and 1.10 is vulnerable to Directory Traversal in pytho... |
high | 7.5 | — | — | 2026-09-30 | 2026-10-01 |
| CVE-2026-51568 modelscope Agentscope v1.0.18-v1.0.0 is vulnerable to Path Traversal in write_te... |
high | 8.1 | — | — | 2026-09-30 | 2026-10-01 |
| CVE-2026-102997 pypdf is a free and open-source pure-python PDF library. |
high | 7.5 | — | Pypdf Project / pypdf | 2026-09-30 | 2026-10-05 |
| CVE-2026-102998 pypdf is a free and open-source pure-python PDF library. |
high | 7.5 | — | Pypdf Project / pypdf | 2026-09-30 | 2026-10-05 |
| CVE-2026-102999 pypdf is a free and open-source pure-python PDF library. |
high | 7.5 | — | Pypdf Project / pypdf | 2026-09-30 | 2026-10-05 |
| CVE-2026-103000 pypdf is a free and open-source pure-python PDF library. |
high | 7.5 | — | Pypdf Project / pypdf | 2026-09-30 | 2026-10-05 |
| CVE-2026-102995 pypdf is a free and open-source pure-python PDF library. |
high | 7.5 | — | Pypdf Project / pypdf | 2026-09-30 | 2026-10-05 |
| CVE-2026-102996 pypdf is a free and open-source pure-python PDF library. |
high | 7.5 | — | Pypdf Project / pypdf | 2026-09-30 | 2026-10-05 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.