September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,826
Low
527
Severity not reported
2,544
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), apache (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-77177 Open GenAI Stack (aka ogx-ai) 2026-06-11, as used in the Meta AI backend for Wha... |
critical | 9.8 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2023-54400 Fumasoft Fumeng Cloud contains a SQL injection vulnerability in the AjaxMethod.a... |
critical | 9.8 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-49243 Webmin is a web-based system administration tool for Unix-like servers. |
critical | 9.6 | — | — | 2026-09-29 | 2026-10-13 |
| CVE-2026-82973 Improper neutralization of CRLF sequences in IMAP command construction in psyb0t... |
critical | 9.4 | — | — | 2026-09-29 | 2026-09-29 |
| CVE-2026-100828 Mitigation bypass in the Bookmarks & History component. |
critical | 9.6 | — | Mozilla / firefox | 2026-09-29 | 2026-10-13 |
| CVE-2026-100829 Mitigation bypass in the DOM: Security component. |
critical | 9.6 | — | Mozilla / firefox | 2026-09-29 | 2026-10-13 |
| CVE-2026-100818 Sandbox escape due to use-after-free in the Widget: Gtk component. |
critical | 9.6 | — | Mozilla / firefox | 2026-09-29 | 2026-10-05 |
| CVE-2026-100819 Sandbox escape due to incorrect boundary conditions in the XPCOM component. |
critical | 9.6 | — | Mozilla / firefox | 2026-09-29 | 2026-10-05 |
| CVE-2026-100810 Other issue in the DevTools component. |
critical | 9.8 | — | Mozilla / firefox | 2026-09-29 | 2026-10-05 |
| CVE-2026-100811 Sandbox escape due to use-after-free in the DOM: Core & HTML component. |
critical | 9.6 | — | Mozilla / firefox | 2026-09-29 | 2026-10-05 |
| CVE-2026-100800 Sandbox escape due to use-after-free in the Disability Access APIs component. |
critical | 9.6 | — | Mozilla / firefox | 2026-09-29 | 2026-10-19 |
| CVE-2026-100804 Sandbox escape due to use-after-free in the Preferences: Backend component. |
critical | 9.6 | — | Mozilla / firefox | 2026-09-29 | 2026-10-19 |
| CVE-2026-100794 Sandbox escape due to incorrect boundary conditions in the Internationalization... |
critical | 9.6 | — | Mozilla / firefox | 2026-09-29 | 2026-10-19 |
| CVE-2026-100781 Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender c... |
critical | 9.6 | — | Mozilla / firefox | 2026-09-29 | 2026-10-05 |
| CVE-2026-100786 Sandbox escape due to use-after-free in the Graphics component. |
critical | 9.6 | — | Mozilla / firefox | 2026-09-29 | 2026-10-05 |
| CVE-2026-100787 Sandbox escape in the XUL component. |
critical | 9.6 | — | Mozilla / firefox | 2026-09-29 | 2026-10-05 |
| CVE-2026-100788 Invalid pointer in the JavaScript: WebAssembly component. |
critical | 9.8 | — | Mozilla / firefox | 2026-09-29 | 2026-10-19 |
| CVE-2026-100775 Sandbox escape in the Graphics component. |
critical | 9.6 | — | Mozilla / firefox | 2026-09-29 | 2026-10-06 |
| CVE-2026-100778 Sandbox escape due to use-after-free in the DOM: Core & HTML component. |
critical | 9.6 | — | Mozilla / firefox | 2026-09-29 | 2026-10-05 |
| CVE-2026-100770 Sandbox escape due to use-after-free in the DOM: Content Processes component. |
critical | 9.6 | — | Mozilla / firefox | 2026-09-29 | 2026-10-06 |
| CVE-2026-100758 Sandbox escape in the DOM: Navigation component. |
critical | 9.6 | — | Mozilla / firefox | 2026-09-29 | 2026-10-13 |
| CVE-2026-100760 Sandbox escape in the Security: Process Sandboxing component. |
critical | 9.6 | — | Mozilla / firefox | 2026-09-29 | 2026-10-13 |
| CVE-2026-100762 Sandbox escape due to use-after-free in the DOM: Content Processes component. |
critical | 9.6 | — | Mozilla / firefox | 2026-09-29 | 2026-10-13 |
| CVE-2026-100763 Incorrect boundary conditions in the Graphics: WebGPU component. |
critical | 9.1 | — | Mozilla / firefox | 2026-09-29 | 2026-10-13 |
| CVE-2026-73595 Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16,... |
critical | 9.8 | — | Dell / policy manager for secure connect gateway | 2026-09-29 | 2026-10-15 |
| CVE-2026-8065 An authentication bypass vulnerability in the firmware update endpoint of Hitach... |
critical | 9.1 | — | — | 2026-09-29 | 2026-09-29 |
| CVE-2026-8066 A directory traversal vulnerability in the file upload functionality of Hitachi... |
critical | 9.1 | — | — | 2026-09-29 | 2026-09-29 |
| CVE-2026-91048 The jdbc shell command scope shipped no org.apache.karaf.command.acl.jdbc.cfg. |
critical | 9.8 | — | Apache / karaf | 2026-09-29 | 2026-10-07 |
| CVE-2026-91012 org.apache.karaf.config.core.impl.ConfigRepositoryImpl#update(pid, properties),... |
critical | 9.8 | — | Apache / karaf | 2026-09-29 | 2026-10-07 |
| CVE-2026-84154 A Code Injection vulnerability affecting GEOVIA Geospatial Data Manager from Rel... |
critical | 9.9 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-102240 A vulnerability was found in Netcore NAP930 0.1.241010.141410. |
critical | 10.0 | — | — | 2026-09-29 | 2026-09-29 |
| CVE-2026-101354 A security flaw has been discovered in FAST FAC1203R 20200116_2.0.4. |
critical | 9.6 | — | — | 2026-09-29 | 2026-09-29 |
| CVE-2026-102361 mall4j through 4.0 contains a missing authentication vulnerability in the PUT /u... |
critical | 9.1 | — | — | 2026-09-29 | 2026-10-01 |
| CVE-2026-101264 A vulnerability was determined in Ziroom ZHOME A0101 1.0.1.0. |
critical | 9.1 | — | — | 2026-09-29 | 2026-10-01 |
| CVE-2026-101263 A vulnerability was found in Ziroom ZHOME A0101 1.0.1.0. |
critical | 9.1 | — | — | 2026-09-29 | 2026-09-29 |
| CVE-2026-101261 A flaw has been found in Ziroom ZHOME A0101 1.0.1.0. |
critical | 9.1 | — | — | 2026-09-28 | 2026-10-01 |
| CVE-2026-101262 A vulnerability has been found in Ziroom ZHOME A0101 1.0.1.0. |
critical | 9.1 | — | — | 2026-09-28 | 2026-09-29 |
| CVE-2026-101260 A vulnerability was detected in Ziroom ZHOME A0101 1.0.1.0. |
critical | 9.1 | — | — | 2026-09-28 | 2026-09-29 |
| CVE-2026-102266 PyJWT is a Python implementation of JSON Web Token standards. |
critical | 9.1 | — | Pyjwt Project / pyjwt | 2026-09-28 | 2026-10-07 |
| CVE-2026-102267 PyJWT is a Python implementation of JSON Web Token standards. |
critical | 9.1 | — | Pyjwt Project / pyjwt | 2026-09-28 | 2026-10-07 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.