September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,828
Low
527
Severity not reported
2,542
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), linux (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-75973 Improper Authentication vulnerability in Apache Tomcat. |
high | 7.3 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-77762 Concurrent Execution using Shared Resource with Improper Synchronization ('Race... |
high | 8.1 | — | — | 2026-09-23 | 2026-09-30 |
| CVE-2026-77791 Uncontrolled Resource Consumption vulnerability in Apache Tomcat during sending... |
high | 7.5 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-12370 ZohoCorp ManageEngine OpManager, NetFlow Analyzer, and Network Configuration Man... |
high | 7.6 | — | — | 2026-09-23 | 2026-09-24 |
| CVE-2026-14913 ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.669 and belo... |
high | 8.8 | — | — | 2026-09-23 | 2026-09-24 |
| CVE-2026-15358 ZohoCorp ManageEngine OpManager and Network Configuration Manager versions befor... |
high | 7.5 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-96442 A code execution flaw was found in Emacs, affecting versions prior to 31.2. |
high | 7.8 | — | — | 2026-09-23 | 2026-10-27 |
| CVE-2026-96455 The Reachy Mini daemon exposes an HTTP API for managing the robot. |
high | 8.8 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-96454 Pake turns a website into a desktop application built on Tauri. |
high | 8.2 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-94243 A vulnerability in Apache Sling Security Bundle: the ReferrerFilter accepts weak... |
high | 7.3 | — | Apache / sling security | 2026-09-23 | 2026-10-06 |
| CVE-2026-95626 Tauri's Content Security Policy hardening, which injects a random nonce to restr... |
high | 8.3 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-95627 When a Tauri application uses the dialog plugin's file or folder picker, an atta... |
high | 7.7 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-93368 The Rename wp-login.php to anything you want plugin for WordPress is vulnerable... |
high | 7.5 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-31377 An Improper Authentication vulnerability in the Apache Doris Frontend (FE) meta... |
high | 7.5 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-42801 NULL pointer dereference vulnerability in ASR Crane，Falcon on Linux (as_rrc mod... |
high | 7.4 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-15027 CGServiSign developed by Changing has a OS Command Injection vulnerability. |
high | 8.8 | — | — | 2026-09-23 | 2026-09-24 |
| CVE-2026-91809 A use-after-free vulnerability exists in Foxit PDF Editor/Reader’s handling of m... |
high | 7.8 | — | Foxit / pdf editor | 2026-09-23 | 2026-10-08 |
| CVE-2026-91811 A heap-based out-of-bounds write vulnerability exists in Foxit PDF Editor/Reader... |
high | 7.8 | — | Foxit / pdf editor | 2026-09-23 | 2026-10-15 |
| CVE-2026-91812 A vulnerability in Foxit PDF Editor/Reader’s update mechanism allows man-in-the-... |
high | 8.1 | — | Foxit / pdf editor | 2026-09-23 | 2026-10-08 |
| CVE-2026-91813 A vulnerability in Foxit PDF Editor/Reader’s update mechanism allows an update p... |
high | 7.8 | — | Foxit / pdf editor | 2026-09-23 | 2026-10-08 |
| CVE-2026-91815 Foxit PDF Editor/Reader does not perform sufficient verification of the JPEG2000... |
high | 7.8 | — | Foxit / pdf editor | 2026-09-23 | 2026-10-08 |
| CVE-2026-91816 A use-after-free vulnerability exists in Foxit PDF Editor/Reader’s handling of P... |
high | 7.8 | — | Foxit / pdf editor | 2026-09-23 | 2026-10-08 |
| CVE-2026-91800 A local privilege escalation vulnerability exists in the installer of Foxit PDF... |
high | 8.8 | — | Foxit / pdf editor | 2026-09-23 | 2026-10-15 |
| CVE-2026-91801 A path traversal vulnerability exists in Foxit PDF Editor/Reader's handling of e... |
high | 7.8 | — | Foxit / pdf editor | 2026-09-23 | 2026-10-08 |
| CVE-2026-91803 A local privilege escalation vulnerability exists in the updater of Foxit PDF Ed... |
high | 7.8 | — | Foxit / pdf editor | 2026-09-23 | 2026-10-08 |
| CVE-2026-91804 A heap-based out-of-bounds write vulnerability exists in Foxit PDF Editor/Reader... |
high | 7.8 | — | Foxit / pdf editor | 2026-09-23 | 2026-10-08 |
| CVE-2026-91805 A use-after-free vulnerability exists in Foxit PDF Editor/Reader’s PDF page-tree... |
high | 7.8 | — | Foxit / pdf editor | 2026-09-23 | 2026-10-08 |
| CVE-2026-91806 A use-after-free vulnerability exists in Foxit PDF Editor/Reader’s handling of P... |
high | 7.8 | — | Foxit / pdf editor | 2026-09-23 | 2026-10-08 |
| CVE-2026-91792 When processing a specially crafted PDF, Foxit PDF Editor/Reader may perform ree... |
high | 7.8 | — | Foxit / pdf editor | 2026-09-23 | 2026-10-08 |
| CVE-2026-91793 When opening a specially crafted PDF, Foxit PDF Editor/Reader executes scripts t... |
high | 7.8 | — | Foxit / pdf editor | 2026-09-23 | 2026-10-08 |
| CVE-2026-91794 An out-of-bounds write vulnerability exists in the PDF rendering process of Foxi... |
high | 7.8 | — | Foxit / pdf editor | 2026-09-23 | 2026-10-29 |
| CVE-2026-91795 Foxit PDF Editor/Reader's FileOpen plugin did not adequately validate certain en... |
high | 7.8 | — | Foxit / pdf editor | 2026-09-23 | 2026-10-08 |
| CVE-2026-91797 Foxit PDF Editor/Reader failed to validate the directory traversal path in the a... |
high | 7.8 | — | Foxit / pdf editor | 2026-09-23 | 2026-10-08 |
| CVE-2026-91798 A local privilege escalation vulnerability exists in the update daemon of Foxit... |
high | 8.8 | — | Foxit / pdf editor | 2026-09-23 | 2026-10-29 |
| CVE-2026-91799 A use-after-free vulnerability exists in Foxit PDF Editor/Reader’s handling of J... |
high | 7.8 | — | Foxit / pdf editor | 2026-09-23 | 2026-10-08 |
| CVE-2026-91789 Foxit PDF Editor/Reader’s U3D/GIF texture decoding path contained insufficient v... |
high | 7.8 | — | Foxit / pdf editor | 2026-09-23 | 2026-10-08 |
| CVE-2026-91790 When rendering the page image, Foxit PDF Editor/Reader fails to perform validati... |
high | 7.8 | — | Foxit / pdf editor | 2026-09-23 | 2026-10-08 |
| CVE-2026-91791 When processing a specially crafted PDF file, Foxit PDF Editor/Reader may encoun... |
high | 7.8 | — | Foxit / pdf editor | 2026-09-23 | 2026-10-08 |
| CVE-2026-93508 The WC Fields Factory WordPress plugin before 4.1.11 does not properly restrict... |
high | 8.1 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-86608 The WP Recipe Maker WordPress plugin before 10.8.2 does not have any authorisati... |
high | 8.2 | — | — | 2026-09-23 | 2026-09-23 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.