September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,828
Low
527
Severity not reported
2,542
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), linux (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-77248 MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (C... |
high | 8.6 | — | Mcp-atlassian / mcp atlassian | 2026-09-22 | 2026-09-28 |
| CVE-2026-77253 MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (C... |
high | 7.1 | — | Mcp-atlassian / mcp atlassian | 2026-09-22 | 2026-09-28 |
| CVE-2026-77255 MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (C... |
high | 8.6 | — | Mcp-atlassian / mcp atlassian | 2026-09-22 | 2026-09-29 |
| CVE-2026-77246 MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (C... |
high | 8.6 | — | Mcp-atlassian / mcp atlassian | 2026-09-22 | 2026-09-28 |
| CVE-2026-75743 Adobe Experience Manager Forms JEE is affected by a Cross-Site Request Forgery (... |
high | 7.1 | — | — | 2026-09-22 | 2026-09-24 |
| CVE-2026-75744 Adobe Experience Manager Forms JEE is affected by a stored Cross-Site Scripting... |
high | 8.1 | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-75676 Bridge is affected by a Stack-based Buffer Overflow vulnerability that could res... |
high | 7.8 | — | Adobe / bridge | 2026-09-22 | 2026-09-25 |
| CVE-2026-75649 Bridge is affected by a Heap-based Buffer Overflow vulnerability that could resu... |
high | 7.8 | — | Adobe / bridge | 2026-09-22 | 2026-09-24 |
| CVE-2026-75655 Bridge is affected by an Uncontrolled Recursion vulnerability that could result... |
high | 7.8 | — | Adobe / bridge | 2026-09-22 | 2026-09-25 |
| CVE-2026-75658 Bridge is affected by an out-of-bounds write vulnerability that could result in... |
high | 7.8 | — | Adobe / bridge | 2026-09-22 | 2026-09-25 |
| CVE-2026-75663 Bridge is affected by an out-of-bounds write vulnerability that could result in... |
high | 7.8 | — | Adobe / bridge | 2026-09-22 | 2026-09-25 |
| CVE-2026-75665 Bridge is affected by a Heap-based Buffer Overflow vulnerability that could resu... |
high | 7.8 | — | Adobe / bridge | 2026-09-22 | 2026-09-25 |
| CVE-2026-75632 CAI Content Credentials is affected by an Uncontrolled Resource Consumption vuln... |
high | 7.5 | — | Adobe / c2pa | 2026-09-22 | 2026-10-15 |
| CVE-2026-19480 CAI Content Credentials is affected by an Improper Input Validation vulnerabilit... |
high | 7.5 | — | Adobe / c2pa | 2026-09-22 | 2026-10-15 |
| CVE-2026-34689 Adobe Connect is affected by an Improper Limitation of a Pathname to a Restricte... |
high | 8.6 | — | Adobe / connect | 2026-09-22 | 2026-09-25 |
| CVE-2026-95656 A vulnerability was found in dgtlmoon changedetection.io up to 50389b07. |
high | 7.3 | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-94384 Missing authorization in Amazon amazon-connect-salesforce-lambda before 5.26 all... |
high | 8.1 | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-93345 MikroTik RouterOS before 7.25beta4 contains an improper input validation vulnera... |
high | 7.5 | — | — | 2026-09-22 | 2026-09-25 |
| CVE-2026-85279 Notepad++ is a free and open-source source code editor. |
high | 8.6 | — | — | 2026-09-22 | 2026-09-23 |
| CVE-2026-85995 Notepad++ is a free and open-source source code editor. |
high | 7.3 | — | — | 2026-09-22 | 2026-09-23 |
| CVE-2026-86054 Notepad++ is a free and open-source source code editor. |
high | 7.8 | — | — | 2026-09-22 | 2026-09-28 |
| CVE-2026-83597 Netdata is an open source observability tool. |
high | 7.0 | — | — | 2026-09-22 | 2026-09-23 |
| CVE-2026-82003 Adobe Campaign Classic (ACC) is affected by an Improper Input Validation vulnera... |
high | 8.5 | — | Adobe / campaign | 2026-09-22 | 2026-09-26 |
| CVE-2026-77271 MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (C... |
high | 8.8 | — | Mcp-atlassian / mcp atlassian | 2026-09-22 | 2026-09-28 |
| CVE-2026-77274 MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (C... |
high | 8.2 | — | Mcp-atlassian / mcp atlassian | 2026-09-22 | 2026-09-28 |
| CVE-2026-77605 Notepad++ is a free and open-source source code editor. |
high | 7.8 | — | — | 2026-09-22 | 2026-09-28 |
| CVE-2026-77258 MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (C... |
high | 7.7 | — | Mcp-atlassian / mcp atlassian | 2026-09-22 | 2026-09-29 |
| CVE-2026-77260 MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (C... |
high | 7.5 | — | Mcp-atlassian / mcp atlassian | 2026-09-22 | 2026-09-29 |
| CVE-2026-77261 MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (C... |
high | 8.5 | — | Mcp-atlassian / mcp atlassian | 2026-09-22 | 2026-09-25 |
| CVE-2026-77265 MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (C... |
high | 7.5 | — | Mcp-atlassian / mcp atlassian | 2026-09-22 | 2026-09-29 |
| CVE-2026-77243 MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (C... |
high | 8.8 | — | Mcp-atlassian / mcp atlassian | 2026-09-22 | 2026-09-29 |
| CVE-2026-77242 MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (C... |
high | 7.5 | — | Mcp-atlassian / mcp atlassian | 2026-09-22 | 2026-09-29 |
| CVE-2026-43642 Softaculous Virtualizor before 3.2.9 (Patch 9) and 3.0.0 contains a PHP object i... |
high | 8.1 | — | — | 2026-09-22 | 2026-09-26 |
| CVE-2026-43643 Softaculous Virtualizor before 3.2.9 (Patch 9) and 3.0.0 contains an authorizati... |
high | 7.5 | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-94455 An HTTP endpoint intended for provisioning enterprise and reseller organisations... |
high | 7.1 | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-87902 WordPress Core Remote File Inclusion Vulnerability |
high | 8.1 | Listed | WordPress / Core | 2026-09-22 | 2026-09-28 |
| CVE-2026-85740 LightRAG provides simple and fast retrieval-augmented generation. |
high | 7.1 | — | — | 2026-09-22 | 2026-09-28 |
| CVE-2026-83603 Netdata is an open source observability tool. |
high | 8.4 | — | — | 2026-09-22 | 2026-09-23 |
| CVE-2026-83598 Netdata is an open source observability tool. |
high | 7.8 | — | — | 2026-09-22 | 2026-09-23 |
| CVE-2026-83599 Netdata is an open source observability tool. |
high | 7.5 | — | — | 2026-09-22 | 2026-09-23 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.