CVEs published in September 2026

CVE-2026-19445Critical

Use-after-free of a server-side SSLContext when sni_callback switches contexts

CVE-2026-76501Critical

CVE-2026-76486Critical

CVE-2026-76485Critical

CVE-2026-76471Critical

Cisco NX-OS Software NX-API Remote Code Execution Vulnerability

CVE-2026-76465Critical

Cisco Nexus 3000 and 9000 Series Switches MPLS OAM Remote Code Execution Vulnerability

CVE-2026-76459Critical

CVE-2026-76458Critical

CVE-2026-76457Critical

CVE-2026-76456Critical

CVE-2026-76455Critical

CVE-2026-76453Critical

CVE-2026-20173Medium

Cisco NX-OS Software Control Plane Denial of Service Vulnerability

CVE-2026-20038Medium

Cisco Nexus 9000 Series Fabric Switches in ACI Mode Endpoint Group Contract Bypass Vulnerability

CVE-2026-20032Medium

Cisco NX-OS Software Python Sandbox Escape Vulnerability

CVE-2026-76504CriticalCISA KEV

Cisco Catalyst SD-WAN Manager Hex Encoding Vulnerability

CVE-2026-95616High

integer overflow in WSS4J's DER bounds check lets an oversized allocation pass validation

CVE-2026-92899Medium

Apache WSS4J: UsernameToken replay protection bypassed by re-encoding the Nonce

CVE-2026-92121High

In the WSS4J streaming (StAX) code, a signature reference using the WS-Security STR-Transform leaves an internal "inside signed content" flag permanently set

CVE-2026-89238Critical

WSS4J EncryptedHeader child confusion could promote an attacker-controlled plaintext element as the decrypted header, leading to incorrect confidentiality coverage and possible policy bypass

CVE-2026-88920Critical

authentication bypass in the DOM security processor in Apache WSS4J allows unauthenticated remote attackers to forge authenticated SOAP messages via a crafted unsigned SAML sender-vouches assertion containing an attacker-controlled key

CVE-2026-87830Critical

In the StAX streaming WS-SecurityPolicy validator, certain relative or unsupported XPath expressions can be converted into paths that never match the actual XML element path

CVE-2026-85532High

Apache WSS4J accepted attacker-controlled derived-key lengths and offsets without adequate bounds

CVE-2026-77185Critical

BASM (Broken Authentication & Session Management) org.apache.sshd:sshd-core Dependency in Crucible Server

CVE-2026-93994High

BASM (Broken Authentication & Session Management) org.apache.sshd:sshd-core Dependency in Crucible Server

CVE-2026-94053Critical

Authentication bypass via LDAP injection in component sshd-ldap in Apache MINA SSHD versions 1.2.0 to 2.19.0 and 3.0.0-M1 to 3.0.0-M5

CVE-2026-93995Medium

CVE-2026-93996Medium

Uncontrolled resource consumption in component ssd-scp in Apache MINA SSHD versions up to 2.19.0 or 3.0.0-M1 to 3.0.0-M5

CVE-2026-94002High

Possible memory exhaustion in SFTP clients (DefaultSftpClient) in component sshd-sftp in Apache MINA SSHD versions 0.9.0 to 2.19.0 and 3.0.0-M1 to 3.0.0-M5

CVE-2026-94029Medium

Server-side memory exhaustion in Apache MINA SSHD 1.0.0 to 2.19.0 and 3.0.0-M1 to 3.0.0-M5, component sshd-sftp, in the SFTP v6 check-file-name/check-file-handle extension

CVE-2026-94052Critical

missing check in LdapPasswordAuthenticator in component sshd-ldap in Apache MINA SSHD versions 1.2.0 to 2.19.0 or 3.0.0-M1 to 3.0.0-M5 bypassed authentication checks

CVE-2026-102511High

Improper Verification of Source of a Communication Channel in the ADS discovery of the Go implementation of Apache PLC4X (PLC4Go) allows an attacker able to send UDP datagrams to the discovering host to redirect subsequent connections to an arbitrary, attacker-chosen address

CVE-2026-102510High

CVE-2026-102509High

CVE-2026-102508Critical

Improper Verification of Cryptographic Signature and Improper Certificate Validation in the OPC UA driver of Apache PLC4X (PLC4J) allows an attacker in a network position between client and server to impersonate the OPC UA server and to read, forge or modify secure-channel traffic, including user credential ssent by the client

CVE-2026-86134High

NULL pointer dereference vulnerability in the WatchGuard Fireware OS authentication process allows a remote, unauthenticated attacker to crash the management daemon by sending a specially request to the login interface, resulting in a denial of service

CVE-2026-44903Medium

Prometheus Vulnerability in NetApp Products

CVE-2026-40179Medium

Prometheus Vulnerability in NetApp Products

CVE-2026-86104High

Fireware OS Resource Exhaustion in Login Process Allows Denial of Service

CVE-2026-18145High

stack-based buffer overflow vulnerability in the spamBlocker (spamd) service of WatchGuard Fireware OS allows an authenticated attacker with administrator privileges to crash the service or potentially execute arbitrary code by sending a specially crafted management request

CVE-2026-86101High

improper authorization vulnerability in WatchGuard Fireware OS's SAML login process allows a remote, authenticated SAML user with access only to the Access Portal to obtain unauthorized Mobile VPN with SSL access through a specially crafted request

CVE-2026-13046High

deserialization of untrusted data vulnerability in WatchGuard Fireware OS's SAML single sign-on session handling (samld) allows an attacker who has already obtained the ability to write files on the appliance to execute arbitrary code in the context of the samld service by causing samld to load a maliciously crafted session file

CVE-2026-86131Critical

code injection vulnerability in WatchGuard Fireware OS's BOVPN Over TLS client configuration handling allows an attacker who controls the remote VPN server to execute arbitrary commands as root on the connecting Firebox

CVE-2026-13224High

Fireware OS Path Traversal in WebUI Management Agent Allows Arbitrary Local File Read

CVE-2026-86133High

integer underflow vulnerability in the WatchGuard Fireware OS IKE daemon (iked) allows a remote attacker who has completed the initial IKEv2 handshake to crash the iked process by sending a specially crafted encrypted IKEv2 message, resulting in a denial of service

CVE-2026-90441High

Fireware OS Missing Authorization in wgagent Management API Allows Denial of Service - Variant B

CVE-2026-18105High

Fireware OS Uncontrolled Resource Consumption in Diagnostic Tasks Allows Denial of Service

CVE-2026-86105Medium

Fireware OS Improper Authorization in Access Portal Reverse Proxy

CVE-2026-86136High

Fireware OS Missing Authorization in wgagent Management API Allows Denial of Service - Variant A

CVE-2026-86132High

integer underflow vulnerability in the WatchGuard Fireware OS IKEv2 daemon (iked) allows a remote, unauthenticated attacker to crash the process by sending a specially crafted encrypted IKEv2 message negotiated with an AES-GCM cipher suite

CVE-2026-86128High

Fireware OS NULL Pointer Dereference in NetFlow IPv6 Traffic Processing Allows Remote Denial of Service

CVE-2026-81433High

stack-based buffer overflow vulnerability in WatchGuard Fireware OS's DHCP fingerprinting daemon (fingerd) allows an unauthenticated attacker with adjacent network access to execute arbitrary code or crash the process by sending a specially crafted DHCP packet

CVE-2026-102330High

Incorrect authorization in SiteIsolation

CVE-2026-102327High

Incorrect authorization in WebView

CVE-2026-102314High

UI misrepresentation in TabStrip

CVE-2026-102305High

UI misrepresentation in SignIn

CVE-2026-102321High

Type confusion in V8

CVE-2026-102320High

Missing authorization in CORS

CVE-2026-102315High

Uninitialized resource in Media

CVE-2026-102310High

Missing authorization in Payments

CVE-2026-102302High

Buffer overflow in V8

CVE-2026-102329High

Cross-site scripting in WebUI

CVE-2026-102324High

Use after free in PictureInPicture

CVE-2026-102319High

Uninitialized resource in GPU

CVE-2026-102318High

Out of bounds read in WebGL

CVE-2026-102301High

Out of bounds write in GPU

CVE-2026-102328High

Type confusion in V8

CVE-2026-102325High

Uninitialized resource in Skia

CVE-2026-102316High

Use after free in Views

CVE-2026-102309High

Use after free in FullScreen

CVE-2026-102304High

Use after free in Passwords

CVE-2026-102326High

Type confusion in V8

CVE-2026-102323High

Type confusion in V8

CVE-2026-102311High

Uninitialized resource in GPU

CVE-2026-102307High

Uninitialized resource in Dawn

CVE-2026-102303High

Uninitialized resource in GPU

CVE-2026-102300High

Uninitialized resource in WebGPU

CVE-2026-102313High

Information disclosure via uninitialized resource in ANGLE

CVE-2026-102312High

UI misrepresentation in Omnibox

CVE-2026-102306High

Use after free in Bluetooth

CVE-2026-102299High

Type confusion in V8

CVE-2026-102331Critical

arbitrary code execution via buffer overflow in ANGLE

CVE-2026-102317High

Improper privilege management in Mojo

CVE-2026-76738Low

Authenticated Buffer Overflow Vulnerability in the API Endpoint of HPE Networking Instant On Causes Denial-of-Service

CVE-2026-76737Low

Authenticated Local Path Traversal Vulnerability Leads to Denial-of-Service in HPE Networking Instant On

CVE-2026-76736Low

Authenticated Local Buffer Overflow Vulnerability leads to Denial-of-Service in HPE Networking Instant On

CVE-2026-76735Medium

Authenticated Local Sensitive Information Disclosure in HPE Networking Instant On

CVE-2026-76734Medium

Unauthenticated Memory Corruption Vulnerability leads to Denial-of-Service in HPE Networking Instant On

CVE-2026-76733Medium

Authenticated Denial-of-Service Vulnerability in HPE Networking Instant On API Endpoint

CVE-2026-76732Medium

Authenticated Local Privilege Escalation Vulnerability in a Daemon of HPE Networking Instant ON

CVE-2026-76731Medium

Authentication Bypass in the Captive Portal of HPE Networking Instant On

CVE-2026-76730Medium

Improper PAPI Packet handling leads to unauthorized access in HPE Networking Instant ON APs

CVE-2026-76729Medium

Authenticated Format String Vulnerability allows Memory Corruption in HPE Networking Instant ON API Endpoint

CVE-2026-76728High

Authenticated Server-Side Request Forgery Leading to Remote Code Execution in HPE Networking Instant ON APs

CVE-2026-76727High

Authenticated Command Injection Vulnerabilities in HPE Networking Instant ON

CVE-2026-76726High

Authentication Bypass Leading to Unauthorized Network Access in HPE Networking Instant ON API Endpoint

CVE-2026-76725Critical

Authentication Bypass in a Management Protocol of HPE Networking Instant ON APs

CVE-2026-76724Critical

Unauthenticated Adjacent Command Injection Vulnerability in HPE Networking Instant ON APs Command Line Interface (CLI) Accessed by the PAPI Protocol

CVE-2026-76723Critical

Unauthenticated Adjacent Buffer Overflow Vulnerabilities lead to Remote Code Execution in HPE Networking Instant ON APS

CVE-2026-76722Critical

Uncontrolled Format String Vulnerabilities lead to Remote Code Execution or Denial-of-Service in HPE Networking Instant ON APs