CVEs published in September 2026

CVE-2026-62801Medium

Microsoft PowerShell Security Feature Bypass Vulnerability

CVE-2026-57098High

Microsoft Remote Desktop App for Windows Information Disclosure Vulnerability

CVE-2026-77482High

Microsoft SQL Server Remote Code Execution Vulnerability

CVE-2026-85360High

Windows Kernel Elevation of Privilege Vulnerability

CVE-2026-69782High

Windows DNS Server Remote Code Execution Vulnerability

CVE-2026-70091Medium

Windows DNS Denial of Service Vulnerability

CVE-2026-69341High

Windows Image Acquisition Elevation of Privilege Vulnerability

CVE-2026-62895High

Azure Arc SQL Server Extension Elevation of Privilege Vulnerability

CVE-2026-62744High

Microsoft Windows Media Foundation Remote Code Execution Vulnerability

CVE-2026-62694High

Windows Installer Elevation of Privilege Vulnerability

CVE-2026-62706High

Microsoft Windows Media Foundation Remote Code Execution Vulnerability

CVE-2026-9216Low

insufficient input validation vulnerability in the listed NETGEAR RAX series models allows a network-adjacent attacker having network access (such as WiFi credentials) to crash the router's management UI

CVE-2026-9215Low

cross site request forgery (CSRF) vulnerability in the listed NETGEAR models allows an attacker who can leverage social engineering techniques on a router administrator to tamper with router configuration and disrupt router operations with active assistance from the router administrator

CVE-2026-75156Critical

CVE-2026-20293High

Cisco UCS and UCS-Based Appliances UEFI Shell Secure Boot Bypass Vulnerability

CVE-2026-12647Critical

Missing Authorization vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on the server

CVE-2026-12646Critical

Missing Authorization vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on the server

CVE-2026-12645Critical

Missing Authorization vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on the server

CVE-2026-83527High

Authentication Bypass vulnerability in Sentry before R10.8.2, R10.7.3 and R10.6.4 allows a remote unauthenticated attacker to gain administrative level access

CVE-2026-12648High

Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on the server

CVE-2026-12650Critical

Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on the server

CVE-2026-12651High

Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on the server

CVE-2026-12745Critical

Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote unauthenticated attacker to execute arbitrary code on the server

CVE-2026-12744Critical

Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote unauthenticated attacker to execute arbitrary code on the server

CVE-2026-18851High

Missing authorization in Ivanti Endpoint Manager Mobile before version 12.10.0.0, 12.9.0.2, and 12.8.0.4 allows a remote authenticated attacker to escalate their privileges to admin

CVE-2026-86135High

Cross-Site Request Forgery (CSRF) vulnerability in WatchGuard Dimension's database snapshot creation feature allows a remote attacker to trigger unauthorized snapshot creation by tricking an authenticated administrator into visiting a specially crafted web page

CVE-2026-84393High

improper validation of certificate with host mismatch vulnerability in Fortinet FortiOS 7.6.1 through 7.6.6, FortiProxy 7.6.2 through 7.6.6 may allow attacker to information disclosure via <insert attack vector here>

CVE-2026-84392Low

Null Pointer Dereference in Log Report

CVE-2026-84391Medium

use of uninitialized variable vulnerability in Fortinet FortiAnalyzer 7.6.3 through 7.6.6 may allow attacker to denial of service via <insert attack vector here>

CVE-2026-84390Critical

JWT used for authentication in web GUI signed with static key

CVE-2026-84389Low

url redirection to untrusted site ('open redirect') vulnerability in Fortinet FortiSIEM 7.5.0 through 7.5.1, FortiSIEM 7.4.1 through 7.4.2 may allow attacker to execute unauthorized code or commands via <insert attack vector here>

CVE-2026-84388Critical

Improper Authentication of FortiPAM Server

CVE-2026-84387High

improper neutralization of special elements used in a command ('command injection') vulnerability in Fortinet FortiSandbox 5.2.0, FortiSandbox 5.0.0 through 5.0.6, FortiSandbox 4.4.0 through 4.4.9 may allow attacker to execute unauthorized code or commands via <insert attack vector here>

CVE-2026-84386Medium

unverified ownership vulnerability in Fortinet FortiClientWindows 7.4.0 through 7.4.7, FortiClientWindows 7.2 all versions may allow attacker to improper access control via <insert attack vector here>

CVE-2026-84385Medium

improper access control vulnerability in Fortinet FortiSOAR PaaS 7.6.0 through 7.6.6, FortiSOAR PaaS 7.5.0 through 7.5.3, FortiSOAR PaaS 7.4 all versions, FortiSOAR PaaS 7.3 all versions, FortiSOAR on-premise 7.6.0 through 7.6.6, FortiSOAR on-premise 7.5.0 through 7.5.3, FortiSOAR on-premise 7.4 all versions, FortiSOAR on-premise 7.3 all versions may allow attacker to escalation of privilege via <insert attack vector here>

CVE-2026-80075High

Windows Work Folders Elevation of Privilege Vulnerability

CVE-2026-58600High

HEVC Video Extensions Elevation of Privilege Vulnerability

CVE-2026-58599High

HEVC Video Extensions Remote Code Execution Vulnerability

CVE-2026-26084Critical

improper access control vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through 4.4.8, FortiSandbox Cloud 5.0.4 through 5.0.5, FortiSandbox PaaS 5.0.4 through 5.0.5 may allow attacker to access sensitive information via crafted HTTP requests

CVE-2026-22575Medium

improper access control vulnerability in Fortinet FortiManager 7.6.0 through 7.6.4, FortiManager 7.4.0 through 7.4.10, FortiManager 7.2 all versions, FortiManager Cloud 7.6.2 through 7.6.4, FortiManager Cloud 7.4.1 through 7.4.10, FortiManager Cloud 7.2 all versions may allow an administrator to bypass the approval process for workflow sessions via crafted HTTP or HTTPs requests

CVE-2026-78254High

The ftp and scp tasks of Apache Ant can download files from a remote server

CVE-2026-80231High

Incorrect HTTPS connection reuse with Native CA Store

CVE-2026-19931Critical

Information disclosure via incorrect connection reuse with Negotiate authentication

CVE-2026-13608High

Libcurl Vulnerability in NetApp Products

CVE-2026-86218CriticalCISA KEV

N-able N-central Static Code Injection Vulnerability

CVE-2026-86060CriticalCISA KEV

MikroTik RouterOS Improper Neutralization of Argument Delimiters in a Command Vulnerability

CVE-2026-67281High

Unauthenticated file read in Mikrotik RouterOS

CVE-2026-67279MediumCISA KEV

Mikrotik RouterOS Improper Enforcement of Behavioral Workflow Vulnerability

CVE-2026-67278Medium

MikroTik RouterOS accepts malformed RSA/PKCS#1 v1.5 signatures across RSA-based services, including TLS/X.509 certificate validation and SSH host-key authentication

CVE-2026-67277HighCISA KEV

MikroTik RouterOS Missing Authentication for Critical Function Vulnerability

CVE-2026-67276Critical

SSH user impersonation possible in Mikrotik RouterOS

CVE-2026-86206Medium

Access control filter bypass allows unauthorised access to APIs

CVE-2026-86207High

Authentication bypass leads to unauthorised access to N-central

CVE-2026-81939Critical

Zip Slip vulnerability in the SonicWall Network Security Manager (NSM) On-Prem file upload and archive processing functionality allows an attacker to extract files outside the intended destination directory using a specially crafted archive

CVE-2026-78328Critical

missing authorization vulnerability in the SonicWall Network Security Manager (NSM) On-Prem Management interface allows a lower-privileged Admin user to escalate privileges to SuperAdmin

CVE-2026-78327Critical

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in the SonicWall Network Security Manager (NSM) On-Prem Management interface allows an authenticated attacker with SuperAdmin privileges to inject arbitrary commands that are executed on the underlying host, resulting in remote code execution

CVE-2026-78849Medium

Cross Site Scripting vulnerability in Netgate pfSense Plus software versions <= 26.03 pfSense CE software versions <= 2.8.1 allows a remote attacker to execute arbitrary code via the captive_portal_status.widget.php file

CVE-2026-38961Medium

Cross-Site Scripting (XSS) vulnerability in the RSS Widget of Netgate pfSense Plus (versions 26.03, 25.11.1) and pfSense CE (version 2.8.1) allows remote authenticated attackers to inject arbitrary JavaScript via malicious content in an RSS feed title

CVE-2026-19534High

DoS (Denial of Service) undici Dependency in Jira Software Data Center

CVE-2026-80825Unrated

NETGEAR: In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7925: ensure tx headroom in usb_sdio_tx_prepare_skb mt7925_usb_sdio_tx_prepare_skb pushes a TX descriptor and a USB header onto every skb and assumes the headroom for them is already there

CVE-2026-52691High

** UNSUPPORTED WHEN ASSIGNED ** Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Griffin Hive Metastore Module

CVE-2026-80190Medium

Apache Allura: stored XSS via SVN code repositories

CVE-2026-85229Medium

CVE-2025-54057Medium

CVE-2026-81270High

Apache Allura: exposure of non-public information via search

CVE-2026-71216Medium

Apache SkyWalking: PagerDuty alarm hook transmits the integration routing key over cleartext HTTP

CVE-2026-80181Critical

Apache Allura's webhooks are vulnerable to Server-Side Request Forgery (SSRF)

CVE-2026-80180Medium

Stored XSS via markdown HTML processing in Apache Allura

CVE-2026-85049High

Use after free in Skia

CVE-2026-56128Medium

pfSense Plus: CE: pfSense Plus and CE: Stored Cross-Site Scripting (XSS) via firewall schedule description.

CVE-2026-56127Medium

pfSense Plus before 26.07 and CE before 2.9.0 allow authenticated users with the Firewall: Rules: Edit privilege to inject arbitrary JavaScript via the descr parameter in /firewall_rules_edit.php

CVE-2026-56126Medium

pfSense Plus before 26.07 and CE before 2.9.0 allow authenticated users with the Status: Monitoring privilege to inject arbitrary JavaScript via graph configuration parameters in /status_monitoring.php

CVE-2026-58097High

CVE-2026-58096High

CVE-2026-58095High

CVE-2026-58094High

FreeBSD Vulnerability in NetApp Products

CVE-2026-58093High

FreeBSD Vulnerability in NetApp Products

CVE-2026-58092High

FreeBSD Vulnerability in NetApp Products

CVE-2026-58091High

FreeBSD Vulnerability in NetApp Products

CVE-2026-58090High

FreeBSD Vulnerability in NetApp Products

CVE-2026-58089High

FreeBSD Vulnerability in NetApp Products

CVE-2026-84292High

SSRF (Server-Side Request Forgery) fast-uri Dependency in Jira Software Data Center

CVE-2026-78222High

vulnerability exists in NGINX JavaScript where a malformed HTTP response received by ngx.fetch can crash an NGINX worker when trusted JavaScript reads Response.statusText

CVE-2026-78689Critical

NGINX JavaScript (njs) has a vulnerability in the XML module's namespace prefix list parser, reachable through the xml.exclusiveC14n method

CVE-2026-77180High

When NGINX Ingress Controller is configured with Ingress annotations, an injection vulnerability exists in the configuration generator of NGINX Ingress Controller

CVE-2026-66362High

When NGINX Plus is configured as the data plane for NGINX Gateway Fabric, an injection vulnerability exists in the NGINX configuration generator component of NGINX Gateway Fabric

CVE-2026-18329High

NGINX JavaScript (njs) and QuickJS (qjs) engines have a vulnerability when a js_access handler performs asynchronous request body processing and an exception is thrown during asynchronous access-control evaluation before an explicit access denial is returned

CVE-2026-66842High

BIG-IP has a vulnerability where an authenticated user of any role may be able to create administrative user accounts through an undisclosed request to Traffic Management User Interface (TMUI)

CVE-2026-63020Low

vulnerability exists in an undisclosed BIG-IP Configuration utility page that may allow an attacker to spoof error messages Impact: An attacker may trick authenticated BIG-IP users into accessing malicious links and reflect a spoofed error message in the victim's BIG-IP Configuration utility web browser session

CVE-2026-32773Medium

There is a lack of XSS escaping in the Spark History Server prior to 3.5.8 which allows a malicious Spark job to generate arbitrary unescaped frontend code which could lead to a minimal privilege escalation in browser

CVE-2026-84358High

Improper privilege management in Downloads

CVE-2026-84351High

Buffer overflow in GPU

CVE-2026-84359High

Information leak in Skia

CVE-2026-84357High

Improper input validation in Omnibox

CVE-2023-54391Critical

Proxmox Virtual Environment (VE) 7.0 through 8.0 contains an authentication bypass vulnerability in libpve-access-control before 8.0.4 that allows unauthenticated attackers to authenticate as any existing enabled user without a configured second factor by supplying an arbitrary tfa-challenge value in the API login endpoint

CVE-2026-84375High

DoS (Denial of Service) js-yaml Dependency in Jira Software Data Center

CVE-2026-83549CriticalCISA KEV

SonicWall SMA1000 Appliances OS Command Injection Vulnerability

CVE-2026-83548CriticalCISA KEV

SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability

CVE-2026-73783Medium

AOS-CX: Stack overflow vulnerabilities exist in an API endpoint of AOS-CX

CVE-2026-73782High

AOS-CX: format string vulnerability exists in the command line interface of AOS-CX that could lead to unauthenticated remote code execution