CVE Tools
Track your stack

September 2026

15,180 CVEs published, +18% on August 2026 and 3.3× September 2025. CISA added 43 to KEV.

2026 month by month

2026, month by month. Point at another month to read it.
2026: CVEs published per month
YearJanFebMarAprMayJunJulAugSepOctNovDecYear total
2026January 2026: 5,244 CVEs17 added to CISA KEVFebruary 2026: 4,931 CVEs28 added to CISA KEVMarch 2026: 6,821 CVEs26 added to CISA KEVApril 2026: 6,440 CVEs31 added to CISA KEVMay 2026: 7,365 CVEs21 added to CISA KEVJune 2026: 8,314 CVEs23 added to CISA KEVJuly 2026: 10,240 CVEs26 added to CISA KEVAugust 2026: 12,909 CVEs31 added to CISA KEVSeptember 2026: 15,180 CVEs43 added to CISA KEVOctober 2026 so far: 9,826 CVEs18 added to CISA KEV87,270+105%so far
Critical
1,34211% of the 12,373 with a CVSS score
Added to CISA KEV
4326 of this month's CVEs are in KEV, listed a median 1 days after publication
Vendors
2,3114,966 products
Top weakness
XSSCWE-79 · 1,128 CVEs

Who drove it

Vendors by distinct CVEs this month, with how many of those CVEs are now in CISA KEV and how far each moved in the ranking.

  1. 1LinuxLinux, Linux Kernel2,115111none—
  2. 2MicrosoftWindows Server 2025, Windows Server 2025 (Server Core Installation), Windows Server 20221,003592+1
  3. 3GoogleChrome, Android, Common Expression Language662833+1
  4. 4OracleOracle Hyperion Financial Management, Hyperion Financial Management, Oracle Business Intelligence Enterprise Edition63497none−2
  5. 5IBMGuardium Data Protection, Financial Transaction Manager (Ftm) For Red Hat Openshift, Datastage On Cloud Pak For Data40445none—
  6. 6Red HatRed Hat Enterprise Linux 9, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 102659none—
  7. 7ApplemacOS, iOS and iPadOS, iPhone OS24781+21
  8. 8AdobeAdobe Experience Manager As A Cloud Service, Adobe Experience Manager 6.5, Adobe Experience Manager 6.5 Lts224321+2
  9. 9DellSecure Connect Gateway, Secure Connect Gateway 5.0 - Appliance, Secure Connect Gateway 5.0 - Application20711none+4
  10. 10Apache Software FoundationApache Syncope, Apache Roller, Apache Tomcat19552none−3
  11. 11MozillaThunderbird, Firefox, Firefox Mobile19153none+6
  12. 12NvidiaGeforce, Rtx, Quadro, Nvs, Tesla1671none+9
  13. 13HPEFabric Composer, Edgeconnect Operating System, Edgeconnect SD-WAN Gateways15719nonenew
  14. 14WwbnAvideo1076none+74
  15. 15Aruba NetworksFabric Composer, Edgeconnect SD-WAN Orchestrator, Analytics and Location Engine10013nonenew
  16. 16CiscoCisco Identity Services Engine Software, Cisco ISE Passive Identity Connector, Identity Services Engine98333+9
  17. 17OpenclawOpenclaw, Openclaw Windows Node, Clawhub900nonenew
  18. 18MispMisp, Misp-modules, Sachertortephp803none+57
  19. 19MongodbMongodb, Mongodb Server, C Driver702none+1
  20. 20SourcecodesterClass and Exam Timetabling System, Online Reviewer Management System, Syllabus-aligned Learning Management & Examination System680none+4
  21. 21Concrete CMSConcrete CMS652nonenew
  22. 22RabbitmqRabbitmq-server, AMQP091-GO, Rabbitmq-java-client650nonenew
  23. 23KiteworksCore, Email Protection Gateway, Secure Data Forms619nonenew
  24. 24ApacheArtemis, Zookeeper, Nifi5917none−16
  25. 25JetbrainsYoutrack, Intellij Idea, Teamcity572none+56

Severity

How this month's CVEs score on CVSS; 2,807 have no score yet. Severity is not exploitation.

  • Critical1,34211%
  • High5,72046%
  • Medium4,73638%
  • Low5755%

Breakouts

Vendors with at least three times their own 12-month median.

  1. HPE15710.5×
  2. Kiteworks618.7×
  3. Nvidia1678.3×
  4. IBM4048.3×
  5. Apache Software Foundation1958.3×
  6. Dell2077.4×
  7. Elastic536.2×
  8. Oracle6346.2×
  9. Microsoft1,0036.1×
  10. Rabbitmq655.9×

New in the top 100

Not in the top 100 in any of the 24 months before.

  1. Rabbitmq65#22
  2. Kiteworks61#23
  3. Netcore44#35
  4. OISF35#41
  5. Contec Co., Ltd.32#42
  6. Pmmp32#43
  7. Zammad32#44
  8. Zohocorp32#45
  9. Sooperset31#47
  10. Mcp-atlassian29#50

What kind of weakness

Weakness classes (CWE) by distinct CVEs, with how far each moved in the ranking.

  1. CWE-79XSS1,128+1
  2. CWE-862Missing Authorization802+1
  3. CWE-284Improper Access Control612−2
  4. CWE-89SQL Injection494—
  5. CWE-416Use After Free472+13
  6. CWE-863Incorrect Authorization452+1
  7. CWE-122Heap Buffer Overflow447+10
  8. CWE-22Path Traversal441−3
  9. CWE-125Out-of-bounds Read416+5
  10. CWE-200Information Exposure395−1
  11. CWE-639Auth Bypass via User Key383−3
  12. CWE-918SSRF360−6
  13. CWE-78OS Command Injection345−3
  14. CWE-269Improper Privilege Mgmt343+5
  15. CWE-306Missing Auth for Critical Function323+1
  16. CWE-400Resource Consumption297+6
  17. CWE-94Code Injection291−6
  18. CWE-787Out-of-bounds Write288−5
  19. CWE-20Improper Input Validation260−7
  20. CWE-287Improper Authentication258+1

Where it landed

The month's CVEs by the sector of the software they affect. A CVE that touches several sectors counts in each.

Area is CVEs this month. Point at a sector to read it.

Which weakness, where

The top weakness classes against the vendors and the sectors that carried them.

The lighter the cell, the more CVEs. Point at one to read it.

September 2026: weakness classes by vendor and by sector: By vendor
By vendor79XSS862Missing Authorization284Improper Access Control89SQL Injection416Use After Free863Incorrect Authorization122Heap Buffer Overflow22Path Traversal125Out-of-bounds Read200Information Exposure
Linux46
Microsoft91376182231371565
Google253195672521828
Oracle Corporation34273126
IBM21137151593264
Oracle159537
Red Hat420337510203
Apple1111713152142214
Adobe113151112636
Dell1255251
Apache Software Foundation151751655
Mozilla13601214

In the news

The CVEs security news mentioned most in September 2026.

  1. CVE-2026-85046Type confusion in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)198.8
  2. CVE-2026-85880Windows Advanced Local Procedure Call (ALPC) Elevation of Privilege Vulnerability197.8
  3. CVE-2026-88771A remote code execution vulnerability exists due to improper input validation, which can allow an unauthenticated attacker to execute arbitrary commands189.8
  4. CVE-2026-88772Memory overflow vulnerability leading to Remote Code Execution or Denial of Service188.1
  5. CVE-2026-20079Cisco Secure Firewall Management Center Authentication Bypass Remote Code Execution Vulnerability1510.0
  6. CVE-2026-85102Improper Certificate Validation in Quantum Security Gateway159.8
  7. CVE-2026-82329Potential authentication bypass leading to administrative access in Artifactory149.8
  8. CVE-2026-81963Windows Update Stack Elevation of Privilege Vulnerability137.8
  9. CVE-2026-86060SSH session privilege manipulation via a crafted username in Mikrotik RouterOS139.8
  10. CVE-2026-20316Cisco Secure Firewall Management Center Software Static Credential Vulnerability125.3
  11. CVE-2026-87902An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the active theme directories. If relevant pre-conditions for ...128.1
  12. CVE-2026-87491Out of bounds write in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)118.8

CVEs published in September 2026

297 vulnerabilities from this month that were exploited in the wild (CISA KEV), covered in the news, explained on cve.tools or searched for. Known-exploited first, then by CVSS. Showing 201–297.

Snapshot v1, computed Oct 5, 2026, 05:00 UTC. MethodologyAll months on record

Nuclei coverage and the detection gap are held back while the template mirror is repaired.