CVEs published September 21 to September 27, 2026
2,837 CVEs were published Sep 21 to Sep 27, 2026, 243 of them critical. CISA added 12 vulnerabilities to its Known Exploited Vulnerabilities catalog.
- CVEs published
- 2,837
- Critical
- 243
- Added to CISA KEV
- 12
- Busiest day
- Fri, Sep 25 (680)
- Quietest day
- Sun, Sep 27 (151)
- September 21, 2026285 CVEs · 31 critical
- September 22, 2026453 CVEs · 85 critical
- September 23, 2026472 CVEs · 43 critical
- September 24, 2026552 CVEs · 34 critical
- September 25, 2026680 CVEs · 23 critical
- September 26, 2026244 CVEs · 16 critical
- September 27, 2026151 CVEs · 11 critical
Added to CISA KEV 12
- CVE-2026-7273A stack-based buffer overflow vulnerability in the CGI program of Zyxel GS1900-48HPv2 firmware versions through 2.90(ABTQ.1)C0 could allow aZyxel GS1900-48HPv2 firmware · Zyxel GS1900-8 firmware +8
- CVE-2026-85102Improper Certificate Validation in Quantum Security Gatewaycheckpoint Quantum Security Gateway
- CVE-2026-93616Directory Traversal and File upload allows execution of arbitrary script on the Management Servercheckpoint Quantum Security Management
- CVE-2026-93952Security Advisory 0183Arista Networks VeloCloud Orchestrator (VCO) On-Prem
- CVE-2026-94127BIG-IP APM OAuth vulnerabilityF5 BIG-IP
- CVE-2026-5430Authentication Bypass via JWT Algorithm Mismatch in Multiple WSO2 Products Allows Account TakeoverWSO2 Universal Gateway · WSO2 Traffic Manager +3
- CVE-2026-71362Adobe Commerce | Incorrect Authorization (CWE-863)Adobe Commerce · Adobe Magento Open Source
- CVE-2026-65660Microsoft SharePoint Server Remote Code Execution VulnerabilityMicrosoft SharePoint Enterprise Server · Microsoft SharePoi…
- CVE-2026-67279SSH Pre-Authentication Rekey State Bypass in MikroTik RouterOSMikrotik RouterOS
- CVE-2026-87902An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the WordPress
- CVE-2026-88771A remote code execution vulnerability exists due to improper input validation, which can allow an unauthenticated attacker to execute arbitrary commandsCitrix NetScaler ADC · Citrix NetScaler Gateway
- CVE-2026-88772Memory overflow vulnerability leading to Remote Code Execution or Denial of ServiceCitrix NetScaler ADC · Citrix NetScaler Gateway