Month report
September 2026
Rolled up 2026-09-22 15:40 from 376,109 CVE records
10,889 CVEs published, +152.1% on the same month last year. 1,062 rated critical, 30 listed by CISA as exploited. linux led with 1,509; the most common weakness class was CWE-79 (755). wwbn climbed 66 places, the largest move. 3 vendors ranked for the first time.
Published
10,889
Critical / high
1,062 / 4,654
Medium / low
3,683 / 486
Added to CISA KEV
30
Public exploit
167
Scanner template
18
Publication to KEV
How long before CISA listed them
Median days to listing
1
Listed within 7 days
100%
Listed within 30 days
100%
Detection gap
Listed as exploited, no public template
Listed this month
30
With a template
8
No template
22
Measured against the nuclei-templates CVE index only. No template there does not mean a CVE is undetectable by any other tool.
Vendors
Ranked by distinct CVEs this month
| # | Vendor | Top products | ||||||
|---|---|---|---|---|---|---|---|---|
| 1 | linux | 1,509 | 107 | 2 | linux (1509) | — | ||
| 2 | microsoft | 1,000 | 60 | 2 | 3 | windows server 2025 (679) · windows server 2025 server core installation (677) · windows server 2022 (641) | ↑1 | |
| 3 | oracle | 634 | 97 | oracle hyperion financial management (81) · oracle business intelligence enterprise edition (29) · siebel crm deployment (29) | ↓1 | |||
| 4 | 514 | 59 | 3 | 9 | chrome (324) · android (184) · android wear (1) | ↑3 | ||
| 5 | ibm | 297 | 32 | 1 | guardium data protection (42) · langflow oss (41) · i (31) | ↓1 | ||
| 6 | apple | 246 | 7 | 6 | macos (222) · ios and ipados (139) · visionos (99) | ↑13 | ||
| 7 | dell | 182 | 11 | secure connect gateway 5 0 appliance (104) · secure connect gateway 5 0 application (103) · openmanage server administrator managed node for rhel 8 10 (20) | ↑6 | |||
| 8 | redhat | 173 | 5 | 3 | red hat enterprise linux 9 (97) · red hat enterprise linux 8 (90) · red hat enterprise linux 10 (85) | ↓3 | ||
| 9 | adobe | 171 | 7 | 1 | 1 | adobe experience manager 6 5 (105) · adobe experience manager 6 5 lts (105) · adobe experience manager as a cloud service (105) | — | |
| 10 | hewlett packard enterprise hpe | 129 | 12 | 1 | fabric composer (52) · edgeconnect sd wan gateways (38) · aos cx (34) | · | ||
| 11 | mozilla | 113 | 30 | 1 | firefox (104) · thunderbird (102) · firefox for ios (1) | ↑1 | ||
| 12 | wwbn | 106 | 6 | avideo (106) | ↑66 | |||
| 13 | apache | 103 | 35 | 1 | apache syncope (22) · apache activemq artemis (7) · apache artemis (7) | ↓7 | ||
| 14 | cisco | 97 | 32 | 2 | 3 | cisco identity services engine software (42) · cisco ise passive identity connector (26) · cisco secure firewall management center fmc (20) | ↑4 | |
| 15 | concrete cms | 65 | concrete cms (65) | · | ||||
| 16 | mongodb | 64 | 2 | mongodb server (25) · c driver (14) · mongoid (8) | ↑14 | |||
| 17 | sourcecodester | 58 | class and exam timetabling system (12) · drug recommendation system (7) · syllabus aligned learning management examination system (7) | — | ||||
| 18 | misp | 54 | 2 | 1 | misp (53) · sachertortephp (1) | ↑32 | ||
| 19 | jenkins project | 53 | 1 | jenkins (13) · jenkins script security plugin (10) · jenkins gitlab plugin (2) | ↑23 | |||
| 20 | grokability | 46 | snipe it (46) | · | ||||
| 21 | arista networks | 44 | 6 | eos (39) · velocloud edge (3) · velocloud (1) | · | |||
| 22 | elastic | 42 | kibana (30) · elasticsearch (4) · eck operator (2) | ↓7 | ||||
| 23 | ash project | 37 | ash (18) · ash typescript (7) · ash authentication oauth2 server (6) | new | ||||
| 24 | itsourcecode | 36 | sales and inventory system (22) · leave management system (6) · online medicine delivery system (5) | ↑8 | ||||
| 25 | oisf | 35 | 3 | suricata (35) | · | |||
| 26 | contec co | 34 | 1 | remote i o coupler unit server type cpsn mcb271 (7) · fxa3000 (4) · fxa3020 (4) | · | |||
| 27 | patriksimek | 34 | 20 | vm2 (34) | · | |||
| 28 | nvidia | 32 | megatron bridge (30) · triton inference server (2) | — | ||||
| 29 | pmmp | 32 | pocketmine mp (32) | new | ||||
| 30 | netcore | 30 | 5 | 1 | nr255 v (23) · nbr200v2 (5) · nr268 (2) | new | ||
| 31 | jetbrains | 29 | 2 | youtrack (22) · intellij idea (5) · goland (1) | ↑28 | |||
| 32 | samsung mobile | 29 | 3 | samsung mobile devices (20) · bixby touch (1) · collection (1) | ↑5 | |||
| 33 | code projects | 28 | hospital information system (5) · assessment management (3) · doctor appointment system (3) | ↑6 | ||||
| 34 | mervinpraison | 28 | 12 | praisonai (24) · praisonaiagents (7) · praisonai platform (2) | ↑12 | |||
| 35 | n8n io | 28 | n8n (28) | ↓8 | ||||
| 36 | siyuan note | 28 | 1 | siyuan (28) | ↓26 | |||
| 37 | tanium | 28 | comply (16) · threat response (4) · asset (2) | · | ||||
| 38 | drupal | 26 | 1 | gammu sms daemon (3) · screenshot (2) · address suggestion (1) | · | |||
| 39 | craftcms | 25 | 1 | cms (24) · commerce (1) | · | |||
| 40 | d link | 25 | 16 | 2 | dwr m921 (5) · dir 822a (2) · dir 878 (2) | ↑12 | ||
| 41 | geovision | 24 | 2 | gv lpc2011 lpc2211 (18) · gv lpclpc2011 2211 (5) · gv remote e map (1) | · | |||
| 42 | eclipse foundation | 23 | 6 | eclipse aerios (4) · eclipse ankaios (4) · eclipse ditto (3) | ↑16 | |||
| 43 | freerdp | 22 | 1 | freerdp (22) | ↓20 | |||
| 44 | 1panel dev | 20 | 3 | maxkb (13) · cordyscrm (7) | · | |||
| 45 | carlo gavazzi automation | 20 | 2 | ice2 8iol1 g65l v1d (20) · ice2 8iol g65l v1d (20) · ice2 8iol k45p rj45 (20) | · | |||
| 46 | envoyproxy | 20 | 1 | envoy (13) · gateway (7) | · | |||
| 47 | pepperl fuchs | 20 | 2 | ice2 8iol1 g65l v1d (20) · ice2 8iol g65l v1d (20) · ice2 8iol k45p rj45 (20) | · | |||
| 48 | phoenix contact | 20 | 2 | ice2 8iol1 g65l v1d (20) · ice2 8iol g65l v1d (20) · ice2 8iol k45p rj45 (20) | · | |||
| 49 | qualcomm | 20 | 1 | 1 | snapdragon (20) | · | ||
| 50 | samsung | 20 | exynos 1330 firmware (7) · exynos 1280 firmware (5) · exynos 850 firmware (4) | · |
One CVE is counted once per vendor, product or weakness class it lists, so a ranking column sums to more than the month's total. Only the month's top 100 keys per dimension are stored. The KEV column counts CVEs published in 2026-09 that are on the CISA KEV catalog today. The 30 in the headline is what CISA listed during the month, whenever those CVEs were published. All 50 ranked vendors are listed; a zero count renders as a dot.
Weaknesses
CWE classes by distinct CVEs
- 1CWE-7975516 critical↑1
- 2CWE-86256736 critical↑1
- 3CWE-28451965 critical↓2
- 4CWE-12241436 critical↑10
- 5CWE-41635144 critical↑14
- 6CWE-8933136 critical↓2
- 7CWE-1253157 critical↑6
- 8CWE-86330717 critical↑1
- 9CWE-26929729 critical↑12
- 10CWE-2227523 critical↓5
- 1CWE-63926313 critical↓4
- 2CWE-20026012 critical↓2
- 3CWE-306250118 critical↑3
- 4CWE-91823514 critical↓8
- 5CWE-7822850 critical↓7
- 6CWE-28719491 critical↑2
- 7CWE-9419448 critical↓6
- 8CWE-78718920 critical↓6
- 9CWE-4001790 critical↑4
- 10CWE-7417212 critical↓5
One CVE is counted once per vendor, product or weakness class it lists, so a ranking column sums to more than the month's total. Only the month's top 100 keys per dimension are stored.