Week 37, 2026

7 September to 13 September 2026. The CVEs published in the week, the most severe of them, and what CISA added to its catalog of known exploited vulnerabilities.

CVEs published: 3,778
Critical: 365
High: 1,723
Added to KEV: 14

Critical 365High 1,723Medium 1,409Low 120Not scored 161All 3,778 in the list

Added to KEVAttackers use these now; patch them first

CVE-2026-85706
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab
GitLab · GitLab
ExploitedCritical10.0
CVE-2026-84869
ScreenConnect Client: Guest-to-Host File Execution via File-Transfer Actions
ConnectWise · ScreenConnect
ExploitedCritical9.9
CVE-2026-42016
Incorrect authorization validation of user token in JFrog Artifactory allows Privilege Escalation
jfrog · artifactory
ExploitedHigh8.1
CVE-2026-42018
Anonymous user token generation exposure in JFrog Artifactory
jfrog · artifactory
ExploitedHigh7.5
CVE-2026-86060
SSH session privilege manipulation via a crafted username in Mikrotik RouterOS
Mikrotik · RouterOS
ExploitedCritical9.2
CVE-2026-67277
Kernel memory disclosure and denial of service in MikroTik RouterOS btest service
Mikrotik · RouterOS
ExploitedHigh8.8
CVE-2026-20079
Cisco Secure Firewall Management Center Authentication Bypass Remote Code Execution Vulnerability
Cisco · Cisco Secure Firewall Management Center (FMC)
ExploitedCritical10.0
CVE-2026-19490
NetScaler ADC and NetScaler Gateway Security Bulletin for CVE-2026-19490
NetScaler · ADC
ExploitedCritical9.3
CVE-2026-87491
Out of bounds write in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML…
Google · Chrome
ExploitedHigh8.8
CVE-2025-25249
A heap-based buffer overflow vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2.0 through 7.2.11, FortiOS 7.0.0…
Fortinet · FortiSwitchManager
ExploitedHigh7.4
CVE-2026-75650
Adobe Commerce | Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336)
Adobe · Adobe Commerce
ExploitedCritical10.0
CVE-2026-86218
pre-authentication remote code execution
N-able · N-central
ExploitedCritical10.0
CVE-2026-81963
Windows Update Stack Elevation of Privilege Vulnerability
Microsoft · Windows 11 version 23H2
ExploitedHigh7.8
CVE-2026-85880
Windows Advanced Local Procedure Call (ALPC) Elevation of Privilege Vulnerability
Microsoft · Windows 10 Version 1607
ExploitedHigh7.8

Most severe new CVEsBy CVSS score

CVE-2026-85706
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab
GitLab · GitLab
ExploitedCritical10.0
CVE-2026-75650
Adobe Commerce | Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336)
Adobe · Adobe Commerce
ExploitedCritical10.0
CVE-2026-82004
Adobe Campaign Classic (ACC) | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)
Adobe · Adobe Campaign Classic
Critical10.0
CVE-2026-86296
D-Link DIR-822A udhcpcd serverpacket.c strcpy stack-based overflow
D-Link · DIR-822A
Critical10.0
CVE-2026-80462
Privilege Escalation in Progress Chef Automate
Progress Software · Chef Automate
Critical10.0
CVE-2026-85978
Unauthenticated Remote Code Execution in Akana API Platform
Perforce · Akana
Critical10.0
CVE-2026-44756
Memory Corruption vulnerability in SAP Extended Passport (EPP) Processing
SAP_SE · SAP Extended Passport (EPP) Processing
Critical10.0
CVE-2026-87827
KGUARD DVR unauthenticated remote command execution vulnerability
KGUARD · KGUARD_firmware
Critical10.0
CVE-2026-14560
Teddy Bear Customize Addon <= 1.0.5 - Unauthenticated Arbitrary File Upload
Unknown · teddy-bear-customize-addon
Critical10.0
CVE-2026-82617
Apache OpenNLP, Apache OpenNLP: ReDoS / stack exhaustion in RegexNameFinderFactory built-in EMAIL and URL patterns
Apache Software Foundation · Apache OpenNLP
Critical10.0

Week 37, 2026

Added to KEVAttackers use these now; patch them first

Most severe new CVEsBy CVSS score

Vendors with the most CVEs

Most common weaknesses