Week 38, 2026

14 September to 20 September 2026. The CVEs published in the week, the most severe of them, and what CISA added to its catalog of known exploited vulnerabilities.

CVEs published: 4,826
Critical: 523
High: 2,072
Added to KEV: 7

Critical 523High 2,072Medium 1,469Low 204Not scored 558All 4,826 in the list

Added to KEVAttackers use these now; patch them first

CVE-2025-39682
tls: fix handling of zero-length records on the rx_list
Linux · Linux
ExploitedCritical9.8
CVE-2026-53266
netfilter: bridge: make ebt_snat ARP rewrite writable
Linux · Linux
ExploitedHigh8.8
CVE-2025-39964
crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg
Linux · Linux
ExploitedHigh7.8
CVE-2026-76460
Cisco Identity Services Engine Authentication Bypass Vulnerability
Cisco · Cisco Identity Services Engine Software
ExploitedCritical10.0
CVE-2026-58704
In Cellular Modem, there is a possible permission bypass due to a logic error in the code. This could lead to remote (proximal/adjacent) escalation of…
Google · Android
ExploitedHigh8.8
CVE-2026-87886
Local privilege escalation due to insecure file permissions. The following products are affected: Acronis Backup plugin for cPanel & WHM (Linux) before build…
Acronis · Acronis Backup plugin for cPanel & WHM
ExploitedHigh7.8
CVE-2026-76461
Cisco Secure Email Gateway SQL Injection Vulnerability
Cisco · Cisco Secure Email
ExploitedCritical9.8

Most severe new CVEsBy CVSS score

CVE-2026-76460
Cisco Identity Services Engine Authentication Bypass Vulnerability
Cisco · Cisco Identity Services Engine Software
ExploitedCritical10.0
CVE-2026-94097
Netcore NBR200V2 CGI Diagnostic Endpoint network_tools command injection
Netcore · NBR200V2
Critical10.0
CVE-2026-53710
MCP Context Forge: RestrictedPython sandbox bypass via getattr builtin in python_sandbox_server
IBM · mcp-context-forge
Critical10.0
CVE-2026-92937
vm2 3.11.6 Remote Code Execution via Promise call/apply
patriksimek · vm2
Critical10.0
CVE-2026-94089
D-Link DIR-868L Authentication webfa_authentication.cgi strcpy stack-based overflow
D-Link · DIR-868L
Critical10.0
CVE-2026-10747
IBM MQ Appliance is affected by a heap buffer overflow vulnerability in protocol message processing
IBM · MQ Appliance
Critical10.0
CVE-2026-69843
Microsoft Fabric Elevation of Privilege Vulnerability
Microsoft · Microsoft Fabric
Critical10.0
CVE-2026-93740
Totolink A3002MU formWlEncrypt buffer overflow
Totolink · A3002MU
Critical10.0
CVE-2026-62104
WordPress Migratico Lite plugin <= 2.6.8 - Remote Code Execution (RCE) vulnerability
superweby · Migratico Lite
Critical10.0
CVE-2026-70416
Dell ObjectScale, versions prior to 4.4.0.0, contains a Deserialization of Untrusted Data vulnerability. An unauthenticated attacker with remote access could…
Dell · ObjectScale
Critical10.0

Week 38, 2026

Added to KEVAttackers use these now; patch them first

Most severe new CVEsBy CVSS score

Vendors with the most CVEs

Most common weaknesses