Search CVEs, research… / diras.sa

ARCHIVE

CVEs published in September 2026

Vulnerabilities added to CVE Radar in September 2026, newest first.

  1. CVE-2026-67378
    Microsoft SQL Server untrusted pointer dereference leads to remote code execution Microsoft Microsoft SQL Server 2019 (CU 32) ·
    • PATCH AVAILABLE
    CRITICAL 9
  2. CVE-2026-67636
    Microsoft SQL Server out-of-bounds read leads to remote code execution Microsoft Microsoft SQL Server 2019 (CU 32) ·
    • PATCH AVAILABLE
    CRITICAL 9
  3. CVE-2026-76420
    Cisco Secure FMC AJP connector pre-auth remote root execution Cisco Cisco Secure Firewall Management Center (FMC) ·
    CRITICAL 9
  4. CVE-2026-67278
    RouterOS RSA signature verification allows TLS/SSH impersonation MikroTik RouterOS ·
    • PATCH AVAILABLE
    CRITICAL 9.1
  5. CVE-2026-86131
    WatchGuard Fireware OS BOVPN Over TLS code injection remote root execution WatchGuard Fireware OS ·
    • PATCH AVAILABLE
    CRITICAL 9.2
  6. CVE-2026-101891
    WatchGuard AP improper access control allows unauthenticated API session WatchGuard WatchGuard AP ·
    • PATCH AVAILABLE
    CRITICAL 9.3
  7. CVE-2026-86102
    WatchGuard AP OS command injection in internal API allows remote code execution WatchGuard WatchGuard AP ·
    • PATCH AVAILABLE
    CRITICAL 9.3
  8. CVE-2026-76969
    SAP Cloud Application Programming Model unauthenticated credential disclosure SAP SAP Cloud Application Programming Model (CAP) ·
    CRITICAL 9.4
  9. CVE-2026-20212
    Cisco NX-OS Silicon One integration unauthenticated remote code execution Cisco Cisco NX-OS Software ·
    • PoC PUBLIC
    CRITICAL 9.8
  10. CVE-2026-62916
    Microsoft Entra authentication bypass lets unauthenticated attacker elevate privileges Microsoft Microsoft Entra ·
    • PATCH AVAILABLE
    CRITICAL 9.8
  11. CVE-2026-77092
    Commvault Cloud deserialization of untrusted data privilege escalation Commvault Commvault Cloud ·
    CRITICAL 9.8
  12. CVE-2026-77098
    Commvault Cloud SQL injection in Private Metrics Server Commvault Commvault Cloud ·
    CRITICAL 9.8
  13. CVE-2026-77089
    Commvault Cloud Command Center pre-auth authentication bypass Commvault Commvault Cloud ·
    CRITICAL 9.8
  14. CVE-2026-12745
    Ivanti Neurons for ITSM pre-auth remote code execution (deserialization) Ivanti Neurons for ITSM ·
    CRITICAL 9.8
  15. CVE-2026-12744
    Neurons for ITSM deserialization remote code execution Ivanti Neurons for ITSM ·
    CRITICAL 9.8
  16. CVE-2026-67631
    Microsoft SQL Server heap-based buffer overflow allows remote code execution Microsoft Microsoft SQL Server 2017 (CU 31) ·
    • PATCH AVAILABLE
    CRITICAL 9.8
  17. CVE-2026-67643
    Microsoft SQL Server 2022/2025 heap buffer overflow pre-auth remote code execution Microsoft Microsoft SQL Server 2022 (CU 26) ·
    • PATCH AVAILABLE
    CRITICAL 9.8
  18. CVE-2026-78509
    Microsoft 365 Apps heap buffer overflow remote code execution Microsoft Microsoft 365 Apps for Enterprise ·
    • PATCH AVAILABLE
    CRITICAL 9.8
  19. CVE-2026-81352
    Web Media Extensions heap buffer overflow allows pre-auth remote code execution Microsoft Web Media Extensions ·
    • PATCH AVAILABLE
    CRITICAL 9.8
  20. CVE-2026-66302
    Skype for Business Server remote code execution via file path control Microsoft Skype for Business Server 2015 CU13 ·
    • PATCH AVAILABLE
    CRITICAL 9.8
20 CVEs · page 1 of 23