CVEs published in September 2026 (page 4)

1. CVE-2026-43790
   MacOS kernel out-of-bounds write lets remote attacker corrupt memory or crash Apple macOS · Sep 30, 2026

   • PATCH AVAILABLE
   CRITICAL 9.1
2. CVE-2026-84625
   IOS and iPadOS permissions issue lets an app fingerprint the user Apple iOS and iPadOS · Sep 30, 2026

   • PATCH AVAILABLE
   CRITICAL 9.1
3. CVE-2026-86881
   IOS and iPadOS certificate validation bypass Apple iOS and iPadOS · Sep 30, 2026

   • PATCH AVAILABLE
   CRITICAL 9.1
4. CVE-2026-92034
   Firefox site isolation flaw allows remote code execution Mozilla Firefox · Sep 30, 2026
   CRITICAL 9.1
5. CVE-2026-92038
   Firefox mitigation bypass in Remote Settings Client Mozilla Firefox · Sep 30, 2026
   CRITICAL 9.1
6. CVE-2026-92041
   Firefox mitigation bypass in DOM networking component Mozilla Firefox · Sep 30, 2026
   CRITICAL 9.1
7. CVE-2026-92051
   Firefox null pointer dereference in Graphics component causes high-impact failures Mozilla Firefox · Sep 30, 2026
   CRITICAL 9.1
8. CVE-2026-92050
   Firefox sandbox escape via XPConnect race condition Mozilla Firefox · Sep 30, 2026
   CRITICAL 9.1
9. CVE-2026-92057
   Firefox Enterprise Policies mitigation bypass Mozilla Firefox · Sep 30, 2026
   CRITICAL 9.1
10. CVE-2026-92075
    Firefox mitigation bypass in Networking component Mozilla Firefox · Sep 30, 2026
    CRITICAL 9.1
11. CVE-2026-92079
    Firefox Widget Win32 mitigation bypass Mozilla Firefox · Sep 30, 2026
    CRITICAL 9.1
12. CVE-2026-83944
    Azure Logic Apps pre-auth privilege escalation via improper access control Microsoft Azure Logic Apps · Sep 30, 2026

    • PATCH AVAILABLE
    CRITICAL 9.1
13. CVE-2026-93765
    Mongoid unsafe reflection allows unauthenticated method invocation MongoDB Mongoid · Sep 30, 2026
    CRITICAL 9.1
14. CVE-2026-89282
    Apache Lounge Windows insecure install directory permissions allow file modification Apache HTTP Server Project Apache Lounge Windows · Sep 30, 2026

    • PATCH AVAILABLE
    CRITICAL 9.1
15. CVE-2026-86350
    Apache Tomcat HTTP/2 request smuggling regression Apache Software Foundation Apache Tomcat · Sep 30, 2026

    • PoC PUBLIC
    CRITICAL 9.1
16. CVE-2026-86246
    Apache Tomcat Native insecure-default TLS options Apache Software Foundation Apache Tomcat Native · Sep 30, 2026
    CRITICAL 9.1
17. CVE-2026-77987
    GitHub Enterprise Server SSRF leads to remote code execution GitHub Enterprise Server · Sep 30, 2026

    • PATCH AVAILABLE
    CRITICAL 9.3
18. CVE-2026-70757
    Oracle WebLogic Server unauthenticated remote code execution via T3/IIOP Oracle Oracle WebLogic Server · Sep 30, 2026
    CRITICAL 9.8
19. CVE-2026-70748
    Oracle WebLogic Server unauthenticated remote takeover via T3/IIOP Oracle Oracle WebLogic Server · Sep 30, 2026
    CRITICAL 9.8
20. CVE-2026-70756
    Oracle WebLogic Server unauthenticated remote takeover via T3/IIOP Oracle Oracle WebLogic Server · Sep 30, 2026
    CRITICAL 9.8