September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,833
Low
527
Severity not reported
2,537
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), linux (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-84331 Incorrect authorization in Actor in Google Chrome prior to 152.0.7977.75 allowed... |
low | 3.1 | — | Google / chrome | 2026-09-02 | 2026-09-03 |
| CVE-2026-84367 joi is a schema description language and data validator for JavaScript. |
low | 3.7 | — | — | 2026-09-01 | 2026-09-09 |
| CVE-2026-84368 joi is a schema description language and data validator for JavaScript. |
low | 3.7 | — | — | 2026-09-01 | 2026-09-09 |
| CVE-2026-84310 pypdf is a free and open-source pure-python PDF library. |
low | 3.3 | — | Pypdf Project / pypdf | 2026-09-01 | 2026-10-05 |
| CVE-2026-84311 pypdf is a free and open-source pure-python PDF library. |
low | 3.3 | — | Pypdf Project / pypdf | 2026-09-01 | 2026-10-05 |
| CVE-2026-84307 Filament is a collection of full-stack components for accelerated Laravel develo... |
low | 3.7 | — | — | 2026-09-01 | 2026-09-09 |
| CVE-2026-73744 A denial-of-service vulnerability exists in the web-based management interface o... |
low | 3.5 | — | Arubanetworks / fabric composer | 2026-09-01 | 2026-09-02 |
| CVE-2026-73745 A vulnerability in the API endpoint of HPE Networking Fabric Composer could allo... |
low | 3.1 | — | Arubanetworks / fabric composer | 2026-09-01 | 2026-09-02 |
| CVE-2026-73746 A denial-of-service vulnerability exists in the API of HPE Networking Fabric Com... |
low | 3.1 | — | Arubanetworks / fabric composer | 2026-09-01 | 2026-09-02 |
| CVE-2026-73747 A local privilege-escalation vulnerability has been discovered in HPE Networking... |
low | 2.5 | — | Arubanetworks / fabric composer | 2026-09-01 | 2026-09-02 |
| CVE-2026-73748 A vulnerability in the affected interface of HPE Networking Fabric Composer allo... |
low | 2.2 | — | Arubanetworks / fabric composer | 2026-09-01 | 2026-09-02 |
| CVE-2026-73743 A vulnerability in the web-based management interface of HPE Networking Fabric C... |
low | 3.7 | — | Arubanetworks / fabric composer | 2026-09-01 | 2026-09-03 |
| CVE-2026-81846 An authorization bypass in the runZero Platform MCP service has been resolved in... |
low | 3.5 | — | — | 2026-09-01 | 2026-09-09 |
| CVE-2026-52295 FFmpeg before 9.0 has an out-of-bounds read because the copied extradata lacked... |
low | 2.9 | — | Ffmpeg / ffmpeg | 2026-09-01 | 2026-10-14 |
| CVE-2023-54356 Kyverno versions 1.9.4 and earlier support insecure 3DES cipher suites (TLS_ECDH... |
low | 3.7 | — | — | 2026-09-01 | 2026-10-08 |
| CVE-2026-48932 A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-... |
low | 3.7 | — | — | 2026-09-01 | 2026-09-03 |
| CVE-2026-18743 A flaw was found in popt. |
low | 2.5 | — | — | 2026-09-01 | 2026-09-08 |
| CVE-2026-103584 Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vu... |
not reported | — | — | — | 2026-09-30 | 2026-10-01 |
| CVE-2026-103585 Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vu... |
not reported | — | — | — | 2026-09-30 | 2026-10-01 |
| CVE-2026-101283 iperf3 3.20–3.21 (esnet/iperf) has a pre-auth heap buffer overflow in decrypt_rs... |
not reported | — | — | — | 2026-09-30 | 2026-10-01 |
| CVE-2026-101276 iperf3 3.21 (esnet/iperf) contains a remote, unauthenticated heap use-after-free... |
not reported | — | — | — | 2026-09-30 | 2026-10-01 |
| CVE-2026-103547 In ldapd in OpenBSD 7.8 before errata 057 and 7.9 before errata 021, delegated B... |
not reported | — | — | — | 2026-09-30 | 2026-10-01 |
| CVE-2026-103548 Improperly stored passwords in the config file in Itron MV-90 xi 3.0 allows atta... |
not reported | — | — | — | 2026-09-30 | 2026-10-01 |
| CVE-2026-102992 piscina is a node.js worker pool implementation. |
not reported | — | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-102990 basic-ftp is an FTP client for Node.js. |
not reported | — | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-55094 Taskcluster is the task execution framework that supports Mozilla's continuous i... |
not reported | — | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-55224 MineAdmin is a ready-to-use backend management system suitable for quickly build... |
not reported | — | — | — | 2026-09-30 | 2026-10-02 |
| CVE-2026-103446 Authorization bypass through User-Controlled key vulnerability in The Wikimedia... |
not reported | — | — | — | 2026-09-30 | 2026-10-06 |
| CVE-2026-103437 Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vu... |
not reported | — | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-103438 Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vu... |
not reported | — | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-103439 Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vu... |
not reported | — | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-103440 Exposure of sensitive information through data queries vulnerability in The Wiki... |
not reported | — | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-103445 Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vu... |
not reported | — | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-75969 Missing authentication for critical function vulnerability for all PTZOptics cam... |
not reported | — | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-55177 CloudTAK is a browser-based Common Operating Picture and situational awareness t... |
not reported | — | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-19445 A remote, unauthenticated TLS client can make a server crash or call
through a f... |
not reported | — | — | — | 2026-09-30 | 2026-10-03 |
| CVE-2026-19553 ssl.SSLContext.wrap_bio() didn't require the server_hostname argument
to not be... |
not reported | — | — | — | 2026-09-30 | 2026-10-16 |
| CVE-2026-103443 Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vu... |
not reported | — | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-103444 Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vu... |
not reported | — | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-80490 Algorithm::AhoCorasick::XS versions through 0.04 for Perl read the haystack stri... |
not reported | — | — | — | 2026-09-30 | 2026-09-30 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.