September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,833
Low
527
Severity not reported
2,537
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), linux (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-102761 NetX Duo's WebSocket client resets the unmasking cursor to the first `NX_PACKET`... |
not reported | — | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-102762 The NetX Duo MQTT client leaks the packet carrying a malformed PUBLISH message. |
not reported | — | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-102725 Out-of-bounds Read from Unvalidated MSRP Attribute List Length |
not reported | — | — | — | 2026-09-29 | 2026-09-29 |
| CVE-2026-102726 Unbounded PPP IPCP Option Parsing Causes a Worker Stall and Out-of-bounds Read |
not reported | — | — | — | 2026-09-29 | 2026-09-29 |
| CVE-2026-102727 FTP Passive Data Connection Not Bound to the Authenticated Control Peer |
not reported | — | — | — | 2026-09-29 | 2026-09-29 |
| CVE-2026-102729 `gx_binres_theme_load()` sizes its theme buffer for the theme it was asked for,... |
not reported | — | — | — | 2026-09-29 | 2026-09-29 |
| CVE-2026-102730 Mounting an attacker-controlled NAND flash image (`lx_nand_flash_open()`) trigge... |
not reported | — | — | — | 2026-09-29 | 2026-09-29 |
| CVE-2026-102757 An unprivileged, memory-protected ThreadX module can have the kernel read and wr... |
not reported | — | — | — | 2026-09-29 | 2026-10-02 |
| CVE-2026-102718 hey,
`_nx_snmp_utility_object_id_get` in the NetX Duo SNMP addon does not valid... |
not reported | — | — | — | 2026-09-29 | 2026-09-29 |
| CVE-2026-102719 Predictable DTLS HelloVerifyRequest Cookie in NetX Secure |
not reported | — | — | — | 2026-09-29 | 2026-09-29 |
| CVE-2026-102720 A DHCP server, or anyone on the LAN who answers a DISCOVER first, can make the c... |
not reported | — | — | — | 2026-09-29 | 2026-09-29 |
| CVE-2026-102721 A TFTP server that answers with a short ERROR packet makes the client read up to... |
not reported | — | — | — | 2026-09-29 | 2026-09-29 |
| CVE-2026-102722 In the IPv4 PASV path, the FTP Client accepts whatever address was sent in the s... |
not reported | — | — | — | 2026-09-29 | 2026-09-29 |
| CVE-2026-102723 NULL Pointer Dereference on MSRP Attribute Table Exhaustion |
not reported | — | — | — | 2026-09-29 | 2026-09-29 |
| CVE-2026-102724 NULL Pointer Dereference When Evicting the Sole MSRP Attribute |
not reported | — | — | — | 2026-09-29 | 2026-09-29 |
| CVE-2026-102710 Attacker model / Preconditions: a loaded `TXM_MODULE_USER_MODE | TXM_MODULE_MEMO... |
not reported | — | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-102711 Two issues in the ThreadX loadable-module loader, reached when a device loads an... |
not reported | — | — | — | 2026-09-29 | 2026-09-29 |
| CVE-2026-102712 On the first DTLS ClientHello, the parser copies a device-claimed session_id len... |
not reported | — | — | — | 2026-09-29 | 2026-09-29 |
| CVE-2026-102713 The TFTP server accepts a DATA datagram of any size. |
not reported | — | — | — | 2026-09-29 | 2026-09-29 |
| CVE-2026-102714 `_nx_icmpv6_validate_options()` scans the option area with `while (length > 2)`... |
not reported | — | — | — | 2026-09-29 | 2026-09-29 |
| CVE-2026-102715 Any host on the LAN can send two mDNS records and make the responder write past... |
not reported | — | — | — | 2026-09-29 | 2026-09-29 |
| CVE-2026-102716 An unauthenticated client can drain the RTSP server's packet pool with a couple... |
not reported | — | — | — | 2026-09-29 | 2026-09-29 |
| CVE-2026-102709 Improper validation of non-secure (NS) pointers in multiple TrustZone-M non-secu... |
not reported | — | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-102242 Improper link resolution (CWE-59 / CWE-22) in the allowedLocalRoots path validat... |
not reported | — | — | — | 2026-09-29 | 2026-09-29 |
| CVE-2026-97711 Serialize JavaScript serializes JavaScript values to a superset of JSON that inc... |
not reported | — | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-102598 Werkzeug is a comprehensive WSGI web application library. |
not reported | — | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-68911 Nicotine+ is a graphical client for the Soulseek peer-to-peer network. |
not reported | — | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-22101 The access to the service menu is obfuscated, but possible with only physical ac... |
not reported | — | — | — | 2026-09-29 | 2026-10-19 |
| CVE-2026-22094 The firmware for the EVbee DC-80 has a weak hardcoded root password, which allow... |
not reported | — | — | — | 2026-09-29 | 2026-10-19 |
| CVE-2026-102371 In wsl-pro-service before 0.1.19ubuntu3, the service component which runs as roo... |
not reported | — | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-4034 Injection Vulnerability in Tibco Administrator version 5.13.0 & prior allows an... |
not reported | — | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-7192 A stack-based buffer overflow vulnerability in the Dbit T-CPE301K 4G WiFi miniro... |
not reported | — | — | — | 2026-09-29 | 2026-09-29 |
| CVE-2026-7193 A vulnerability relating to the use of predefined credentials in the Dbit T-CPE3... |
not reported | — | — | — | 2026-09-29 | 2026-09-29 |
| CVE-2026-101267 A missing permission check allowed low-privileged users with access to an event... |
not reported | — | — | — | 2026-09-29 | 2026-09-29 |
| CVE-2026-101268 If an attacker is able to convince a victim on a specially crafted link, the vic... |
not reported | — | — | — | 2026-09-29 | 2026-09-29 |
| CVE-2026-101269 The mechanism binding API-uploaded files to the uploader's authentication method... |
not reported | — | — | — | 2026-09-29 | 2026-09-29 |
| CVE-2026-101270 Malicious HTML content could be injected into the help texts of various fields w... |
not reported | — | — | — | 2026-09-29 | 2026-09-29 |
| CVE-2026-101271 OAuth credentials (access tokens) are valid for the entirety of their lifetime,... |
not reported | — | — | — | 2026-09-29 | 2026-09-29 |
| CVE-2026-85520 Google Merchant Center Feed (gmfeed) module for PrestaShop is vulnerable to unau... |
not reported | — | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-41875 Quick.Cart is vulnerable to Cross-Site Request Forgery in admin config panel. |
not reported | — | — | — | 2026-09-29 | 2026-09-30 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.