September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,833
Low
527
Severity not reported
2,537
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), linux (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-73640 Dayforce ESS Excelity is vulnerable to Time Based-Blind SQL Injection in passwor... |
not reported | — | — | — | 2026-09-28 | 2026-10-13 |
| CVE-2026-82936 mH-DEVELOPER smart home module is vulnerable to Denial of Service due to uncontr... |
not reported | — | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-82928 mH-DEVELOPER smart home module contains a hardcoded SSH public key in /root/.ssh... |
not reported | — | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-82929 mH-DEVELOPER smart home module uses the same hard-coded SSH host keys on every d... |
not reported | — | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-82930 mH-DEVELOPER smart home module does not verify tokens in its authorization middl... |
not reported | — | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-82932 mH-DEVELOPER smart home module does not load any firewall rules at startup. |
not reported | — | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-82933 mH-DEVELOPER smart home module sends its web interface and API traffic over unen... |
not reported | — | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-82935 mH-DEVELOPER smart home module ships with an end-of-life, unsupported Debian 8 a... |
not reported | — | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-52749 The Kaon AR2140X router improperly issues session cookies in responses to unauth... |
not reported | — | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-18825 An Origin Validation Error in the middleware of the connect-xcors npm package al... |
not reported | — | — | — | 2026-09-28 | 2026-09-30 |
| CVE-2026-52748 The Kaon AR2140X router contains a vulnerability where the backup functionality... |
not reported | — | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-94194 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')... |
not reported | — | — | — | 2026-09-28 | 2026-09-30 |
| CVE-2026-91043 Allocation of Resources Without Limits or Throttling vulnerability in elixir-min... |
not reported | — | — | — | 2026-09-28 | 2026-09-29 |
| CVE-2026-92103 Allocation of Resources Without Limits or Throttling vulnerability in elixir-min... |
not reported | — | — | — | 2026-09-28 | 2026-09-30 |
| CVE-2026-81867 A Deserialization of Untrusted Data vulnerability in the JavaScript Task in Goog... |
not reported | — | — | — | 2026-09-28 | 2026-09-30 |
| CVE-2026-81375 A Confused Deputy vulnerability in the EmailTask component in Google Cloud Appli... |
not reported | — | — | — | 2026-09-28 | 2026-09-29 |
| CVE-2026-19759 An Incorrect Authorization vulnerability in the task configuration in Google Clo... |
not reported | — | — | — | 2026-09-28 | 2026-09-29 |
| CVE-2026-7170 Stored Cross-Site Scripting (XSS) in TPVEnlanube affecting the following endpoin... |
not reported | — | — | — | 2026-09-28 | 2026-09-30 |
| CVE-2026-7171 Stored Cross-Site Scripting (XSS) in TPVEnlanube affecting the following endpoin... |
not reported | — | — | — | 2026-09-28 | 2026-09-30 |
| CVE-2026-7172 Stored Cross-Site Scripting (XSS) in TPVEnlanube affecting the following endpoin... |
not reported | — | — | — | 2026-09-28 | 2026-09-30 |
| CVE-2026-87723 In Google fuse-archive versions prior to 1.24, an attacker who can prepend a dir... |
not reported | — | — | — | 2026-09-28 | 2026-09-29 |
| CVE-2026-101041 The account recovery (password reset) functionality in the vulnerability-lookup... |
not reported | — | — | — | 2026-09-27 | 2026-09-29 |
| CVE-2026-89136 When using RPK (Raw Public Key), the client side of a TLS 1.2, 1.3 and DTLS 1.2... |
not reported | — | — | — | 2026-09-27 | 2026-09-29 |
| CVE-2026-100655 Rejected reason: This CVE ID has been rejected as a duplicate. |
not reported | — | — | — | 2026-09-26 | 2026-09-28 |
| CVE-2026-100656 Rejected reason: This CVE ID has been rejected as a duplicate. |
not reported | — | — | — | 2026-09-26 | 2026-09-28 |
| CVE-2026-100657 Rejected reason: This CVE ID has been rejected as a duplicate. |
not reported | — | — | — | 2026-09-26 | 2026-09-28 |
| CVE-2026-100658 Rejected reason: This CVE ID has been rejected as a duplicate. |
not reported | — | — | — | 2026-09-26 | 2026-09-28 |
| CVE-2026-86066 Horilla is an HR and CRM software. |
not reported | — | — | — | 2026-09-25 | 2026-09-30 |
| CVE-2026-57449 Actual is a local-first personal finance tool. |
not reported | — | — | — | 2026-09-25 | 2026-09-28 |
| CVE-2026-9652 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-09-25 | 2026-10-16 |
| CVE-2026-9655 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-09-25 | 2026-10-16 |
| CVE-2026-88003 InvoicePlane is a self-hosted open source application for managing invoices, cli... |
not reported | — | — | — | 2026-09-25 | 2026-09-28 |
| CVE-2026-7799 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-09-25 | 2026-10-16 |
| CVE-2026-7800 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-09-25 | 2026-10-16 |
| CVE-2026-71483 Horilla is an HR and CRM software. |
not reported | — | — | — | 2026-09-25 | 2026-09-29 |
| CVE-2026-53973 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-09-25 | 2026-10-16 |
| CVE-2026-45234 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-09-25 | 2026-10-16 |
| CVE-2026-45235 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-09-25 | 2026-10-16 |
| CVE-2026-45236 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-09-25 | 2026-10-16 |
| CVE-2026-45237 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-09-25 | 2026-10-16 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.