September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,833
Low
527
Severity not reported
2,537
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), linux (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-45238 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-09-25 | 2026-10-16 |
| CVE-2026-45239 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-09-25 | 2026-10-16 |
| CVE-2026-45240 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-09-25 | 2026-10-16 |
| CVE-2026-45241 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-09-25 | 2026-10-16 |
| CVE-2026-49117 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-09-25 | 2026-10-16 |
| CVE-2026-49118 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-09-25 | 2026-10-16 |
| CVE-2026-53971 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-09-25 | 2026-10-16 |
| CVE-2026-53972 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-09-25 | 2026-10-16 |
| CVE-2026-100382 Improper Neutralization of Special Elements used in an OS Command ('OS Command I... |
not reported | — | — | — | 2026-09-25 | 2026-09-28 |
| CVE-2026-100383 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site... |
not reported | — | — | — | 2026-09-25 | 2026-09-28 |
| CVE-2026-100381 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site... |
not reported | — | — | — | 2026-09-25 | 2026-09-28 |
| CVE-2026-96879 Improper removal of sensitive information before storage or transfer vulnerabili... |
not reported | — | — | — | 2026-09-25 | 2026-09-29 |
| CVE-2026-9313 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-09-25 | 2026-10-16 |
| CVE-2026-57864 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-09-25 | 2026-10-16 |
| CVE-2026-100380 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site... |
not reported | — | — | — | 2026-09-25 | 2026-09-28 |
| CVE-2026-100376 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site... |
not reported | — | — | — | 2026-09-25 | 2026-09-28 |
| CVE-2026-100377 Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wiki... |
not reported | — | — | — | 2026-09-25 | 2026-09-28 |
| CVE-2026-100378 Missing Authorization vulnerability in Wikimedia Foundation Mediawiki - Translat... |
not reported | — | — | — | 2026-09-25 | 2026-09-28 |
| CVE-2026-100379 Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wiki... |
not reported | — | — | — | 2026-09-25 | 2026-09-28 |
| CVE-2026-96877 Improper neutralization of input during web page generation ('cross-site scripti... |
not reported | — | — | — | 2026-09-25 | 2026-09-29 |
| CVE-2026-96878 Improper neutralization of input during web page generation ('cross-site scripti... |
not reported | — | — | — | 2026-09-25 | 2026-09-29 |
| CVE-2026-96875 Improper neutralization of input during web page generation ('cross-site scripti... |
not reported | — | — | — | 2026-09-25 | 2026-09-29 |
| CVE-2026-96876 Improper neutralization of input during web page generation ('cross-site scripti... |
not reported | — | — | — | 2026-09-25 | 2026-09-29 |
| CVE-2026-57861 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-09-25 | 2026-10-16 |
| CVE-2026-53990 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-09-25 | 2026-10-16 |
| CVE-2026-84465 Zammad is a web based open source helpdesk/customer support system. |
not reported | — | — | — | 2026-09-25 | 2026-09-29 |
| CVE-2026-84458 Zammad is a web based open source helpdesk/customer support system. |
not reported | — | — | — | 2026-09-25 | 2026-09-28 |
| CVE-2026-84460 Zammad is a web based open source helpdesk/customer support system. |
not reported | — | — | — | 2026-09-25 | 2026-09-29 |
| CVE-2026-84461 Zammad is a web based open source helpdesk/customer support system. |
not reported | — | — | — | 2026-09-25 | 2026-09-28 |
| CVE-2026-84463 Zammad is a web based open source helpdesk/customer support system. |
not reported | — | — | — | 2026-09-25 | 2026-09-29 |
| CVE-2026-84464 Zammad is a web based open source helpdesk/customer support system. |
not reported | — | — | — | 2026-09-25 | 2026-09-28 |
| CVE-2026-63207 Zammad is a web based open source helpdesk/customer support system. |
not reported | — | — | — | 2026-09-25 | 2026-09-29 |
| CVE-2026-63208 Zammad is a web based open source helpdesk/customer support system. |
not reported | — | — | — | 2026-09-25 | 2026-09-28 |
| CVE-2026-63216 Zammad is a web based open source helpdesk/customer support system. |
not reported | — | — | — | 2026-09-25 | 2026-09-29 |
| CVE-2026-63006 Zammad is a web based open source helpdesk/customer support system. |
not reported | — | — | — | 2026-09-25 | 2026-09-29 |
| CVE-2026-63204 Zammad is a web based open source helpdesk/customer support system. |
not reported | — | — | — | 2026-09-25 | 2026-09-28 |
| CVE-2026-63205 Zammad is a web based open source helpdesk/customer support system. |
not reported | — | — | — | 2026-09-25 | 2026-09-29 |
| CVE-2026-63206 Zammad is a web based open source helpdesk/customer support system. |
not reported | — | — | — | 2026-09-25 | 2026-09-28 |
| CVE-2026-61855 Zammad is a web based open source helpdesk/customer support system. |
not reported | — | — | — | 2026-09-25 | 2026-09-28 |
| CVE-2026-55214 GLPI is a free asset and IT management software package. |
not reported | — | — | — | 2026-09-25 | 2026-09-29 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.