September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,833
Low
527
Severity not reported
2,537
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), linux (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-55217 GLPI is a free asset and IT management software package. |
not reported | — | — | — | 2026-09-25 | 2026-09-25 |
| CVE-2026-53628 GLPI is a free asset and IT management software package. |
not reported | — | — | — | 2026-09-25 | 2026-09-30 |
| CVE-2026-53629 GLPI is a free asset and IT management software package. |
not reported | — | — | — | 2026-09-25 | 2026-09-25 |
| CVE-2026-53610 GLPI is a free asset and IT management software package. |
not reported | — | — | — | 2026-09-25 | 2026-09-29 |
| CVE-2026-53625 GLPI is a free asset and IT management software package. |
not reported | — | — | — | 2026-09-25 | 2026-09-25 |
| CVE-2026-53626 GLPI is a free asset and IT management software package. |
not reported | — | — | — | 2026-09-25 | 2026-09-30 |
| CVE-2026-53627 GLPI is a free asset and IT management software package. |
not reported | — | — | — | 2026-09-25 | 2026-09-25 |
| CVE-2026-49469 GLPI is a free asset and IT management software package. |
not reported | — | — | — | 2026-09-25 | 2026-09-29 |
| CVE-2026-49470 GLPI is a free asset and IT management software package. |
not reported | — | — | — | 2026-09-25 | 2026-09-28 |
| CVE-2026-48482 GLPI is a free asset and IT management software package. |
not reported | — | — | — | 2026-09-25 | 2026-09-30 |
| CVE-2026-47679 GLPI is a free asset and IT management software package. |
not reported | — | — | — | 2026-09-25 | 2026-09-25 |
| CVE-2026-45801 GLPI is a free asset and IT management software package. |
not reported | — | — | — | 2026-09-25 | 2026-09-25 |
| CVE-2026-84462 Zammad is a web based open source helpdesk/customer support system. |
not reported | — | — | — | 2026-09-25 | 2026-09-28 |
| CVE-2026-61525 Zammad is a web based open source helpdesk/customer support system. |
not reported | — | — | — | 2026-09-25 | 2026-09-28 |
| CVE-2026-65828 Zammad is a web based open source helpdesk/customer support system. |
not reported | — | — | — | 2026-09-25 | 2026-09-28 |
| CVE-2026-56735 Zammad is a web based open source helpdesk/customer support system. |
not reported | — | — | — | 2026-09-25 | 2026-09-28 |
| CVE-2026-56730 Zammad is a web based open source helpdesk/customer support system. |
not reported | — | — | — | 2026-09-25 | 2026-09-29 |
| CVE-2026-56731 Zammad is a web based open source helpdesk/customer support system. |
not reported | — | — | — | 2026-09-25 | 2026-09-28 |
| CVE-2026-56732 Zammad is a web based open source helpdesk/customer support system. |
not reported | — | — | — | 2026-09-25 | 2026-09-28 |
| CVE-2026-56733 Zammad is a web based open source helpdesk/customer support system. |
not reported | — | — | — | 2026-09-25 | 2026-09-28 |
| CVE-2026-56734 Zammad is a web based open source helpdesk/customer support system. |
not reported | — | — | — | 2026-09-25 | 2026-09-29 |
| CVE-2026-56725 Zammad is a web based open source helpdesk/customer support system. |
not reported | — | — | — | 2026-09-25 | 2026-09-29 |
| CVE-2026-56726 Zammad is a web based open source helpdesk/customer support system. |
not reported | — | — | — | 2026-09-25 | 2026-09-28 |
| CVE-2026-56727 Zammad is a web based open source helpdesk/customer support system. |
not reported | — | — | — | 2026-09-25 | 2026-09-28 |
| CVE-2026-56728 Zammad is a web based open source helpdesk/customer support system. |
not reported | — | — | — | 2026-09-25 | 2026-09-28 |
| CVE-2026-95834 Use After Free in the drag source path of the drag and drop protocol in kitty fr... |
not reported | — | — | — | 2026-09-25 | 2026-09-29 |
| CVE-2026-95835 Missing Authorization in the askpass escape code handler in kitty from 0.25.0 be... |
not reported | — | — | — | 2026-09-25 | 2026-09-29 |
| CVE-2026-80432 Missing Authorization in the drop handling path of the drag and drop protocol in... |
not reported | — | — | — | 2026-09-25 | 2026-09-29 |
| CVE-2026-56723 Zammad is a web based open source helpdesk/customer support system. |
not reported | — | — | — | 2026-09-25 | 2026-09-28 |
| CVE-2026-56724 Zammad is a web based open source helpdesk/customer support system. |
not reported | — | — | — | 2026-09-25 | 2026-09-28 |
| CVE-2026-56729 Zammad is a web based open source helpdesk/customer support system. |
not reported | — | — | — | 2026-09-25 | 2026-09-28 |
| CVE-2026-100248 The Rattadan Cosmowarp smart contract before 56c6147 can have a comparison to an... |
not reported | — | — | — | 2026-09-25 | 2026-09-30 |
| CVE-2026-96874 Improper neutralization of input during web page generation ('cross-site scripti... |
not reported | — | — | — | 2026-09-25 | 2026-09-29 |
| CVE-2026-96812 Improper Exposure of Resource to Wrong Sphere in the host file helper (gofer) in... |
not reported | — | — | — | 2026-09-25 | 2026-09-25 |
| CVE-2026-60096 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-09-25 | 2026-10-16 |
| CVE-2026-60097 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-09-25 | 2026-10-16 |
| CVE-2026-60098 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-09-25 | 2026-10-16 |
| CVE-2026-60099 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-09-25 | 2026-10-16 |
| CVE-2026-60100 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-09-25 | 2026-10-16 |
| CVE-2026-60101 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-09-25 | 2026-10-16 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.