September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,828
Low
527
Severity not reported
2,542
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), linux (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-93217 In the Linux kernel, the following vulnerability has been resolved:
mm/madvise:... |
not reported | — | — | — | 2026-09-24 | 2026-10-19 |
| CVE-2026-93218 In the Linux kernel, the following vulnerability has been resolved:
mm/huge_mem... |
not reported | — | — | — | 2026-09-24 | 2026-10-19 |
| CVE-2026-93208 In the Linux kernel, the following vulnerability has been resolved:
kasan: fix... |
not reported | — | — | — | 2026-09-24 | 2026-10-30 |
| CVE-2026-93209 In the Linux kernel, the following vulnerability has been resolved:
Bluetooth:... |
not reported | — | — | — | 2026-09-24 | 2026-10-19 |
| CVE-2026-93210 In the Linux kernel, the following vulnerability has been resolved:
smb: client... |
not reported | — | — | — | 2026-09-24 | 2026-10-19 |
| CVE-2026-93205 In the Linux kernel, the following vulnerability has been resolved:
iommu/arm-s... |
not reported | — | — | — | 2026-09-24 | 2026-10-30 |
| CVE-2026-93206 In the Linux kernel, the following vulnerability has been resolved:
PCI/proc: U... |
not reported | — | — | — | 2026-09-24 | 2026-10-19 |
| CVE-2026-56739 Logto is the modern, open-source auth infrastructure for SaaS and AI apps. |
not reported | — | — | — | 2026-09-24 | 2026-09-28 |
| CVE-2026-97404 In OpenStack Zaqar before 22.0.2, WSGI transport mishandles the URL-Signature he... |
not reported | — | — | — | 2026-09-24 | 2026-09-26 |
| CVE-2026-90481 In PortSwigger Burp Suite DAST (formerly Burp Suite Enterprise Edition) before 2... |
not reported | — | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-12559 A Stored Cross-Site Scripting (XSS) vulnerability has been identified in OpenTex... |
not reported | — | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-97058 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-09-24 | 2026-10-16 |
| CVE-2026-91187 Improper Verification of Cryptographic Signature vulnerability in dashbit nimble... |
not reported | — | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-96515 This
vulnerability exists in the Netlink ICT HG323RW router due to insufficient... |
not reported | — | — | — | 2026-09-24 | 2026-10-12 |
| CVE-2026-7169 a vulnerability involving an unchecked search path element in Evope Collector, v... |
not reported | — | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-79680 Authentication bypass vulnerability in the password authentication mechanism of... |
not reported | — | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-4638 PRTG Network Monitor before version 26.2.120.1449 ships a demo EXE/Script sensor... |
not reported | — | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-4637 Paessler PRTG Network Monitor before version 26.2.120.1449 is affected by a refl... |
not reported | — | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-87739 An improper authentication vulnerability in PaperCut MF/NG allows an unauthentic... |
not reported | — | — | — | 2026-09-24 | 2026-10-13 |
| CVE-2026-82077 An improper limitation of a pathname to a restricted directory (path traversal)... |
not reported | — | — | — | 2026-09-24 | 2026-10-13 |
| CVE-2026-11744 An input validation vulnerability exists in the PaperCut Hive embedded applicati... |
not reported | — | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-97168 Rejected reason: it is a suggestion |
not reported | — | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-14780 A vulnerability exists in the PaperCut NG/MF platform's device-scripting functio... |
not reported | — | — | — | 2026-09-24 | 2026-10-13 |
| CVE-2026-97151 mammoth (aka mammoth.js) before 1.12.2 is vulnerable to prototype pollution when... |
not reported | — | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-97152 Nanomsg versions 0.5-beta through 1.x before 1.2.3 has a remotely exploitable bu... |
not reported | — | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-97149 In OpenStack Swift before 2.38.2, the tempurl middleware does not reject the X-C... |
not reported | — | — | — | 2026-09-24 | 2026-10-06 |
| CVE-2026-82370 Unauthenticated remote command injection in the Brocade SANnav orchestrator HTTP... |
not reported | — | — | — | 2026-09-24 | 2026-10-01 |
| CVE-2026-57168 Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. |
not reported | — | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-59980 hpack is an HTTP/2 Header Encoding for Python. |
not reported | — | — | — | 2026-09-23 | 2026-09-30 |
| CVE-2026-57854 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-09-23 | 2026-10-16 |
| CVE-2026-82369 Insufficient input sanitization of shell metacharacters in the Brocade SANnav CL... |
not reported | — | — | — | 2026-09-23 | 2026-10-01 |
| CVE-2026-67240 RabbitMQ is a messaging and streaming broker. |
not reported | — | — | — | 2026-09-23 | 2026-09-24 |
| CVE-2026-67228 RabbitMQ is a messaging and streaming broker. |
not reported | — | — | — | 2026-09-23 | 2026-09-29 |
| CVE-2026-66069 RabbitMQ is a messaging and streaming broker. |
not reported | — | — | — | 2026-09-23 | 2026-09-24 |
| CVE-2026-53968 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-09-23 | 2026-10-16 |
| CVE-2026-53969 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-09-23 | 2026-10-16 |
| CVE-2026-53978 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-09-23 | 2026-10-16 |
| CVE-2026-53979 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-09-23 | 2026-10-16 |
| CVE-2026-66067 RabbitMQ is a messaging and streaming broker. |
not reported | — | — | — | 2026-09-23 | 2026-09-24 |
| CVE-2026-87898 OS command injection in Plesk allows remote authenticated users to execute arbit... |
not reported | — | — | — | 2026-09-23 | 2026-09-24 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.