September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,826
Low
527
Severity not reported
2,544
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), apache (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-83615 xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser... |
not reported | — | — | — | 2026-09-01 | 2026-09-08 |
| CVE-2026-83605 xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser... |
not reported | — | — | — | 2026-09-01 | 2026-09-08 |
| CVE-2026-83606 xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser... |
not reported | — | — | — | 2026-09-01 | 2026-09-08 |
| CVE-2026-83607 xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser... |
not reported | — | — | — | 2026-09-01 | 2026-09-08 |
| CVE-2026-83608 xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser... |
not reported | — | — | — | 2026-09-01 | 2026-09-08 |
| CVE-2026-83609 xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser... |
not reported | — | — | — | 2026-09-01 | 2026-09-08 |
| CVE-2026-75538 An attacker that connects to an open Erlang TCP port that uses the inet driver w... |
not reported | — | — | — | 2026-09-01 | 2026-09-08 |
| CVE-2026-73270 Improper Handling of Case Sensitivity vulnerability in Erlang/OTP inets httpd al... |
not reported | — | — | — | 2026-09-01 | 2026-09-08 |
| CVE-2026-73276 Gracefulness code ignored cases that should be rejected, resulting in possible H... |
not reported | — | — | — | 2026-09-01 | 2026-09-08 |
| CVE-2026-73812 httpd function check_header/3 rejects duplicate Content-Length (per CVE-2026-239... |
not reported | — | — | — | 2026-09-01 | 2026-09-08 |
| CVE-2026-74835 The inets application HTTP server httpd fails to enforce a configured body-size... |
not reported | — | — | — | 2026-09-01 | 2026-09-08 |
| CVE-2026-74994 The mod_auth module in OTP's inets httpd server, when configured with dets or mn... |
not reported | — | — | — | 2026-09-01 | 2026-09-08 |
| CVE-2026-70405 Improper Validation of Specified Quantity in Input vulnerability in Erlang/OTP s... |
not reported | — | — | — | 2026-09-01 | 2026-09-08 |
| CVE-2026-70409 Improper Validation of Specified Quantity in Input vulnerability in Erlang/OTP e... |
not reported | — | — | — | 2026-09-01 | 2026-09-08 |
| CVE-2026-71380 Missing Release of Resource after Effective Lifetime vulnerability in Erlang/OTP... |
not reported | — | — | — | 2026-09-01 | 2026-09-08 |
| CVE-2026-71562 Improper Validation of Specified Quantity in Input vulnerability in Erlang/OTP i... |
not reported | — | — | — | 2026-09-01 | 2026-09-08 |
| CVE-2026-66357 httpd has never implemented obs-fold (RFC 2616 §2.2 / RFC 7230 §3.2.4 header con... |
not reported | — | — | — | 2026-09-01 | 2026-09-08 |
| CVE-2026-66835 Path Equivalence vulnerability in Erlang/OTP inets httpd allows a remote unauthe... |
not reported | — | — | — | 2026-09-01 | 2026-09-08 |
| CVE-2026-69664 Missing Release of Resource after Effective Lifetime vulnerability in Erlang/OTP... |
not reported | — | — | — | 2026-09-01 | 2026-09-22 |
| CVE-2026-70399 Allocation of Resources Without Limits or Throttling vulnerability in Erlang/OTP... |
not reported | — | — | — | 2026-09-01 | 2026-09-08 |
| CVE-2026-59696 Improper Validation of Specified Quantity in Input vulnerability in Erlang/OTP s... |
not reported | — | — | — | 2026-09-01 | 2026-09-08 |
| CVE-2026-5480 Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. |
not reported | — | — | — | 2026-09-01 | 2026-09-01 |
| CVE-2026-55951 The Erlang/OTP httpc HTTP client does not enforce a limit on the total size of r... |
not reported | — | — | — | 2026-09-01 | 2026-09-08 |
| CVE-2026-9634 A security issue exists within the Redundancy Module Configuration Tool. |
not reported | — | — | — | 2026-09-01 | 2026-09-01 |
| CVE-2026-9637 A denial-of-service security issue exists in the affected Logix platforms listed... |
not reported | — | — | — | 2026-09-01 | 2026-09-01 |
| CVE-2026-9621 A denial-of-service security issue exists within RSLinx® Classic. |
not reported | — | — | — | 2026-09-01 | 2026-09-01 |
| CVE-2026-9622 A denial-of-service security issue exists within RSLinx® Classic. |
not reported | — | — | — | 2026-09-01 | 2026-09-01 |
| CVE-2026-9624 A denial-of-service security issue exists within RSLinx® Classic. |
not reported | — | — | — | 2026-09-01 | 2026-09-01 |
| CVE-2026-9625 A denial-of-service security issue exists within RSLinx® Classic. |
not reported | — | — | — | 2026-09-01 | 2026-09-01 |
| CVE-2026-9633 A security issue exists within the Redundancy Module Configuration Tool. |
not reported | — | — | — | 2026-09-01 | 2026-09-01 |
| CVE-2026-16675 A privilege escalation security issue exists within FactoryTalk® Activation Mana... |
not reported | — | — | — | 2026-09-01 | 2026-09-01 |
| CVE-2026-12661 A denial-of-service security issue exists within FactoryTalk® Historian Machine... |
not reported | — | — | — | 2026-09-01 | 2026-09-01 |
| CVE-2026-12663 A security issue exists within ControlFLASH™, where the installer grants write p... |
not reported | — | — | — | 2026-09-01 | 2026-09-01 |
| CVE-2026-13336 CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS C... |
not reported | — | — | — | 2026-09-01 | 2026-09-01 |
| CVE-2026-13337 CWE-564: SQL Injection: Hibernate vulnerability exists that could allow the inje... |
not reported | — | — | — | 2026-09-01 | 2026-09-01 |
| CVE-2026-13348 CWE-307: Improper Restriction of Excessive Authentication Attempts vulnerability... |
not reported | — | — | — | 2026-09-01 | 2026-09-01 |
| CVE-2025-12768 A security issue exists within FactoryTalk® Historian Machine Edition. |
not reported | — | — | — | 2026-09-01 | 2026-10-19 |
| CVE-2024-10085 CWE-770: Allocation of Resources Without Limits or Throttling vulnerability exis... |
not reported | — | — | — | 2026-09-01 | 2026-10-27 |
| CVE-2026-84149 This vulnerability exists in the ERP system due to exposure of repository inform... |
not reported | — | — | — | 2026-09-01 | 2026-09-01 |
| CVE-2026-84235 A denial-of-service security issue exists in the affected product. |
not reported | — | — | — | 2026-09-01 | 2026-09-01 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.