September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,364
Critical
1,230
High
4,374
Medium
4,126
Low
462
Severity not reported
1,172
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (964), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-6928 IBM Concert 1.0.0 through 3.0.0 references or accesses memory after it has been... |
critical | 9.8 | — | Ibm / concert | 2026-09-23 | 2026-09-29 |
| CVE-2026-6721 IBM Concert 1.0.0 through 3.0.0 allows an unauthenticated remote attacker can su... |
critical | 9.8 | — | Ibm / concert | 2026-09-23 | 2026-09-28 |
| CVE-2026-10027 IBM MQ could allow a remote attacker to cause a denial of service or execute arb... |
critical | 9.8 | — | Ibm / mq | 2026-09-18 | 2026-09-23 |
| CVE-2026-78573 IBM ContextForge MCP Gateway 1.0.0 through 1.0.7 could allow a remote attacker t... |
critical | 9.8 | — | Ibm / contextforge | 2026-09-10 | 2026-09-16 |
| CVE-2026-80424 IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated a... |
critical | 9.1 | — | Ibm / datastage on cloud pak for data | 2026-09-10 | 2026-09-16 |
| CVE-2026-82107 IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated a... |
critical | 9.6 | — | Ibm / datastage on cloud pak for data | 2026-09-10 | 2026-09-16 |
| CVE-2026-77822 IBM ContextForge MCP Gateway could allow a remote authenticated attacker to obta... |
critical | 9.6 | — | Ibm / contextforge | 2026-09-04 | 2026-09-15 |
| CVE-2026-18221 IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to gain unauthorized... |
critical | 9.8 | — | Ibm / i | 2026-09-04 | 2026-09-08 |
| CVE-2026-17057 IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of... |
critical | 9.1 | — | Ibm / i | 2026-09-04 | 2026-09-08 |
| CVE-2026-17207 IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of... |
critical | 9.1 | — | Ibm / i | 2026-09-04 | 2026-09-08 |
| CVE-2026-93306 IBM Server Firmware FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, FW... |
high | 7.1 | — | Ibm / power system e1080 \(9080-hex\) firmware | 2026-09-25 | 2026-09-30 |
| CVE-2026-6935 IBM Concert 1.0.0 through 3.0.0 invokes operating system commands without fully... |
high | 7.8 | — | Ibm / concert | 2026-09-23 | 2026-09-29 |
| CVE-2026-6794 IBM Concert 1.0.0 through 3.0.0 has a double free vulnerability that exists due... |
high | 7.8 | — | Ibm / concert | 2026-09-23 | 2026-09-28 |
| CVE-2026-6730 IBM Concert 1.0.0 through 3.0.0 is vulnerable to a buffer overflow, caused by im... |
high | 7.8 | — | Ibm / concert | 2026-09-23 | 2026-09-28 |
| CVE-2026-16468 IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated a... |
high | 8.8 | — | Ibm / datastage on cloud pak for data | 2026-09-22 | 2026-09-25 |
| CVE-2026-16469 IBM DataStage on Cloud Pak for Data 5.4.0.0 px-runtime could allow a remote auth... |
high | 8.8 | — | Ibm / datastage on cloud pak for data | 2026-09-22 | 2026-09-25 |
| CVE-2026-16672 IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated a... |
high | 8.8 | — | Ibm / datastage on cloud pak for data | 2026-09-22 | 2026-09-25 |
| CVE-2026-17102 IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated a... |
high | 8.8 | — | Ibm / datastage on cloud pak for data | 2026-09-22 | 2026-09-25 |
| CVE-2026-10575 IBM MQ could allow an authenticated attacker to cause a denial of service or pot... |
high | 8.8 | — | Ibm / mq | 2026-09-18 | 2026-09-23 |
| CVE-2026-10853 IBM MQ could allow an authenticated attacker with cluster access to cause a deni... |
high | 8.8 | — | Ibm / mq | 2026-09-18 | 2026-09-23 |
| CVE-2026-11375 IBM MQ could allow an authenticated attacker to cause a denial of service or pot... |
high | 8.8 | — | Ibm / mq | 2026-09-18 | 2026-09-23 |
| CVE-2026-11378 IBM MQ could allow an authenticated attacker to cause a denial of service or pot... |
high | 8.8 | — | Ibm / mq | 2026-09-18 | 2026-09-23 |
| CVE-2026-75624 IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, and 12.0.1.0 through 12.0.... |
high | 8.8 | — | Ibm / app connect enterprise | 2026-09-10 | 2026-09-16 |
| CVE-2026-9336 IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to a denial of servi... |
high | 7.5 | — | Ibm / websphere application server | 2026-09-10 | 2026-09-16 |
| CVE-2026-80436 IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated a... |
high | 8.5 | — | Ibm / datastage on cloud pak for data | 2026-09-10 | 2026-09-16 |
| CVE-2026-80380 IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote attacker to per... |
high | 7.1 | — | Ibm / datastage on cloud pak for data | 2026-09-10 | 2026-09-16 |
| CVE-2026-81210 IBM DataStage on Cloud Pak for Data 5.4.0.0 concatenates three caller-supplied s... |
high | 7.7 | — | Ibm / datastage on cloud pak for data | 2026-09-10 | 2026-09-16 |
| CVE-2026-81207 IBM DataStage on Cloud Pak for Data 5.4.0.0 allows any authenticated tenant — wi... |
high | 8.5 | — | Ibm / datastage on cloud pak for data | 2026-09-10 | 2026-09-16 |
| CVE-2026-81540 IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated a... |
high | 8.5 | — | Ibm / datastage on cloud pak for data | 2026-09-10 | 2026-09-16 |
| CVE-2026-81550 IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated a... |
high | 8.8 | — | Ibm / datastage on cloud pak for data | 2026-09-10 | 2026-09-16 |
| CVE-2026-81551 IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated a... |
high | 8.1 | — | Ibm / datastage on cloud pak for data | 2026-09-10 | 2026-09-16 |
| CVE-2026-82095 IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated a... |
high | 8.8 | — | Ibm / datastage on cloud pak for data | 2026-09-10 | 2026-09-16 |
| CVE-2026-82097 IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated a... |
high | 8.8 | — | Ibm / datastage on cloud pak for data | 2026-09-10 | 2026-09-16 |
| CVE-2026-82098 IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated a... |
high | 8.8 | — | Ibm / datastage on cloud pak for data | 2026-09-10 | 2026-09-16 |
| CVE-2026-82099 IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated a... |
high | 8.8 | — | Ibm / datastage on cloud pak for data | 2026-09-10 | 2026-09-16 |
| CVE-2026-9176 IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to a security bypass... |
high | 7.1 | — | Ibm / websphere application server | 2026-09-10 | 2026-09-15 |
| CVE-2026-9327 IBM WebSphere Application Server 9.0, and 8.5 could allow an authenticated user... |
high | 8.1 | — | Ibm / websphere application server | 2026-09-10 | 2026-09-15 |
| CVE-2026-18905 IBM ContextForge MCP Gateway (`mcp-contextforge-gateway`) <= v1.0.6 MCP Context... |
high | 7.7 | — | Ibm / contextforge | 2026-09-04 | 2026-09-15 |
| CVE-2026-18486 IBM ContextForge MCP Gateway <= v1.0.7 MCP Context Forge could allow a remote au... |
high | 8.8 | — | Ibm / contextforge | 2026-09-04 | 2026-09-15 |
| CVE-2026-18489 IBM ContextForge MCP Gateway - Translate utility <= 1.0.8 MCP Context Forge coul... |
high | 7.4 | — | Ibm / contextforge | 2026-09-04 | 2026-09-15 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.