September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,326
Critical
1,227
High
4,361
Medium
4,108
Low
460
Severity not reported
1,170
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (964), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-91852 Improper neutralization of input during web page generation ('cross-site scripti... |
medium | 6.1 | — | Apache / sling xss protection api | 2026-09-23 | 2026-09-30 |
| CVE-2026-91928 Improper neutralization of input during web page generation ('cross-site scripti... |
medium | 6.1 | — | Apache / sling xss protection api | 2026-09-23 | 2026-09-30 |
| CVE-2026-91999 Improper neutralization of input during web page generation ('cross-site scripti... |
medium | 6.1 | — | Apache / sling xss protection api | 2026-09-23 | 2026-09-30 |
| CVE-2026-92001 Improper restriction of recursive entity references in DTDs ('XML entity expansi... |
medium | 6.1 | — | Apache / sling xss protection api | 2026-09-23 | 2026-09-30 |
| CVE-2026-82355 When a request to the Airflow core API carries both a session cookie and an expl... |
medium | 4.2 | — | Apache / airflow | 2026-09-21 | 2026-09-25 |
| CVE-2026-75158 Apache Airflow's `/assets/events` API returned asset events for every Dag in the... |
medium | 4.3 | — | Apache / airflow | 2026-09-21 | 2026-09-25 |
| CVE-2026-91867 When Neethi fetches a remote policy reference, it only limits the time per read,... |
medium | 4.3 | — | Apache / neethi | 2026-09-21 | 2026-09-25 |
| CVE-2026-82561 Apache NiFi 1.5.0 through 2.11.0 provide REST API methods that replace the entir... |
medium | 6.5 | — | Apache / nifi | 2026-09-16 | 2026-09-21 |
| CVE-2026-81866 Apache NiFi 2.9.0 through 2.11.0 provide Connector configuration update and veri... |
medium | 4.3 | — | Apache / nifi | 2026-09-16 | 2026-09-21 |
| CVE-2026-75880 An authenticated client could attach a consumer with a selector containing craft... |
medium | 6.5 | — | Apache / artemis | 2026-09-10 | 2026-09-18 |
| CVE-2026-84439 When audit logging is enabled (zookeeper.audit.enable=true), an unauthenticated... |
medium | 5.3 | — | Apache / zookeeper | 2026-09-16 | 2026-09-18 |
| CVE-2026-84501 An unauthenticated attacker can inject arbitrary fake log lines into Apache ZooK... |
medium | 5.3 | — | Apache / zookeeper | 2026-09-16 | 2026-09-18 |
| CVE-2026-86465 Apache Airflow Akeyless provider: the Akeyless secrets backend's team-scope guar... |
medium | 6.5 | — | Apache / apache-airflow-providers-akeyless | 2026-09-16 | 2026-09-17 |
| CVE-2026-57822 When the broker is processing message-based management requests, sent by an auth... |
medium | 6.5 | — | Apache / artemis | 2026-09-10 | 2026-09-16 |
| CVE-2026-54048 Specifying tblproperties('avro.schema.url'=' http://...' ) or with a 'file:///'... |
medium | 5.3 | — | Apache / impala | 2026-09-09 | 2026-09-10 |
| CVE-2026-32773 There is a lack of XSS escaping in the Spark History Server prior to 3.5.8 which... |
medium | 6.1 | — | Apache / spark | 2026-09-02 | 2026-09-08 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.