September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,321
Critical
1,226
High
4,361
Medium
4,108
Low
460
Severity not reported
1,166
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (964), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-19915 A potential security vulnerability has been identified in the HP Support Assista... |
not reported | — | — | — | 2026-09-22 | 2026-09-29 |
| CVE-2026-101041 The account recovery (password reset) functionality in the vulnerability-lookup... |
not reported | — | — | — | 2026-09-27 | 2026-09-29 |
| CVE-2026-55473 HomeBox is a home inventory and organization system. |
not reported | — | — | — | 2026-09-21 | 2026-09-29 |
| CVE-2026-45381 Tautulli is a Python based monitoring and tracking tool for Plex Media Server. |
not reported | — | — | — | 2026-09-21 | 2026-09-29 |
| CVE-2026-91043 Allocation of Resources Without Limits or Throttling vulnerability in elixir-min... |
not reported | — | — | — | 2026-09-28 | 2026-09-29 |
| CVE-2026-67228 RabbitMQ is a messaging and streaming broker. |
not reported | — | — | — | 2026-09-23 | 2026-09-29 |
| CVE-2026-84452 Windows ML CLI is a command line tool for building portable, performant, and hig... |
not reported | — | — | — | 2026-09-02 | 2026-09-28 |
| CVE-2026-82584 Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in a... |
not reported | — | — | — | 2026-09-07 | 2026-09-28 |
| CVE-2026-18023 Sensitive Information in Resource Not Removed Before Reuse in ASUS Armoury Crate... |
not reported | — | — | — | 2026-09-08 | 2026-09-28 |
| CVE-2026-19397 Missing authentication for a critical function in ASUS Control Center Express Ag... |
not reported | — | — | — | 2026-09-08 | 2026-09-28 |
| CVE-2026-75808 Allocation of Resources Without Limits or Throttling in ASUS Armoury Crate allow... |
not reported | — | — | — | 2026-09-08 | 2026-09-28 |
| CVE-2026-75809 Exposed IOCTL with insufficient access control in ASUS Armoury Crate allows a lo... |
not reported | — | — | — | 2026-09-08 | 2026-09-28 |
| CVE-2026-75810 Exposed Dangerous Method or Function in ASUS Armoury Crate allow a local user to... |
not reported | — | — | — | 2026-09-08 | 2026-09-28 |
| CVE-2026-75811 Improper Restriction of Software Interfaces to Hardware Features in ASUS Armoury... |
not reported | — | — | — | 2026-09-08 | 2026-09-28 |
| CVE-2026-40854 WNC T-Mobile 5G Box IDU router contains an authentication bypass vulnerability i... |
not reported | — | — | — | 2026-09-16 | 2026-09-28 |
| CVE-2026-40855 WNC T-Mobile 5G Box IDU router is vulnerable to a command injection. |
not reported | — | — | — | 2026-09-16 | 2026-09-28 |
| CVE-2026-40856 WNC T-Mobile 5G Box IDU router is vulnerable to improper access control. |
not reported | — | — | — | 2026-09-16 | 2026-09-28 |
| CVE-2026-40857 WNC T-Mobile 5G Box IDU router contains a cross-site request forgery (CSRF) vuln... |
not reported | — | — | — | 2026-09-16 | 2026-09-28 |
| CVE-2026-58146 WNC T-Mobile 5G Box IDU router is vulnerable to OS command injection vulnerabili... |
not reported | — | — | — | 2026-09-16 | 2026-09-28 |
| CVE-2026-58147 WNC T-Mobile 5G Box IDU router contains an OS command injection vulnerability in... |
not reported | — | — | — | 2026-09-16 | 2026-09-28 |
| CVE-2026-100655 Rejected reason: This CVE ID has been rejected as a duplicate. |
not reported | — | — | — | 2026-09-26 | 2026-09-28 |
| CVE-2026-100656 Rejected reason: This CVE ID has been rejected as a duplicate. |
not reported | — | — | — | 2026-09-26 | 2026-09-28 |
| CVE-2026-100657 Rejected reason: This CVE ID has been rejected as a duplicate. |
not reported | — | — | — | 2026-09-26 | 2026-09-28 |
| CVE-2026-100658 Rejected reason: This CVE ID has been rejected as a duplicate. |
not reported | — | — | — | 2026-09-26 | 2026-09-28 |
| CVE-2026-65980 Chartbrew is an open-source web application that can connect directly to databas... |
not reported | — | — | — | 2026-09-21 | 2026-09-28 |
| CVE-2026-56739 Logto is the modern, open-source auth infrastructure for SaaS and AI apps. |
not reported | — | — | — | 2026-09-24 | 2026-09-28 |
| CVE-2026-46649 Joplin is an open source note-taking and to-do application that organises notes... |
not reported | — | — | — | 2026-09-21 | 2026-09-28 |
| CVE-2026-101891 An improper access control vulnerability in an internal API service on WatchGuar... |
not reported | — | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-86102 An OS command injection vulnerability in the WatchGuard AP internal API service... |
not reported | — | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-87969 An OS command injection vulnerability in the WatchGuard AP diagnostic CLI allows... |
not reported | — | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-63374 AnyIO is a high level asynchronous concurrency and networking framework that wor... |
not reported | — | — | — | 2026-09-22 | 2026-09-28 |
| CVE-2026-82928 mH-DEVELOPER smart home module contains a hardcoded SSH public key in /root/.ssh... |
not reported | — | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-100376 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site... |
not reported | — | — | — | 2026-09-25 | 2026-09-28 |
| CVE-2026-100377 Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wiki... |
not reported | — | — | — | 2026-09-25 | 2026-09-28 |
| CVE-2026-100378 Missing Authorization vulnerability in Wikimedia Foundation Mediawiki - Translat... |
not reported | — | — | — | 2026-09-25 | 2026-09-28 |
| CVE-2026-100379 Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wiki... |
not reported | — | — | — | 2026-09-25 | 2026-09-28 |
| CVE-2026-100380 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site... |
not reported | — | — | — | 2026-09-25 | 2026-09-28 |
| CVE-2026-100381 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site... |
not reported | — | — | — | 2026-09-25 | 2026-09-28 |
| CVE-2026-100382 Improper Neutralization of Special Elements used in an OS Command ('OS Command I... |
not reported | — | — | — | 2026-09-25 | 2026-09-28 |
| CVE-2026-100383 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site... |
not reported | — | — | — | 2026-09-25 | 2026-09-28 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.