September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,321
Critical
1,226
High
4,361
Medium
4,108
Low
460
Severity not reported
1,166
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (964), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-97514 In the Linux kernel, the following vulnerability has been resolved:
media: chip... |
not reported | — | — | — | 2026-09-24 | 2026-09-28 |
| CVE-2026-97519 In the Linux kernel, the following vulnerability has been resolved:
drm/xe: Fix... |
not reported | — | — | — | 2026-09-24 | 2026-09-28 |
| CVE-2026-97504 In the Linux kernel, the following vulnerability has been resolved:
watchdog: l... |
not reported | — | — | — | 2026-09-24 | 2026-09-28 |
| CVE-2026-97498 In the Linux kernel, the following vulnerability has been resolved:
drm/amdgpu/... |
not reported | — | — | — | 2026-09-24 | 2026-09-28 |
| CVE-2026-97499 In the Linux kernel, the following vulnerability has been resolved:
coresight:... |
not reported | — | — | — | 2026-09-24 | 2026-09-28 |
| CVE-2026-97473 In the Linux kernel, the following vulnerability has been resolved:
powercap: i... |
not reported | — | — | — | 2026-09-24 | 2026-09-28 |
| CVE-2026-97404 In OpenStack Zaqar before 22.0.2, WSGI transport mishandles the URL-Signature he... |
not reported | — | — | — | 2026-09-24 | 2026-09-26 |
| CVE-2026-77621 Vector is a high-performance observability data pipeline. |
not reported | — | — | — | 2026-09-22 | 2026-09-26 |
| CVE-2026-75511 Novu provides an API for sending notifications through multiple channels. |
not reported | — | — | — | 2026-09-22 | 2026-09-26 |
| CVE-2026-71543 OpenBao is an open source identity-based secrets management system. |
not reported | — | — | — | 2026-09-21 | 2026-09-25 |
| CVE-2026-68919 GoCD is a continuous deliver server. |
not reported | — | — | — | 2026-09-21 | 2026-09-25 |
| CVE-2026-54584 mport is the MidnightBSD Package Manager. |
not reported | — | — | — | 2026-09-21 | 2026-09-25 |
| CVE-2026-53629 GLPI is a free asset and IT management software package. |
not reported | — | — | — | 2026-09-25 | 2026-09-25 |
| CVE-2026-45801 GLPI is a free asset and IT management software package. |
not reported | — | — | — | 2026-09-25 | 2026-09-25 |
| CVE-2026-55217 GLPI is a free asset and IT management software package. |
not reported | — | — | — | 2026-09-25 | 2026-09-25 |
| CVE-2026-53627 GLPI is a free asset and IT management software package. |
not reported | — | — | — | 2026-09-25 | 2026-09-25 |
| CVE-2026-53625 GLPI is a free asset and IT management software package. |
not reported | — | — | — | 2026-09-25 | 2026-09-25 |
| CVE-2026-47679 GLPI is a free asset and IT management software package. |
not reported | — | — | — | 2026-09-25 | 2026-09-25 |
| CVE-2026-90901 Joomla Extension - joomshaper.com - Authenticated, Privileged SQL Injection in M... |
not reported | — | — | — | 2026-09-23 | 2026-09-25 |
| CVE-2026-90902 Joomla Extension - joomshaper.com - Authenticated, Privileged SQL Injection in C... |
not reported | — | — | — | 2026-09-23 | 2026-09-25 |
| CVE-2026-96812 Improper Exposure of Resource to Wrong Sphere in the host file helper (gofer) in... |
not reported | — | — | — | 2026-09-25 | 2026-09-25 |
| CVE-2026-87721 Uncontrolled Resource Consumption (CWE-400 / CWE-407) in the ANTLR 3 search quer... |
not reported | — | — | — | 2026-09-24 | 2026-09-25 |
| CVE-2026-87722 Uncontrolled Resource Consumption (CWE-400 / CWE-1333) in regex search query pre... |
not reported | — | — | — | 2026-09-24 | 2026-09-25 |
| CVE-2026-87720 Incorrect Authorization (CWE-863) in project name normalization (ProjectUtil.str... |
not reported | — | — | — | 2026-09-24 | 2026-09-25 |
| CVE-2026-84283 Secure Folder 1.2 stores files selected for its password-protected vault as unen... |
not reported | — | — | — | 2026-09-25 | 2026-09-25 |
| CVE-2026-85082 Root Browser Classic 3.3.0 passes the path of a selected SQLite database to an o... |
not reported | — | — | — | 2026-09-25 | 2026-09-25 |
| CVE-2026-100190 The AIL Framework crawler splash domain page (showDomain.html) is vulnerable to... |
not reported | — | — | — | 2026-09-25 | 2026-09-25 |
| CVE-2026-100172 The AIL Framework (ail-project/ail-framework) contains a stored cross-site scrip... |
not reported | — | — | — | 2026-09-25 | 2026-09-25 |
| CVE-2026-100174 The AIL Framework tag selector component (var/www/static/js/tags.js) is vulnerab... |
not reported | — | — | — | 2026-09-25 | 2026-09-25 |
| CVE-2026-100176 The AIL Framework's username timeline feature is vulnerable to stored cross-site... |
not reported | — | — | — | 2026-09-25 | 2026-09-25 |
| CVE-2026-100177 The AIL Framework crawler task creation API (api_add_crawler_task) contained an... |
not reported | — | — | — | 2026-09-25 | 2026-09-25 |
| CVE-2026-100187 The Onion module in AIL Framework contained a performance shortcut in its URL ex... |
not reported | — | — | — | 2026-09-25 | 2026-09-25 |
| CVE-2026-97863 The cisco_firesight_manager_ACL_rule_export module in misp-modules generates a s... |
not reported | — | — | — | 2026-09-25 | 2026-09-25 |
| CVE-2026-97898 Insecure Direct Object Reference / missing object-level authorization in the Aki... |
not reported | — | — | — | 2026-09-25 | 2026-09-25 |
| CVE-2026-46636 Twig is a template language for PHP. |
not reported | — | — | — | 2026-09-04 | 2026-09-25 |
| CVE-2026-44715 OpenMRS is an open source electronic medical record system platform. |
not reported | — | — | — | 2026-09-11 | 2026-09-25 |
| CVE-2026-44202 Open Access Management (OpenAM) is an access management solution. |
not reported | — | — | — | 2026-09-15 | 2026-09-25 |
| CVE-2026-46619 Open Access Management (OpenAM) is an access management solution. |
not reported | — | — | — | 2026-09-15 | 2026-09-25 |
| CVE-2026-46495 OpenDJ is an LDAPv3 compliant directory service. |
not reported | — | — | — | 2026-09-15 | 2026-09-25 |
| CVE-2026-55774 OpenBao is an open source identity-based secrets management system. |
not reported | — | — | — | 2026-09-15 | 2026-09-25 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.