September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,321
Critical
1,226
High
4,361
Medium
4,108
Low
460
Severity not reported
1,166
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (964), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-12974 A Security Policy Bypass vulnerability exists in Forcepoint Security Engine (NGF... |
not reported | — | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-92378 A session management
vulnerability exists in the Legacy UI Reduced Function Logi... |
not reported | — | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-53554 SQLBot is an intelligent Text-to-SQL system based on large language models and R... |
not reported | — | — | — | 2026-09-17 | 2026-09-23 |
| CVE-2026-53555 SQLBot is an intelligent Text-to-SQL system based on large language models and R... |
not reported | — | — | — | 2026-09-17 | 2026-09-23 |
| CVE-2026-53556 SQLBot is an intelligent Text-to-SQL system based on large language models and R... |
not reported | — | — | — | 2026-09-17 | 2026-09-23 |
| CVE-2026-53557 SQLBot is an intelligent Text-to-SQL system based on large language models and R... |
not reported | — | — | — | 2026-09-17 | 2026-09-23 |
| CVE-2026-93769 HumHub 1.18.5 is affected by a stored cross-site scripting (XSS) vulnerability t... |
not reported | — | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-92419 WEBCON BPS is vulnerable to Insecure Direct Object Reference (IDOR) in the /api/... |
not reported | — | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-96559 Rejected reason: This ID was for testing |
not reported | — | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-19535 Nozomi Networks Labs identified a CWE-352: Cross-Site Request Forgery (CSRF) vul... |
not reported | — | — | — | 2026-09-16 | 2026-09-23 |
| CVE-2026-73163 Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Ele... |
not reported | — | — | — | 2026-09-16 | 2026-09-23 |
| CVE-2026-73164 Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Ele... |
not reported | — | — | — | 2026-09-16 | 2026-09-23 |
| CVE-2026-73165 Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Ele... |
not reported | — | — | — | 2026-09-16 | 2026-09-23 |
| CVE-2026-73166 Nozomi Networks Labs identified a CWE-94: Improper Control of Generation of Code... |
not reported | — | — | — | 2026-09-16 | 2026-09-23 |
| CVE-2026-73167 Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Ele... |
not reported | — | — | — | 2026-09-16 | 2026-09-23 |
| CVE-2026-73169 Nozomi Networks Labs identified a CWE-79: Improper Neutralization of Input Durin... |
not reported | — | — | — | 2026-09-16 | 2026-09-23 |
| CVE-2026-73170 Nozomi Networks Labs identified a CWE-94: Improper Control of Generation of Code... |
not reported | — | — | — | 2026-09-16 | 2026-09-23 |
| CVE-2026-73171 Nozomi Networks Labs identified a CWE-73: External Control of File Name or Path... |
not reported | — | — | — | 2026-09-16 | 2026-09-23 |
| CVE-2026-73172 Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Ele... |
not reported | — | — | — | 2026-09-16 | 2026-09-23 |
| CVE-2026-73173 Nozomi Networks Labs identified a CWE-306: Missing Authentication for Critical F... |
not reported | — | — | — | 2026-09-16 | 2026-09-23 |
| CVE-2026-73174 Nozomi Networks Labs identified a CWE-319: Cleartext Transmission of Sensitive I... |
not reported | — | — | — | 2026-09-16 | 2026-09-23 |
| CVE-2026-73175 Nozomi Networks Labs identified a CWE-400: Uncontrolled Resource Consumption vul... |
not reported | — | — | — | 2026-09-16 | 2026-09-23 |
| CVE-2026-88817 An authenticated, non-guest user of Curiosity Workspace could enroll themselves... |
not reported | — | — | — | 2026-09-16 | 2026-09-23 |
| CVE-2026-13745 A vulnerability in the Gemini CLI prior to version 0.39.1 allows attackers to ac... |
not reported | — | — | — | 2026-09-10 | 2026-09-23 |
| CVE-2026-73176 Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Ele... |
not reported | — | — | — | 2026-09-16 | 2026-09-23 |
| CVE-2026-8849 Use After Free vulnerability in RTI Connext Professional (Security Plugins) allo... |
not reported | — | — | — | 2026-09-22 | 2026-09-23 |
| CVE-2026-7866 Stack-based Buffer Overflow vulnerability in RTI Connext Professional (Core Libr... |
not reported | — | — | — | 2026-09-22 | 2026-09-23 |
| CVE-2026-89169 live-boot ff8867c allows attackers to bypass the dm-verity-enforce-roothash-sign... |
not reported | — | — | — | 2026-09-11 | 2026-09-22 |
| CVE-2026-93894 In Vinyl Cache before 9.0,2, workspace buffer overflow vulnerability was found i... |
not reported | — | — | — | 2026-09-18 | 2026-09-22 |
| CVE-2026-71198 In OpenStack Glance before 32.0.1, the location API does not validate destinatio... |
not reported | — | — | — | 2026-09-14 | 2026-09-22 |
| CVE-2026-93852 In OpenStack Blazar before 17.0.1, the V2 lease listing operation (GET /v2/lease... |
not reported | — | — | — | 2026-09-18 | 2026-09-22 |
| CVE-2026-93854 In OpenStack Blazar before 17.0.1, the V2 lease API does not enforce object-leve... |
not reported | — | — | — | 2026-09-18 | 2026-09-22 |
| CVE-2026-94571 In OpenStack Octavia before 18.0.1, the Amphora provider driver did not reject c... |
not reported | — | — | — | 2026-09-21 | 2026-09-22 |
| CVE-2026-92252 Incorrect default permissions in the installation directory of WatchDog Anti-Vir... |
not reported | — | — | — | 2026-09-20 | 2026-09-22 |
| CVE-2026-92253 Improper link resolution before file access in the quarantine restoration proces... |
not reported | — | — | — | 2026-09-20 | 2026-09-22 |
| CVE-2026-92254 Missing Authorization in the IOCTL handlers of the wsdkd.sys kernel drivers in W... |
not reported | — | — | — | 2026-09-20 | 2026-09-22 |
| CVE-2026-91921 Cross-Site Scripting (XSS) vulnerability due to inadequate input sanitisation in... |
not reported | — | — | — | 2026-09-21 | 2026-09-22 |
| CVE-2026-93556 The ‘/password/guardarClau/recover’ endpoint accepts the ‘usuariId’ parameter, w... |
not reported | — | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-16651 temporalio/sqlparser can panic when Parse, ParseStrictDDL, or ParseNext processe... |
not reported | — | — | — | 2026-09-21 | 2026-09-22 |
| CVE-2026-16652 Temporal Server did not bound the work performed while searching for a Schedule'... |
not reported | — | — | — | 2026-09-21 | 2026-09-22 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.