September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,321
Critical
1,226
High
4,361
Medium
4,108
Low
460
Severity not reported
1,166
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (964), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-95697 MISP contains an authorization flaw in the Organisation model's captureOrg metho... |
not reported | — | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-95698 The findOrgImage method in MISP's OrgImgHelper constructs a filesystem path by c... |
not reported | — | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-95701 In MISP, the __statisticsOrgs method in UsersController.php used the organizatio... |
not reported | — | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-95703 In MISP, the OrganisationsController::__uploadLogo method processed a caller-sup... |
not reported | — | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-95671 In MISP, the CollectionsController add() method enforced the sharing-group usabi... |
not reported | — | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-95674 In MISP, the queryEnrichment method in EventsController.php accepted a module na... |
not reported | — | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-95679 MISP's RequestHandlerComponent automatically decodes XML request bodies on all w... |
not reported | — | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-95682 MISP contains a stored cross-site scripting (XSS) vulnerability in the admin ema... |
not reported | — | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-95683 In MISP, the Overmind event view enriches an event with its most recent attached... |
not reported | — | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-95665 MISP contains a reflected cross-site scripting (XSS) vulnerability in the event... |
not reported | — | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-95667 The MISP installer scripts (for Debian 12, Debian 13, Ubuntu 24.04, and RHEL 9.4... |
not reported | — | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-95658 MISP's WorkflowsController exposed the moduleStatelessExecution action in the Se... |
not reported | — | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-95659 MISP contains a reflected cross-site scripting (XSS) vulnerability in the Analys... |
not reported | — | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-95661 MISP contains a reflected cross-site scripting (XSS) vulnerability in the attrib... |
not reported | — | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-95511 Rejected reason: Not a vulnerability. |
not reported | — | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-93598 ArcadeDB (Maven artifact com.arcadedb:arcadedb-engine) through 26.8.1 contains a... |
not reported | — | — | — | 2026-09-18 | 2026-09-22 |
| CVE-2026-90990 Improper neutralization of newlines in filter values in the monitoring host and... |
not reported | — | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-49995 Tautulli is a Python based monitoring and tracking tool for Plex Media Server. |
not reported | — | — | — | 2026-09-21 | 2026-09-22 |
| CVE-2026-69664 Missing Release of Resource after Effective Lifetime vulnerability in Erlang/OTP... |
not reported | — | — | — | 2026-09-01 | 2026-09-22 |
| CVE-2026-93296 MISP contains a stored cross-site scripting (XSS) vulnerability in the Overmind... |
not reported | — | — | — | 2026-09-17 | 2026-09-22 |
| CVE-2026-93295 MISP contains a vulnerability in its background job dispatch mechanism that allo... |
not reported | — | — | — | 2026-09-17 | 2026-09-22 |
| CVE-2026-54575 mport is the MidnightBSD Package Manager. |
not reported | — | — | — | 2026-09-17 | 2026-09-21 |
| CVE-2026-54586 mport is the MidnightBSD Package Manager. |
not reported | — | — | — | 2026-09-17 | 2026-09-21 |
| CVE-2026-77021 Improper handling of highly compressed data (data amplification) in Checkmk <2.5... |
not reported | — | — | — | 2026-09-21 | 2026-09-21 |
| CVE-2026-52835 Tautulli is a Python based monitoring and tracking tool for Plex Media Server. |
not reported | — | — | — | 2026-09-21 | 2026-09-21 |
| CVE-2026-77972 Time-of-check Time-of-use (TOCTOU) Race Condition in Slab safeurl allows an atta... |
not reported | — | — | — | 2026-09-15 | 2026-09-21 |
| CVE-2026-77866 Server-Side Request Forgery (SSRF) vulnerability in Slab safeurl allows an attac... |
not reported | — | — | — | 2026-09-15 | 2026-09-21 |
| CVE-2026-19407 Bucket Squatting in Google Cloud Gemini Enterprise Agent Platform SDK for Python... |
not reported | — | — | — | 2026-09-15 | 2026-09-21 |
| CVE-2026-81531 An information
disclosure vulnerability has been identified in Omada Controller. |
not reported | — | — | — | 2026-09-08 | 2026-09-21 |
| CVE-2026-68914 Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. |
not reported | — | — | — | 2026-09-18 | 2026-09-21 |
| CVE-2026-77568 Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. |
not reported | — | — | — | 2026-09-18 | 2026-09-21 |
| CVE-2026-92612 In Eclipse iceoryx2 versions greater than v0.8.0, the StaticString exposes its c... |
not reported | — | — | — | 2026-09-21 | 2026-09-21 |
| CVE-2026-94373 MISP contains a DOM-based cross-site scripting (XSS) vulnerability in the contex... |
not reported | — | — | — | 2026-09-21 | 2026-09-21 |
| CVE-2026-94374 MISP contains an insecure direct object reference vulnerability in the processMo... |
not reported | — | — | — | 2026-09-21 | 2026-09-21 |
| CVE-2026-94379 The login() function in MISP's UsersController.php contained insufficient HTTP m... |
not reported | — | — | — | 2026-09-21 | 2026-09-21 |
| CVE-2026-94393 When a user creates or edits a report inside an event, MISP can identify an exis... |
not reported | — | — | — | 2026-09-21 | 2026-09-21 |
| CVE-2026-94372 MISP contains a stored cross-site scripting (XSS) vulnerability in the default t... |
not reported | — | — | — | 2026-09-21 | 2026-09-21 |
| CVE-2026-94404 MISP has a security issue that could let an attacker change threat-intelligence... |
not reported | — | — | — | 2026-09-21 | 2026-09-21 |
| CVE-2026-94381 MISP has a security issue that can let a user gain more access than their API ke... |
not reported | — | — | — | 2026-09-21 | 2026-09-21 |
| CVE-2026-94383 The MISP blocklist workflow module accepted a user-supplied blocklist filename p... |
not reported | — | — | — | 2026-09-21 | 2026-09-21 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.