September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,321
Critical
1,226
High
4,361
Medium
4,108
Low
460
Severity not reported
1,166
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (964), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-94394 When a regular user adds a reference between objects or attributes, MISP checks... |
not reported | — | — | — | 2026-09-21 | 2026-09-21 |
| CVE-2026-94401 MISP has a file-handling vulnerability that could let certain authenticated user... |
not reported | — | — | — | 2026-09-21 | 2026-09-21 |
| CVE-2026-93884 Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. |
not reported | — | — | — | 2026-09-21 | 2026-09-21 |
| CVE-2026-94277 MISP's galaxy matrix statistics view (app/View/Users/statistics_galaxymatrix.ctp... |
not reported | — | — | — | 2026-09-21 | 2026-09-21 |
| CVE-2026-80219 Rejected reason: Red Hat Product Security has come to the conclusion that this C... |
not reported | — | — | — | 2026-09-08 | 2026-09-21 |
| CVE-2026-90839 Rejected reason: this is rejected |
not reported | — | — | — | 2026-09-21 | 2026-09-21 |
| CVE-2026-81898 In Concrete CMS below version 9.5.3, the Address attribute's country-less text f... |
not reported | — | — | — | 2026-09-15 | 2026-09-20 |
| CVE-2026-68532 Concrete CMS 9.0.0 to dashboard group type controller did not validate a CSRF to... |
not reported | — | — | — | 2026-09-15 | 2026-09-20 |
| CVE-2026-18113 In Concrete CMS 9.0 to 9.5.2, the Top Navigation Bar block did not HTML-escape d... |
not reported | — | — | — | 2026-09-15 | 2026-09-20 |
| CVE-2026-84048 Joomla Extension - joomgalleryfriends.net - Unauthenticated arbitrary file uploa... |
not reported | — | — | — | 2026-09-15 | 2026-09-19 |
| CVE-2026-79954 NASA CryptoLib 1.5.0 contains an authentication downgrade vulnerability in the T... |
not reported | — | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-81301 Ekia File Manager 1.2.7 exposes com.ekia.filecontrolmanager.OpenFileProvider as... |
not reported | — | — | — | 2026-09-14 | 2026-09-18 |
| CVE-2026-77884 Gallery - Private Photo Vault 1.0.41 starts an unauthenticated HTTP server that... |
not reported | — | — | — | 2026-09-14 | 2026-09-18 |
| CVE-2026-85628 Transmission of the home Wi-Fi credentials without encryption during the pairing... |
not reported | — | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-86443 Cleartext storage of sensitive information in the DuoxMe application for Android... |
not reported | — | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-86474 The lack of TLS certificate validation when downloading firmware updates in VEO... |
not reported | — | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-86585 The lack of signature verification of firmware update packages in VEO and VEO-XS... |
not reported | — | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-88260 Authentication bypass using an alternate path or channel and Improper validation... |
not reported | — | — | — | 2026-09-11 | 2026-09-18 |
| CVE-2026-88261 Improper input validation vulnerability in bizwell xClick allows Stored XSS. |
not reported | — | — | — | 2026-09-15 | 2026-09-18 |
| CVE-2026-88262 Insufficient session expiration vulnerability in bizwell xClick allows Authentic... |
not reported | — | — | — | 2026-09-15 | 2026-09-18 |
| CVE-2026-68491 An insufficient check allowed for the overwrite of arbitrary files via a symlink... |
not reported | — | — | — | 2026-09-15 | 2026-09-18 |
| CVE-2026-68489 Static Code Injection in Plesk extensions "Ruby" before 1.6.6 and "Node.js Toolk... |
not reported | — | — | — | 2026-09-14 | 2026-09-18 |
| CVE-2026-15638 An unauthenticated user with access to Secret Server could leverage a padding or... |
not reported | — | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-15639 An attacker can craft a malicious link that, if used by a legitimate user, may c... |
not reported | — | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-15640 Under certain conditions a valid SAML IdP response may be used to impersonate an... |
not reported | — | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-92627 A heap-use-after-free vulnerability exists in H5T__conv_f_f() in src/H5Tconv.c i... |
not reported | — | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-89082 HP has identified potential security vulnerabilities in the HP Advance software... |
not reported | — | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-89083 HP
has identified potential security vulnerabilities in the HP Advance software... |
not reported | — | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-89084 HP
has identified potential security vulnerabilities in the HP Advance software... |
not reported | — | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-92611 In Eclipse Ankaios versions 0.6.0 to before 1.0.4, `LogRule::matches` in the age... |
not reported | — | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-92082 By default, Payara Server does not limit the number of failed login attempts, wh... |
not reported | — | — | — | 2026-09-15 | 2026-09-18 |
| CVE-2026-85104 In Sooma 2GEN brain stimulator, an attacker within Bluetooth range can make unau... |
not reported | — | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-16172 Netskope was notified of an out-of-bounds heap read affecting the Endpoint DLP (... |
not reported | — | — | — | 2026-09-10 | 2026-09-18 |
| CVE-2026-16174 Netskope was notified about a potential gap in Netskope Endpoint DLP (EPDLP) run... |
not reported | — | — | — | 2026-09-10 | 2026-09-18 |
| CVE-2026-15710 An information leakage vulnerability exists in the Endpoint DLP component (epdlp... |
not reported | — | — | — | 2026-09-11 | 2026-09-18 |
| CVE-2026-12518 A local privilege escalation vulnerability in the Logitech Logi Options+ updater... |
not reported | — | — | — | 2026-09-14 | 2026-09-18 |
| CVE-2026-85979 Affected versions of Puppet Enterprise contain a command injection vulnerability... |
not reported | — | — | — | 2026-09-11 | 2026-09-18 |
| CVE-2026-3869 CWE-303 : Incorrect Implementation of Authentication Algorithm vulnerability exi... |
not reported | — | — | — | 2026-09-11 | 2026-09-18 |
| CVE-2026-81861 CWE-522: Insufficiently Protected Credentials vulnerability that could result in... |
not reported | — | — | — | 2026-09-11 | 2026-09-18 |
| CVE-2026-20773 A role-based access control issue was identified in the administrative expressio... |
not reported | — | — | — | 2026-09-14 | 2026-09-18 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.