September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,364
Critical
1,230
High
4,374
Medium
4,126
Low
462
Severity not reported
1,172
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (964), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-92808 A server-side request forgery (SSRF) vulnerability exists in the UnifiedLogin se... |
not reported | — | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-50603 A vulnerability has been identified in the Acer Agent Service component included... |
not reported | — | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-50604 A vulnerability has been identified in the Acer Agent Service component included... |
not reported | — | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-50605 A vulnerability has been identified in the Acer Agent Service component included... |
not reported | — | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-50606 A vulnerability has been identified in the Acer System Monitoring component incl... |
not reported | — | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-50607 A vulnerability has been identified in the Acer System Monitoring component incl... |
not reported | — | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-50608 A vulnerability has been identified in the Acer System Monitoring component incl... |
not reported | — | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-50609 A vulnerability has been identified in the Acer System Monitoring component incl... |
not reported | — | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-50610 A vulnerability has been identified in the Acer System Monitoring component incl... |
not reported | — | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-54576 mport is the MidnightBSD Package Manager. |
not reported | — | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-54578 mport is the MidnightBSD Package Manager. |
not reported | — | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-54507 Vvveb is a powerful and easy to use CMS with page builder to build websites, blo... |
not reported | — | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-89418 google-protobuf contains an unbounded recursion when parsing unknown protobuf gr... |
not reported | — | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-78668 Rejected reason: reserved but not needed |
not reported | — | — | — | 2026-09-17 | 2026-09-17 |
| CVE-2026-54581 mport is the MidnightBSD Package Manager. |
not reported | — | — | — | 2026-09-17 | 2026-09-17 |
| CVE-2026-54582 mport is the MidnightBSD Package Manager. |
not reported | — | — | — | 2026-09-17 | 2026-09-17 |
| CVE-2026-54583 mport is the MidnightBSD Package Manager. |
not reported | — | — | — | 2026-09-17 | 2026-09-17 |
| CVE-2026-54585 mport is the MidnightBSD Package Manager. |
not reported | — | — | — | 2026-09-17 | 2026-09-17 |
| CVE-2026-54587 mport is the MidnightBSD Package Manager. |
not reported | — | — | — | 2026-09-17 | 2026-09-17 |
| CVE-2026-73177 Nozomi Networks Labs identified a CWE-345: Insufficient Verification of Data Aut... |
not reported | — | — | — | 2026-09-16 | 2026-09-17 |
| CVE-2026-92962 vm2 is a sandbox for running untrusted JavaScript. |
not reported | — | — | — | 2026-09-17 | 2026-09-17 |
| CVE-2026-53681 Rejected reason: Red Hat Product Security has come to the conclusion that this C... |
not reported | — | — | — | 2026-09-17 | 2026-09-17 |
| CVE-2026-53679 Rejected reason: Red Hat Product Security has come to the conclusion that this C... |
not reported | — | — | — | 2026-09-17 | 2026-09-17 |
| CVE-2026-21586 This High severity Improper Authorization vulnerability was introduced in versio... |
not reported | — | — | — | 2026-09-15 | 2026-09-17 |
| CVE-2026-21587 This High severity Improper Authorization vulnerability was introduced in versio... |
not reported | — | — | — | 2026-09-15 | 2026-09-17 |
| CVE-2026-11874 Rejected reason: Red Hat Product Security has come to the conclusion that this C... |
not reported | — | — | — | 2026-09-17 | 2026-09-17 |
| CVE-2026-75754 Missing Authentication for Critical Function, Server-Side Request Forgery (SSRF)... |
not reported | — | — | — | 2026-09-04 | 2026-09-17 |
| CVE-2026-16003 Exposed IOCTL with Insufficient Access Control in Armoury Crate driver allows a... |
not reported | — | — | — | 2026-09-08 | 2026-09-17 |
| CVE-2026-16004 Exposed IOCTL with Insufficient Access Control in Armoury Crate driver allows a... |
not reported | — | — | — | 2026-09-08 | 2026-09-17 |
| CVE-2026-16005 Release of Invalid Pointer or Reference in Armoury Crate driver allows a local u... |
not reported | — | — | — | 2026-09-08 | 2026-09-17 |
| CVE-2026-16006 Exposure of Sensitive System Information to an Unauthorized Control Sphere in Ar... |
not reported | — | — | — | 2026-09-08 | 2026-09-17 |
| CVE-2026-12962 A Permissive Cross-domain Security Policy with Untrusted Domains in Armoury Crat... |
not reported | — | — | — | 2026-09-08 | 2026-09-17 |
| CVE-2026-69204 Http4s is a Scala interface for HTTP services. |
not reported | — | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-88819 In Siglet current and past versions the refresh token handler do not enforce pro... |
not reported | — | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-86836 In Eclipse Ankaios versions 0.1.0 through 1.0.2, the agent creates workload file... |
not reported | — | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-77179 On macOS, the virtio-fs host server used by Docker Sandboxes improperly follows... |
not reported | — | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-79994 The guest-to-host Unix-domain socket relay in Docker Sandboxes validates that a... |
not reported | — | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-86338 Ash field_policies are documented to protect against filter-based information di... |
not reported | — | — | — | 2026-09-16 | 2026-09-16 |
| CVE-2026-88255 Improper Validation of Unsafe Equivalence in Input in ZenHive mpp allows an unau... |
not reported | — | — | — | 2026-09-16 | 2026-09-16 |
| CVE-2026-89186 Use of Cache Containing Sensitive Information in ZenHive mpp allows a shared HTT... |
not reported | — | — | — | 2026-09-16 | 2026-09-16 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.