September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,364
Critical
1,230
High
4,374
Medium
4,126
Low
462
Severity not reported
1,172
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (964), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-78216 AshLua exposes Ash read actions to Lua scripts run through an eval action. |
not reported | — | — | — | 2026-09-08 | 2026-09-08 |
| CVE-2026-78230 AshAi exposes Ash read actions to language-model tool calls. |
not reported | — | — | — | 2026-09-08 | 2026-09-08 |
| CVE-2026-86477 Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. |
not reported | — | — | — | 2026-09-08 | 2026-09-08 |
| CVE-2026-86283 MISP's UiBeta theme collection view (app/View/Themed/UiBeta/Collections/view.ctp... |
not reported | — | — | — | 2026-09-06 | 2026-09-08 |
| CVE-2026-82752 Improper Validation of Specified Quantity in Input vulnerability in ash-project... |
not reported | — | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-82750 Improper Validation of Specified Quantity in Input in ZenHive mpp allows an unau... |
not reported | — | — | — | 2026-09-06 | 2026-09-08 |
| CVE-2026-82751 Improper Validation of Specified Quantity in Input in ZenHive mpp allows an unau... |
not reported | — | — | — | 2026-09-06 | 2026-09-08 |
| CVE-2026-16769 An unencrypted 'pause encryption request' message causes a denial of service in... |
not reported | — | — | — | 2026-09-08 | 2026-09-08 |
| CVE-2026-86207 An authentication bypass in N-central < 2026.3 HF 3 leads to authentication bypa... |
not reported | — | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-86206 A vulnerability in the N-central internal API access control filter allows unaut... |
not reported | — | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-18167 A
stack-based buffer overflow vulnerability exists in the EasyMesh module of
TP-... |
not reported | — | — | — | 2026-09-03 | 2026-09-08 |
| CVE-2026-84186 Vulnerability involving incorrect access control in the Tools::getRemoteAddr() f... |
not reported | — | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-77132 It has been discovered that several AJAX routes used for the backend localizatio... |
not reported | — | — | — | 2026-09-08 | 2026-09-08 |
| CVE-2026-85400 Backend administrators without system maintainer privileges were able to schedul... |
not reported | — | — | — | 2026-09-08 | 2026-09-08 |
| CVE-2026-86135 A Cross-Site Request Forgery (CSRF) vulnerability in WatchGuard Dimension's data... |
not reported | — | — | — | 2026-09-08 | 2026-09-08 |
| CVE-2026-78043 The Windows Interactive Service in OpenVPN 2.7_alpha1 through 2.7.6 allows local... |
not reported | — | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-78221 An incorrect buffer size calculation in the Windows Interactive Service in OpenV... |
not reported | — | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-81738 OpenVPN 2.5.0 through 2.7.6 on Windows using the tap-windows6 driver allows atta... |
not reported | — | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-81830 The Windows interactive service in OpenVPN 2.4.0 through 2.6.22 allows local aut... |
not reported | — | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-82312 OpenVPN 2.0.0 through 2.6.22 and 2.7_alpha1 through 2.7.6 on Windows allows loca... |
not reported | — | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-84226 OpenVPN version 2.5.0 through 2.6.22 and 2.7_alpha1 through 2.7.6 on Windows all... |
not reported | — | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-84732 Retransmissions of ACK packet ID in OpenVPN through 2.6.22 and 2.7.6 allow remot... |
not reported | — | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-82325 A use-after-free vulnerability in the OpenVPN ovpn-dco-win driver version 2.5.0... |
not reported | — | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-85201 In Eclipse Ankaios versions 0.1.0 through 1.0.1, the agent does not limit the le... |
not reported | — | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-84173 In Eclipse Ankaios versions v0.5.1 through v1.0.1, the agent-side Control Interf... |
not reported | — | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-33197 AMI APTIOV contains a vulnerability in BIOS where a privileged user may cause th... |
not reported | — | — | — | 2026-09-08 | 2026-09-08 |
| CVE-2026-19204 A client may send a WebSocket frame with an unknown opcode and a very large decl... |
not reported | — | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-15431 A potential security vulnerability has been identified in the HP Support
Assist... |
not reported | — | — | — | 2026-09-03 | 2026-09-08 |
| CVE-2026-82753 Allocation of Resources Without Limits or Throttling vulnerability in ash-projec... |
not reported | — | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-82754 Improper Protection of Alternate Path vulnerability in ash-project ash_authentic... |
not reported | — | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-82755 Use of Cache Containing Sensitive Information vulnerability in ash-project ash_a... |
not reported | — | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-82756 Improper Encoding or Escaping of Output vulnerability in ash-project ash_authent... |
not reported | — | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-82757 Server-Side Request Forgery (SSRF) vulnerability in ash-project ash_authenticati... |
not reported | — | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-82758 Improper Authentication vulnerability in ash-project ash_authentication_oauth2_s... |
not reported | — | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-81638 Improper Handling of Alternate Encoding vulnerability in ash-project ash_double_... |
not reported | — | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-82586 Improper Protection of Alternate Path vulnerability in ash-project ash_lua allow... |
not reported | — | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-82710 Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in a... |
not reported | — | — | — | 2026-09-08 | 2026-09-08 |
| CVE-2026-19203 A client may issue specially crafted HTTP/1.1 chunked requests to a Jetty server... |
not reported | — | — | — | 2026-09-08 | 2026-09-08 |
| CVE-2026-4644 A Missing Authorization vulnerability in HTTP Connector in Google Cloud Integrat... |
not reported | — | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-79707 A Path Traversal vulnerability in the builder endpoint in Google Cloud Agent Dev... |
not reported | — | — | — | 2026-09-04 | 2026-09-08 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.