September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,364
Critical
1,230
High
4,374
Medium
4,126
Low
462
Severity not reported
1,172
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (964), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-77950 Generation of Error Message Containing Sensitive Information vulnerability in as... |
not reported | — | — | — | 2026-09-01 | 2026-09-01 |
| CVE-2026-82730 Incorrect Authorization vulnerability in ash-project ash_typescript allows an un... |
not reported | — | — | — | 2026-09-01 | 2026-09-01 |
| CVE-2026-82731 URL Redirection to Untrusted Site ('Open Redirect') vulnerability in ash-project... |
not reported | — | — | — | 2026-09-01 | 2026-09-01 |
| CVE-2026-82732 Improper Input Validation vulnerability in ash-project ash_typescript allows a r... |
not reported | — | — | — | 2026-09-01 | 2026-09-01 |
| CVE-2026-82733 Generation of Error Message Containing Sensitive Information vulnerability in as... |
not reported | — | — | — | 2026-09-01 | 2026-09-01 |
| CVE-2026-82734 Improper Validation of Specified Quantity in Input vulnerability in ash-project... |
not reported | — | — | — | 2026-09-01 | 2026-09-01 |
| CVE-2026-82735 Uncontrolled Resource Consumption vulnerability in ash-project ash allows an att... |
not reported | — | — | — | 2026-09-01 | 2026-09-01 |
| CVE-2026-82736 Incorrect Behavior Order: Validate Before Canonicalize vulnerability in ash-proj... |
not reported | — | — | — | 2026-09-01 | 2026-09-01 |
| CVE-2026-82737 Integer Overflow or Wraparound vulnerability in ash-project ash lets an attacker... |
not reported | — | — | — | 2026-09-01 | 2026-09-01 |
| CVE-2026-82738 Improper Input Validation vulnerability in ash-project ash allows an attacker to... |
not reported | — | — | — | 2026-09-01 | 2026-09-01 |
| CVE-2026-82739 Generation of Error Message Containing Sensitive Information vulnerability in as... |
not reported | — | — | — | 2026-09-01 | 2026-09-01 |
| CVE-2026-82740 Improper Input Validation vulnerability in ash-project ash fails to enforce the... |
not reported | — | — | — | 2026-09-01 | 2026-09-01 |
| CVE-2026-82741 Improper Validation of Specified Type of Input vulnerability in ash-project ash... |
not reported | — | — | — | 2026-09-01 | 2026-09-01 |
| CVE-2026-82742 Uncontrolled Resource Consumption vulnerability in ash-project ash lets an attac... |
not reported | — | — | — | 2026-09-01 | 2026-09-01 |
| CVE-2026-82743 Uncontrolled Resource Consumption vulnerability in ash-project ash lets a slow a... |
not reported | — | — | — | 2026-09-01 | 2026-09-01 |
| CVE-2026-82744 Not Failing Securely (Failing Open) vulnerability in ash-project ash skips an As... |
not reported | — | — | — | 2026-09-01 | 2026-09-01 |
| CVE-2026-82745 Improper Access Control vulnerability in ash-project ash lets a create action ov... |
not reported | — | — | — | 2026-09-01 | 2026-09-01 |
| CVE-2026-82746 Missing Authorization vulnerability in ash-project ash allows an actor to update... |
not reported | — | — | — | 2026-09-01 | 2026-09-01 |
| CVE-2026-82748 Incorrect Authorization vulnerability in ash-project ash authorizes an aggregate... |
not reported | — | — | — | 2026-09-01 | 2026-09-01 |
| CVE-2026-82749 Incorrect Authorization vulnerability in ash-project ash widens a relationship's... |
not reported | — | — | — | 2026-09-01 | 2026-09-01 |
| CVE-2026-82747 Incorrect Authorization vulnerability in ash-project ash returns records that a... |
not reported | — | — | — | 2026-09-01 | 2026-09-01 |
| CVE-2026-19471 Multiple stored cross-site scripting security issues exist within ArmorStart® LT... |
not reported | — | — | — | 2026-09-01 | 2026-09-01 |
| CVE-2026-13336 CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS C... |
not reported | — | — | — | 2026-09-01 | 2026-09-01 |
| CVE-2026-13337 CWE-564: SQL Injection: Hibernate vulnerability exists that could allow the inje... |
not reported | — | — | — | 2026-09-01 | 2026-09-01 |
| CVE-2026-13348 CWE-307: Improper Restriction of Excessive Authentication Attempts vulnerability... |
not reported | — | — | — | 2026-09-01 | 2026-09-01 |
| CVE-2026-4813 A vulnerability in the Lutece Core XSL export management module up to version 7.... |
not reported | — | — | — | 2026-09-01 | 2026-09-01 |
| CVE-2026-84165 A vulnerability relating to incorrect access control in OpenNebula by OpenNebula... |
not reported | — | — | — | 2026-09-01 | 2026-09-01 |
| CVE-2026-19472 A denial-of-service security issue exists within ArmorStart® LT. |
not reported | — | — | — | 2026-09-01 | 2026-09-01 |
| CVE-2026-84235 A denial-of-service security issue exists in the affected product. |
not reported | — | — | — | 2026-09-01 | 2026-09-01 |
| CVE-2026-12661 A denial-of-service security issue exists within FactoryTalk® Historian Machine... |
not reported | — | — | — | 2026-09-01 | 2026-09-01 |
| CVE-2026-12663 A security issue exists within ControlFLASH™, where the installer grants write p... |
not reported | — | — | — | 2026-09-01 | 2026-09-01 |
| CVE-2026-16675 A privilege escalation security issue exists within FactoryTalk® Activation Mana... |
not reported | — | — | — | 2026-09-01 | 2026-09-01 |
| CVE-2026-9621 A denial-of-service security issue exists within RSLinx® Classic. |
not reported | — | — | — | 2026-09-01 | 2026-09-01 |
| CVE-2026-9622 A denial-of-service security issue exists within RSLinx® Classic. |
not reported | — | — | — | 2026-09-01 | 2026-09-01 |
| CVE-2026-9624 A denial-of-service security issue exists within RSLinx® Classic. |
not reported | — | — | — | 2026-09-01 | 2026-09-01 |
| CVE-2026-9625 A denial-of-service security issue exists within RSLinx® Classic. |
not reported | — | — | — | 2026-09-01 | 2026-09-01 |
| CVE-2026-9633 A security issue exists within the Redundancy Module Configuration Tool. |
not reported | — | — | — | 2026-09-01 | 2026-09-01 |
| CVE-2026-9634 A security issue exists within the Redundancy Module Configuration Tool. |
not reported | — | — | — | 2026-09-01 | 2026-09-01 |
| CVE-2026-9637 A denial-of-service security issue exists in the affected Logix platforms listed... |
not reported | — | — | — | 2026-09-01 | 2026-09-01 |
| CVE-2024-7953 A vulnerability exists in the affected products that allows a threat actor to cr... |
not reported | — | — | — | 2026-09-01 | 2026-09-01 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.