September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,364
Critical
1,230
High
4,374
Medium
4,126
Low
462
Severity not reported
1,172
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (964), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-86473 Apache Airflow: the Core API logout endpoint revokes only a session token presen... |
critical | 9.1 | — | Apache / airflow | 2026-09-21 | 2026-09-25 |
| CVE-2026-86462 Apache Airflow FAB provider: changing a user's password through the Admin user-e... |
critical | 9.1 | — | Apache / apache-airflow-providers-fab | 2026-09-16 | 2026-09-18 |
| CVE-2026-82311 Apache Airflow FAB provider: resetting a user's password does not delete that us... |
critical | 9.8 | — | Apache / apache-airflow-providers-fab | 2026-09-16 | 2026-09-18 |
| CVE-2026-76187 Apache Airflow Keycloak provider: the unauthenticated token endpoint accepts a c... |
critical | 9.8 | — | Apache / apache-airflow-providers-keycloak | 2026-09-16 | 2026-09-18 |
| CVE-2026-76186 Apache Airflow Keycloak provider: from Airflow 3.3 the Keycloak auth manager tak... |
critical | 9.1 | — | Apache / apache-airflow-providers-keycloak | 2026-09-16 | 2026-09-18 |
| CVE-2026-75156 Apache Airflow FAB provider versions 3.7.3 through 3.8.0 do not validate the iss... |
critical | 9.1 | — | Apache / apache-airflow-providers-fab | 2026-09-08 | 2026-09-18 |
| CVE-2026-27446 Missing Authentication for Critical Function (CWE-306) vulnerability in Apache A... |
critical | 9.8 | — | Apache / artemis | 2026-03-04 | 2026-09-18 |
| CVE-2026-82617 The two built-in name-finder patterns exposed by
opennlp.tools.namefind.RegexNam... |
critical | 9.8 | — | Apache / opennlp | 2026-09-11 | 2026-09-16 |
| CVE-2026-49364 An unauthenticated network-adjacent attacker can leverage discovery to capture c... |
critical | 9.1 | — | Apache / artemis | 2026-09-10 | 2026-09-16 |
| CVE-2026-67593 A remote attacker can craft an Openwire RemoveSubscriptionInfo command to cause... |
critical | 9.1 | — | Apache / artemis | 2026-09-10 | 2026-09-16 |
| CVE-2026-80352 Improper Control of Generation of Code ('Code Injection') vulnerability in Apach... |
critical | 9.8 | — | Apache / camel | 2026-09-10 | 2026-09-14 |
| CVE-2026-80351 Improper neutralization of directives in dynamically evaluated code ('eval injec... |
critical | 9.8 | — | Apache / camel | 2026-09-10 | 2026-09-14 |
| CVE-2026-84939 Path traversal vulnerability in Apache FreeMarker template loading mechanism, if... |
critical | 9.1 | — | Apache / freemarker | 2026-09-10 | 2026-09-11 |
| CVE-2026-41869 Missing Authorization, Improper Resource Shutdown and Job Interruption vulnerabi... |
critical | 9.1 | — | Apache / nutch | 2026-09-09 | 2026-09-10 |
| CVE-2026-41871 Missing Authorization, Use of Externally-Controlled Input to Select Classes or C... |
critical | 9.8 | — | Apache / nutch | 2026-09-09 | 2026-09-10 |
| CVE-2026-56207 Signature of Bearer token is not verified in last step of SAML2 authentication f... |
critical | 9.8 | — | Apache / impala | 2026-09-09 | 2026-09-10 |
| CVE-2026-91864 A specially crafted WS-Policy document can pack unlimited content inside a polic... |
high | 7.5 | — | Apache / neethi | 2026-09-21 | 2026-09-25 |
| CVE-2026-91865 A small WS-Policy document using repeated policy references can force Neethi to... |
high | 7.5 | — | Apache / neethi | 2026-09-21 | 2026-09-25 |
| CVE-2026-91866 A specially crafted pair of WS-Policy documents can force Neethi's policy-inters... |
high | 7.5 | — | Apache / neethi | 2026-09-21 | 2026-09-25 |
| CVE-2026-91863 A specially crafted WS-Policy document with deeply nested policy elements can by... |
high | 7.5 | — | Apache / neethi | 2026-09-21 | 2026-09-24 |
| CVE-2026-87976 Apache NiFi Registry 0.4.0 through 2.11.0 are subject to path manipulation when... |
high | 8.1 | — | Apache / nifi | 2026-09-16 | 2026-09-21 |
| CVE-2026-86089 Apache NiFi 2.11.0 supports migrating the contents of a version-controlled Proce... |
high | 7.1 | — | Apache / nifi | 2026-09-16 | 2026-09-21 |
| CVE-2026-70469 Apache NiFi 2.11.0 disabled support for gzip-encoded HTTP requests for the appli... |
high | 7.5 | — | Apache / nifi | 2026-09-16 | 2026-09-21 |
| CVE-2026-74761 Improper input validation in TopicRegion in Apache ActiveMQ, Apache ActiveMQ Bro... |
high | 7.5 | — | Apache / activemq | 2026-09-09 | 2026-09-18 |
| CVE-2026-79993 The `deleteContainer` opcode (0x14/20) is processed without verifying the caller... |
high | 7.5 | — | Apache / zookeeper | 2026-09-16 | 2026-09-18 |
| CVE-2026-59739 Information disclosure via SetWatches reconnect replay in Apache ZooKeeper due t... |
high | 7.5 | — | Apache / zookeeper | 2026-09-16 | 2026-09-18 |
| CVE-2026-59969 Apache ZooKeeper quorum TLS fails to enforce peer hostname verification in FIPS-... |
high | 7.5 | — | Apache / zookeeper | 2026-09-16 | 2026-09-18 |
| CVE-2026-86792 Apache Airflow Apache Kafka provider versions 1.15.0 before 2.0.0 resolve dotted... |
high | 8.8 | — | Apache / apache-airflow-providers-apache-kafka | 2026-09-16 | 2026-09-18 |
| CVE-2026-86466 Apache Airflow FAB provider: the Authentik OAuth path in the FAB auth manager do... |
high | 8.1 | — | Apache / apache-airflow-providers-fab | 2026-09-16 | 2026-09-18 |
| CVE-2026-82310 Apache Airflow FAB provider: deactivating a user account does not stop tokens is... |
high | 7.2 | — | Apache / apache-airflow-providers-fab | 2026-09-16 | 2026-09-18 |
| CVE-2026-67211 OOM Denial of Service via Unbounded Map Pre-Sizing in Apache OpenNLP SymSpellMod... |
high | 7.5 | — | Apache / opennlp | 2026-09-11 | 2026-09-16 |
| CVE-2026-49362 An unauthenticated remote attacker can create arbitrary durable queues via the C... |
high | 7.5 | — | Apache / artemis | 2026-09-10 | 2026-09-16 |
| CVE-2026-49363 An unauthenticated remote attacker connecting with the CORE protocol can discove... |
high | 7.5 | — | Apache / artemis | 2026-09-10 | 2026-09-16 |
| CVE-2026-80354 Authorization bypass through User-Controlled key vulnerability in Apache Camel K... |
high | 8.1 | — | Apache / camel | 2026-09-10 | 2026-09-14 |
| CVE-2026-41870 Missing Authorization, Improper Control of Generation of Code ('Code Injection')... |
high | 8.8 | — | Apache / nutch | 2026-09-09 | 2026-09-11 |
| CVE-2026-57866 Server side request forgery in Apache Impala versions 4.4.x and 4.5.x. |
high | 8.8 | — | Apache / impala | 2026-09-09 | 2026-09-10 |
| CVE-2026-65181 Insufficient authorization of Data Source tables in Impala 2.7-4.5 allows a clie... |
high | 8.1 | — | Apache / impala | 2026-09-09 | 2026-09-10 |
| CVE-2026-73334 Potential problem for users of the org.apache.parquet.crypto.keytools package in... |
high | 8.1 | — | Apache / parquet | 2026-09-09 | 2026-09-10 |
| CVE-2026-78254 The ftp and scp tasks of Apache Ant can download files from a remote server. |
high | 7.4 | — | Apache / ant | 2026-09-07 | 2026-09-09 |
| CVE-2026-73192 An improper neutralization of input during web page generation ('Cross-site Scri... |
medium | 6.1 | — | Apache / sling xss protection api | 2026-09-23 | 2026-09-30 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.