September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,826
Low
527
Severity not reported
2,544
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), apache (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-91863 A specially crafted WS-Policy document with deeply nested policy elements can by... |
high | 7.5 | — | Apache / neethi | 2026-09-21 | 2026-09-24 |
| CVE-2026-91864 A specially crafted WS-Policy document can pack unlimited content inside a polic... |
high | 7.5 | — | Apache / neethi | 2026-09-21 | 2026-09-25 |
| CVE-2026-91865 A small WS-Policy document using repeated policy references can force Neethi to... |
high | 7.5 | — | Apache / neethi | 2026-09-21 | 2026-09-25 |
| CVE-2026-87976 Apache NiFi Registry 0.4.0 through 2.11.0 are subject to path manipulation when... |
high | 8.1 | — | Apache / nifi | 2026-09-16 | 2026-09-21 |
| CVE-2026-86089 Apache NiFi 2.11.0 supports migrating the contents of a version-controlled Proce... |
high | 7.1 | — | Apache / nifi | 2026-09-16 | 2026-09-21 |
| CVE-2026-70469 Apache NiFi 2.11.0 disabled support for gzip-encoded HTTP requests for the appli... |
high | 7.5 | — | Apache / nifi | 2026-09-16 | 2026-09-21 |
| CVE-2026-86792 Apache Airflow Apache Kafka provider versions 1.15.0 before 2.0.0 resolve dotted... |
high | 8.8 | — | Apache / apache-airflow-providers-apache-kafka | 2026-09-16 | 2026-09-18 |
| CVE-2026-86466 Apache Airflow FAB provider: the Authentik OAuth path in the FAB auth manager do... |
high | 8.1 | — | Apache / apache-airflow-providers-fab | 2026-09-16 | 2026-09-18 |
| CVE-2026-79993 The `deleteContainer` opcode (0x14/20) is processed without verifying the caller... |
high | 7.5 | — | Apache / zookeeper | 2026-09-16 | 2026-09-18 |
| CVE-2026-82310 Apache Airflow FAB provider: deactivating a user account does not stop tokens is... |
high | 7.2 | — | Apache / apache-airflow-providers-fab | 2026-09-16 | 2026-09-18 |
| CVE-2026-59739 Information disclosure via SetWatches reconnect replay in Apache ZooKeeper due t... |
high | 7.5 | — | Apache / zookeeper | 2026-09-16 | 2026-09-18 |
| CVE-2026-59969 Apache ZooKeeper quorum TLS fails to enforce peer hostname verification in FIPS-... |
high | 7.5 | — | Apache / zookeeper | 2026-09-16 | 2026-09-18 |
| CVE-2026-67211 OOM Denial of Service via Unbounded Map Pre-Sizing in Apache OpenNLP SymSpellMod... |
high | 7.5 | — | Apache / opennlp | 2026-09-11 | 2026-09-16 |
| CVE-2026-80354 Authorization bypass through User-Controlled key vulnerability in Apache Camel K... |
high | 8.1 | — | Apache / camel | 2026-09-10 | 2026-09-14 |
| CVE-2026-49363 An unauthenticated remote attacker connecting with the CORE protocol can discove... |
high | 7.5 | — | Apache / artemis | 2026-09-10 | 2026-09-16 |
| CVE-2026-49362 An unauthenticated remote attacker can create arbitrary durable queues via the C... |
high | 7.5 | — | Apache / artemis | 2026-09-10 | 2026-09-16 |
| CVE-2026-74761 Improper input validation in TopicRegion in Apache ActiveMQ, Apache ActiveMQ Bro... |
high | 7.5 | — | Apache / activemq | 2026-09-09 | 2026-09-18 |
| CVE-2026-65181 Insufficient authorization of Data Source tables in Impala 2.7-4.5 allows a clie... |
high | 8.1 | — | Apache / impala | 2026-09-09 | 2026-09-10 |
| CVE-2026-73334 Potential problem for users of the org.apache.parquet.crypto.keytools package in... |
high | 8.1 | — | Apache / parquet | 2026-09-09 | 2026-09-10 |
| CVE-2026-41870 Missing Authorization, Improper Control of Generation of Code ('Code Injection')... |
high | 8.8 | — | Apache / nutch | 2026-09-09 | 2026-09-11 |
| CVE-2026-57866 Server side request forgery in Apache Impala versions 4.4.x and 4.5.x. |
high | 8.8 | — | Apache / impala | 2026-09-09 | 2026-09-10 |
| CVE-2026-78254 The ftp and scp tasks of Apache Ant can download files from a remote server. |
high | 7.4 | — | Apache / ant | 2026-09-07 | 2026-09-09 |
| CVE-2026-92899 Apache WSS4J remembers the Nonce of each UsernameToken it accepts, so a captured... |
medium | 4.8 | — | Apache / wss4j | 2026-09-30 | 2026-10-02 |
| CVE-2026-66083 The /datasources/unauth-datasource endpoint does not properly enforce data sourc... |
medium | 6.5 | — | Apache / dolphinscheduler | 2026-09-29 | 2026-10-06 |
| CVE-2026-81862 Apache Airflow's Teradata provider embedded cloud storage credentials directly i... |
medium | 6.5 | — | Apache / apache-airflow-providers-teradata | 2026-09-29 | 2026-10-07 |
| CVE-2026-81914 Apache Airflow's Google provider built Google Drive search expressions by interp... |
medium | 4.3 | — | Apache / apache-airflow-providers-google | 2026-09-29 | 2026-10-07 |
| CVE-2026-81930 Apache Airflow's Snowflake provider did not validate the connection's `account`... |
medium | 6.3 | — | Apache / apache-airflow-providers-snowflake | 2026-09-29 | 2026-10-07 |
| CVE-2026-86843 The Apache Airflow Teradata provider's compute-cluster example Dag declared ever... |
medium | 6.3 | — | Apache / apache-airflow-providers-teradata | 2026-09-29 | 2026-10-07 |
| CVE-2026-91085 Apache Karaf's shell/SSH command security is enforced by per-scope ACL configura... |
medium | 6.3 | — | Apache / karaf | 2026-09-29 | 2026-10-07 |
| CVE-2026-92573 Improper handling of compressed data in the shared GZIP decompressor used for AM... |
medium | 6.5 | — | Apache / qpid broker-j | 2026-09-25 | 2026-10-05 |
| CVE-2026-91928 Improper neutralization of input during web page generation ('cross-site scripti... |
medium | 6.1 | — | Apache / sling xss protection api | 2026-09-23 | 2026-09-30 |
| CVE-2026-91999 Improper neutralization of input during web page generation ('cross-site scripti... |
medium | 6.1 | — | Apache / sling xss protection api | 2026-09-23 | 2026-09-30 |
| CVE-2026-92001 Improper restriction of recursive entity references in DTDs ('XML entity expansi... |
medium | 6.1 | — | Apache / sling xss protection api | 2026-09-23 | 2026-09-30 |
| CVE-2026-94251 A vulnerability in Apache Sling Security Bundle: ContentDispositionFilter mediat... |
medium | 6.5 | — | Apache / sling security | 2026-09-23 | 2026-10-06 |
| CVE-2026-73192 An improper neutralization of input during web page generation ('Cross-site Scri... |
medium | 6.1 | — | Apache / sling xss protection api | 2026-09-23 | 2026-09-30 |
| CVE-2026-91852 Improper neutralization of input during web page generation ('cross-site scripti... |
medium | 6.1 | — | Apache / sling xss protection api | 2026-09-23 | 2026-09-30 |
| CVE-2026-82355 When a request to the Airflow core API carries both a session cookie and an expl... |
medium | 4.2 | — | Apache / airflow | 2026-09-21 | 2026-09-25 |
| CVE-2026-75158 Apache Airflow's `/assets/events` API returned asset events for every Dag in the... |
medium | 4.3 | — | Apache / airflow | 2026-09-21 | 2026-09-25 |
| CVE-2026-91867 When Neethi fetches a remote policy reference, it only limits the time per read,... |
medium | 4.3 | — | Apache / neethi | 2026-09-21 | 2026-09-25 |
| CVE-2026-81866 Apache NiFi 2.9.0 through 2.11.0 provide Connector configuration update and veri... |
medium | 4.3 | — | Apache / nifi | 2026-09-16 | 2026-09-21 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.