September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,826
Low
527
Severity not reported
2,544
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), apache (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-82561 Apache NiFi 1.5.0 through 2.11.0 provide REST API methods that replace the entir... |
medium | 6.5 | — | Apache / nifi | 2026-09-16 | 2026-09-21 |
| CVE-2026-84439 When audit logging is enabled (zookeeper.audit.enable=true), an unauthenticated... |
medium | 5.3 | — | Apache / zookeeper | 2026-09-16 | 2026-09-18 |
| CVE-2026-84501 An unauthenticated attacker can inject arbitrary fake log lines into Apache ZooK... |
medium | 5.3 | — | Apache / zookeeper | 2026-09-16 | 2026-09-18 |
| CVE-2026-86465 Apache Airflow Akeyless provider: the Akeyless secrets backend's team-scope guar... |
medium | 6.5 | — | Apache / apache-airflow-providers-akeyless | 2026-09-16 | 2026-09-17 |
| CVE-2026-57822 When the broker is processing message-based management requests, sent by an auth... |
medium | 6.5 | — | Apache / artemis | 2026-09-10 | 2026-09-16 |
| CVE-2026-75880 An authenticated client could attach a consumer with a selector containing craft... |
medium | 6.5 | — | Apache / artemis | 2026-09-10 | 2026-09-18 |
| CVE-2026-54048 Specifying tblproperties('avro.schema.url'=' http://...' ) or with a 'file:///'... |
medium | 5.3 | — | Apache / impala | 2026-09-09 | 2026-09-10 |
| CVE-2026-32773 There is a lack of XSS escaping in the Spark History Server prior to 3.5.8 which... |
medium | 6.1 | — | Apache / spark | 2026-09-02 | 2026-09-08 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.