September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,828
Low
527
Severity not reported
2,542
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), linux (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-98080 In the Linux kernel, the following vulnerability has been resolved:
btrfs: do n... |
medium | 5.5 | — | Linux / linux kernel | 2026-09-25 | 2026-10-19 |
| CVE-2026-98082 In the Linux kernel, the following vulnerability has been resolved:
btrfs: fix... |
medium | 5.5 | — | Linux / linux kernel | 2026-09-25 | 2026-10-19 |
| CVE-2026-98062 In the Linux kernel, the following vulnerability has been resolved:
bpf: Mark s... |
medium | 5.5 | — | Linux / linux kernel | 2026-09-25 | 2026-10-21 |
| CVE-2026-98051 In the Linux kernel, the following vulnerability has been resolved:
net: bcmasp... |
medium | 5.5 | — | Linux / linux kernel | 2026-09-25 | 2026-10-19 |
| CVE-2026-98053 In the Linux kernel, the following vulnerability has been resolved:
ASoC: Intel... |
medium | 5.5 | — | Linux / linux kernel | 2026-09-25 | 2026-10-21 |
| CVE-2026-98054 In the Linux kernel, the following vulnerability has been resolved:
ASoC: Intel... |
medium | 5.5 | — | Linux / linux kernel | 2026-09-25 | 2026-10-19 |
| CVE-2026-98059 In the Linux kernel, the following vulnerability has been resolved:
bpf: Mark s... |
medium | 5.5 | — | Linux / linux kernel | 2026-09-25 | 2026-10-29 |
| CVE-2026-98049 In the Linux kernel, the following vulnerability has been resolved:
bpf: zero e... |
medium | 5.5 | — | Linux / linux kernel | 2026-09-25 | 2026-10-21 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.