September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,826
Low
527
Severity not reported
2,544
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), apache (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2025-14753 IBM Cloud Pak for Data 5.1.2 could allow a remote attacker to traverse directori... |
high | 7.5 | — | Ibm / cloud pak for data | 2026-09-18 | 2026-10-14 |
| CVE-2025-14754 IBM Cloud Pak for Data 5.1.2 could allow an authenticated user to execute arbitr... |
high | 8.8 | — | Ibm / cloud pak for data | 2026-09-18 | 2026-10-14 |
| CVE-2026-16673 IBM DataStage on Cloud Pak for Data 5.4.0.0 IBM DataStage could allow a remote a... |
high | 8.8 | — | Ibm / datastage on cloud pak for data | 2026-09-14 | 2026-10-06 |
| CVE-2026-16335 IBM DataStage on Cloud Pak for Data 5.4.0.0 IBM DataStage could allow a remote a... |
high | 8.8 | — | Ibm / datastage on cloud pak for data | 2026-09-14 | 2026-10-06 |
| CVE-2026-16338 IBM DataStage on Cloud Pak for Data 5.4.0.0 IBM DataStage could allow a remote a... |
high | 8.8 | — | Ibm / datastage on cloud pak for data | 2026-09-14 | 2026-10-06 |
| CVE-2026-16428 IBM DataStage on Cloud Pak for Data 5.4.0.0 IBM DataStage could allow a remote a... |
high | 8.8 | — | Ibm / datastage on cloud pak for data | 2026-09-14 | 2026-10-06 |
| CVE-2026-16466 IBM DataStage on Cloud Pak for Data 5.4.0.0 IBM DataStage could allow a remote a... |
high | 8.8 | — | Ibm / datastage on cloud pak for data | 2026-09-14 | 2026-10-06 |
| CVE-2026-86093 IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 could allow an attacker... |
high | 7.5 | — | Ibm / db2 | 2026-09-10 | 2026-09-14 |
| CVE-2026-87958 IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to a deni... |
high | 8.1 | — | Ibm / db2 | 2026-09-10 | 2026-09-14 |
| CVE-2026-82095 IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated a... |
high | 8.8 | — | Ibm / datastage on cloud pak for data | 2026-09-10 | 2026-09-16 |
| CVE-2026-82097 IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated a... |
high | 8.8 | — | Ibm / datastage on cloud pak for data | 2026-09-10 | 2026-09-16 |
| CVE-2026-82098 IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated a... |
high | 8.8 | — | Ibm / datastage on cloud pak for data | 2026-09-10 | 2026-09-16 |
| CVE-2026-82099 IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated a... |
high | 8.8 | — | Ibm / datastage on cloud pak for data | 2026-09-10 | 2026-09-16 |
| CVE-2026-81540 IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated a... |
high | 8.5 | — | Ibm / datastage on cloud pak for data | 2026-09-10 | 2026-09-16 |
| CVE-2026-81550 IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated a... |
high | 8.8 | — | Ibm / datastage on cloud pak for data | 2026-09-10 | 2026-09-16 |
| CVE-2026-81551 IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated a... |
high | 8.1 | — | Ibm / datastage on cloud pak for data | 2026-09-10 | 2026-09-16 |
| CVE-2026-80380 IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote attacker to per... |
high | 7.1 | — | Ibm / datastage on cloud pak for data | 2026-09-10 | 2026-09-16 |
| CVE-2026-80436 IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated a... |
high | 8.5 | — | Ibm / datastage on cloud pak for data | 2026-09-10 | 2026-09-16 |
| CVE-2026-81207 IBM DataStage on Cloud Pak for Data 5.4.0.0 allows any authenticated tenant — wi... |
high | 8.5 | — | Ibm / datastage on cloud pak for data | 2026-09-10 | 2026-09-16 |
| CVE-2026-81210 IBM DataStage on Cloud Pak for Data 5.4.0.0 concatenates three caller-supplied s... |
high | 7.7 | — | Ibm / datastage on cloud pak for data | 2026-09-10 | 2026-09-16 |
| CVE-2026-75624 IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, and 12.0.1.0 through 12.0.... |
high | 8.8 | — | Ibm / app connect enterprise | 2026-09-10 | 2026-09-16 |
| CVE-2026-9176 IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to a security bypass... |
high | 7.1 | — | Ibm / websphere application server | 2026-09-10 | 2026-09-15 |
| CVE-2026-9327 IBM WebSphere Application Server 9.0, and 8.5 could allow an authenticated user... |
high | 8.1 | — | Ibm / websphere application server | 2026-09-10 | 2026-09-15 |
| CVE-2026-9336 IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to a denial of servi... |
high | 7.5 | — | Ibm / websphere application server | 2026-09-10 | 2026-09-16 |
| CVE-2026-18175 IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to manipulate databas... |
high | 7.5 | — | Ibm / i | 2026-09-04 | 2026-09-10 |
| CVE-2026-18341 IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to corr... |
high | 8.8 | — | Ibm / i | 2026-09-04 | 2026-09-08 |
| CVE-2026-18486 IBM ContextForge MCP Gateway <= v1.0.7 MCP Context Forge could allow a remote au... |
high | 8.8 | — | Ibm / contextforge | 2026-09-04 | 2026-09-15 |
| CVE-2026-18489 IBM ContextForge MCP Gateway - Translate utility <= 1.0.8 MCP Context Forge coul... |
high | 7.4 | — | Ibm / contextforge | 2026-09-04 | 2026-09-15 |
| CVE-2026-17470 IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of... |
high | 7.5 | — | Ibm / i | 2026-09-04 | 2026-09-09 |
| CVE-2026-17499 IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local attacker to execute arbitrary c... |
high | 7.8 | — | Ibm / i | 2026-09-04 | 2026-09-09 |
| CVE-2026-17255 IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of... |
high | 7.5 | — | Ibm / i | 2026-09-04 | 2026-09-10 |
| CVE-2026-16826 IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local attacker to execute arbitrary c... |
high | 7.8 | — | Ibm / i | 2026-09-04 | 2026-09-10 |
| CVE-2026-78543 IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, and 12.0.1.0 through 12.0.... |
high | 7.5 | — | Ibm / app connect enterprise | 2026-09-04 | 2026-09-09 |
| CVE-2026-18905 IBM ContextForge MCP Gateway (`mcp-contextforge-gateway`) <= v1.0.6 MCP Context... |
high | 7.7 | — | Ibm / contextforge | 2026-09-04 | 2026-09-15 |
| CVE-2026-81832 IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, and 12.0.1.0 through 12.0.... |
high | 7.7 | — | Ibm / app connect enterprise | 2026-09-04 | 2026-09-08 |
| CVE-2026-8862 IBM Netezza Software 11.3.0.3 through Interim Fix 002 has credentials that are h... |
high | 7.5 | — | Ibm / netezza performance server | 2026-09-03 | 2026-09-10 |
| CVE-2026-84882 IBM Guardium Data Protection 12.2 is vulnerable to path traversal in the Univers... |
medium | 6.5 | — | Ibm / guardium data protection | 2026-09-25 | 2026-10-20 |
| CVE-2026-84893 IBM Guardium Data Protection 12.2 is vulnerable to SQL injection in the PESI ser... |
medium | 6.5 | — | Ibm / guardium data protection | 2026-09-25 | 2026-10-20 |
| CVE-2026-77825 IBM ContextForge MCP Gateway 1.0.0 through 1.0.8 was vulnerable to path traversa... |
medium | 4.9 | — | Ibm / contextforge | 2026-09-24 | 2026-09-29 |
| CVE-2026-6544 IBM Concert 1.0.0 through 3.0.0 allows recursive copying of directories without... |
medium | 6.2 | — | Ibm / concert | 2026-09-24 | 2026-09-28 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.