September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,826
Low
527
Severity not reported
2,544
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), apache (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-89238 WSS4J EncryptedHeader child confusion could promote an attacker-controlled plain... |
critical | 9.1 | — | Apache / wss4j | 2026-09-30 | 2026-10-06 |
| CVE-2026-87830 In the StAX streaming WS-SecurityPolicy validator, certain relative or unsupport... |
critical | 9.1 | — | Apache / wss4j | 2026-09-30 | 2026-10-06 |
| CVE-2026-88920 An authentication bypass in the DOM security processor in Apache WSS4J allows un... |
critical | 9.8 | — | Apache / wss4j | 2026-09-30 | 2026-10-02 |
| CVE-2026-91048 The jdbc shell command scope shipped no org.apache.karaf.command.acl.jdbc.cfg. |
critical | 9.8 | — | Apache / karaf | 2026-09-29 | 2026-10-07 |
| CVE-2026-91012 org.apache.karaf.config.core.impl.ConfigRepositoryImpl#update(pid, properties),... |
critical | 9.8 | — | Apache / karaf | 2026-09-29 | 2026-10-07 |
| CVE-2026-92609 Session fixation in HTTP management authentication allows remote attackers to ga... |
critical | 9.8 | — | Apache / qpid broker-j | 2026-09-25 | 2026-10-05 |
| CVE-2026-86246 Initialization of a resource with an insecure default vulnerability in Apache To... |
critical | 9.1 | — | Apache / tomcat native | 2026-09-23 | 2026-10-06 |
| CVE-2026-86473 Apache Airflow: the Core API logout endpoint revokes only a session token presen... |
critical | 9.1 | — | Apache / airflow | 2026-09-21 | 2026-09-25 |
| CVE-2026-76186 Apache Airflow Keycloak provider: from Airflow 3.3 the Keycloak auth manager tak... |
critical | 9.1 | — | Apache / apache-airflow-providers-keycloak | 2026-09-16 | 2026-09-18 |
| CVE-2026-76187 Apache Airflow Keycloak provider: the unauthenticated token endpoint accepts a c... |
critical | 9.8 | — | Apache / apache-airflow-providers-keycloak | 2026-09-16 | 2026-09-18 |
| CVE-2026-86462 Apache Airflow FAB provider: changing a user's password through the Admin user-e... |
critical | 9.1 | — | Apache / apache-airflow-providers-fab | 2026-09-16 | 2026-09-18 |
| CVE-2026-82311 Apache Airflow FAB provider: resetting a user's password does not delete that us... |
critical | 9.8 | — | Apache / apache-airflow-providers-fab | 2026-09-16 | 2026-09-18 |
| CVE-2026-82617 The two built-in name-finder patterns exposed by
opennlp.tools.namefind.RegexNam... |
critical | 9.8 | — | Apache / opennlp | 2026-09-11 | 2026-09-16 |
| CVE-2026-80352 Improper Control of Generation of Code ('Code Injection') vulnerability in Apach... |
critical | 9.8 | — | Apache / camel | 2026-09-10 | 2026-09-14 |
| CVE-2026-80351 Improper neutralization of directives in dynamically evaluated code ('eval injec... |
critical | 9.8 | — | Apache / camel | 2026-09-10 | 2026-09-14 |
| CVE-2026-84939 Path traversal vulnerability in Apache FreeMarker template loading mechanism, if... |
critical | 9.1 | — | Apache / freemarker | 2026-09-10 | 2026-09-11 |
| CVE-2026-49364 An unauthenticated network-adjacent attacker can leverage discovery to capture c... |
critical | 9.1 | — | Apache / artemis | 2026-09-10 | 2026-09-16 |
| CVE-2026-57967 An unauthenticated remote attacker can craft a CORE protocol SESSION_REATTACH pa... |
critical | 9.8 | — | Apache / artemis | 2026-09-10 | 2026-10-09 |
| CVE-2026-67593 A remote attacker can craft an Openwire RemoveSubscriptionInfo command to cause... |
critical | 9.1 | — | Apache / artemis | 2026-09-10 | 2026-09-16 |
| CVE-2026-41869 Missing Authorization, Improper Resource Shutdown and Job Interruption vulnerabi... |
critical | 9.1 | — | Apache / nutch | 2026-09-09 | 2026-09-10 |
| CVE-2026-41871 Missing Authorization, Use of Externally-Controlled Input to Select Classes or C... |
critical | 9.8 | — | Apache / nutch | 2026-09-09 | 2026-09-10 |
| CVE-2026-56207 Signature of Bearer token is not verified in last step of SAML2 authentication f... |
critical | 9.8 | — | Apache / impala | 2026-09-09 | 2026-09-10 |
| CVE-2026-75156 Apache Airflow FAB provider versions 3.7.3 through 3.8.0 do not validate the iss... |
critical | 9.1 | — | Apache / apache-airflow-providers-fab | 2026-09-08 | 2026-09-18 |
| CVE-2026-95616 An integer overflow in WSS4J's DER bounds check lets an oversized allocation pas... |
high | 7.5 | — | Apache / wss4j | 2026-09-30 | 2026-10-06 |
| CVE-2026-92121 In the WSS4J streaming (StAX) code, a signature reference using the WS-Security... |
high | 7.5 | — | Apache / wss4j | 2026-09-30 | 2026-10-06 |
| CVE-2026-85532 Apache WSS4J accepted attacker-controlled derived-key lengths and offsets withou... |
high | 7.5 | — | Apache / wss4j | 2026-09-30 | 2026-10-02 |
| CVE-2026-102495 Apache XmlSchema doesn't limit how deeply schema imports and includes can be nes... |
high | 7.5 | — | Apache / xmlschema | 2026-09-29 | 2026-10-06 |
| CVE-2026-102496 Apache XmlSchema doesn't limit how deeply schema structures can be nested when i... |
high | 7.5 | — | Apache / xmlschema | 2026-09-29 | 2026-10-06 |
| CVE-2026-102497 The Apache XmlSchema walker (xmlschema-walker) doesn't detect cycles in type der... |
high | 7.5 | — | Apache / xmlschema | 2026-09-29 | 2026-10-06 |
| CVE-2026-92142 Apache Karaf exposes a JMX MBeanServer guarded by KarafMBeanServerGuard, which e... |
high | 8.8 | — | Apache / karaf | 2026-09-29 | 2026-10-07 |
| CVE-2026-91006 Apache Karaf's instance-management service (InstanceServiceImpl) builds the comm... |
high | 8.8 | — | Apache / karaf | 2026-09-28 | 2026-10-08 |
| CVE-2026-90979 LDAPCache and LDAPBackingEngine build LDAP search filters for user lookup and ro... |
high | 7.3 | — | Apache / karaf | 2026-09-28 | 2026-10-08 |
| CVE-2026-92550 A pre-authentication attacker could leverage type size/count handling to cause e... |
high | 7.5 | — | Apache / qpid broker-j | 2026-09-25 | 2026-10-05 |
| CVE-2026-92560 A pre-authentication attacker could leverage type size/count handling to cause e... |
high | 7.5 | — | Apache / qpid broker-j | 2026-09-25 | 2026-10-05 |
| CVE-2026-92564 A pre-authentication attacker could leverage type nesting to cause a StackOverfl... |
high | 7.5 | — | Apache / qpid broker-j | 2026-09-25 | 2026-10-05 |
| CVE-2026-92608 Improper handling of property-encoding exceptions in AMQP 1.0-to-AMQP 0-10 messa... |
high | 7.5 | — | Apache / qpid broker-j | 2026-09-25 | 2026-10-05 |
| CVE-2026-86247 Race condition within a thread vulnerability in Apache Tomcat Native allowed cli... |
high | 7.4 | — | Apache / tomcat native | 2026-09-23 | 2026-10-06 |
| CVE-2026-86243 Buffer over-read vulnerability in Apache Tomcat Native during the TLS handshake... |
high | 7.5 | — | Apache / tomcat native | 2026-09-23 | 2026-10-06 |
| CVE-2026-94243 A vulnerability in Apache Sling Security Bundle: the ReferrerFilter accepts weak... |
high | 7.3 | — | Apache / sling security | 2026-09-23 | 2026-10-06 |
| CVE-2026-91866 A specially crafted pair of WS-Policy documents can force Neethi's policy-inters... |
high | 7.5 | — | Apache / neethi | 2026-09-21 | 2026-09-25 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.