September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,828
Low
527
Severity not reported
2,542
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), linux (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-56914 In multiple locations, there is a possible use-after-free due to improper lockin... |
high | 8.4 | — | Google / android | 2026-09-15 | 2026-09-21 |
| CVE-2026-56920 In s_decode_vui_param of fw_hevc_dec_header.c, there is a possible out-of-bounds... |
high | 8.8 | — | Google / android | 2026-09-15 | 2026-09-21 |
| CVE-2026-56882 In Cellular Modem, there is a possible information disclosure due to a logic err... |
high | 8.8 | — | Google / android | 2026-09-15 | 2026-09-21 |
| CVE-2026-56881 In enable_segment of remap.c, there is a possible permission bypass due to a log... |
high | 8.4 | — | Google / android | 2026-09-15 | 2026-09-21 |
| CVE-2026-55306 In Cellular Modem, there is a possible denial of service due to improper input v... |
high | 7.5 | — | Google / android | 2026-09-15 | 2026-09-21 |
| CVE-2026-55318 In multiple locations, there is a possible use-after-free due to a race conditio... |
high | 8.8 | — | Google / android | 2026-09-15 | 2026-09-21 |
| CVE-2026-55323 In gf_base_update_finger_base of gf_base.c, there is a possible out-of-bounds wr... |
high | 7.8 | — | Google / android | 2026-09-15 | 2026-09-21 |
| CVE-2026-55331 In IP Multimedia Subsystem, there is a possible out-of-bounds write due to an in... |
high | 8.8 | — | Google / android | 2026-09-15 | 2026-09-21 |
| CVE-2026-55343 In decodeAmr of ImsMediaAudioPlayer.cpp, there is a possible out-of-bounds write... |
high | 8.0 | — | Google / android | 2026-09-15 | 2026-09-21 |
| CVE-2026-55351 In VPU, there is a possible out-of-bounds write due to an integer overflow. |
high | 7.8 | — | Google / android | 2026-09-15 | 2026-09-21 |
| CVE-2026-55359 In multiple locations, there is a possible permission bypass due to a logic erro... |
high | 7.8 | — | Google / android | 2026-09-15 | 2026-09-21 |
| CVE-2026-55301 In Wave6VpuDecFlush of wave6.c, there is a possible out-of-bounds write due to a... |
high | 8.4 | — | Google / android | 2026-09-15 | 2026-09-21 |
| CVE-2026-19885 OriginLab Origin Viewer OGWU File Parsing Out-Of-Bounds Write Remote Code Execut... |
high | 7.8 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-19886 OriginLab Origin Viewer OGM File Parsing Memory Corruption Remote Code Execution... |
high | 7.8 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-19774 BlueZ A2DP Stack-based Buffer Overflow Remote Code Execution Vulnerability. |
high | 7.1 | — | — | 2026-09-15 | 2026-09-18 |
| CVE-2026-19781 Ashlar-Vellum Cobalt VS File Parsing Heap-based Buffer Overflow Remote Code Exec... |
high | 7.8 | — | — | 2026-09-15 | 2026-09-18 |
| CVE-2026-0199 In gf_ta_test_set_config of gf_ta_test.c, there is a possible out-of-bounds writ... |
high | 7.8 | — | Google / android | 2026-09-15 | 2026-09-21 |
| CVE-2026-0200 In Cellular Modem, there is a possible out-of-bounds write due to a heap buffer... |
high | 8.8 | — | Google / android | 2026-09-15 | 2026-09-21 |
| CVE-2026-0171 In multiple locations, there is a possible out-of-bounds write due to a logic er... |
high | 8.8 | — | Google / android | 2026-09-15 | 2026-09-21 |
| CVE-2026-0189 In ac_init_policy of init.c, there is a possible permission bypass due to a logi... |
high | 8.4 | — | Google / android | 2026-09-15 | 2026-09-21 |
| CVE-2026-0194 In multiple locations, there is a possible permission bypass due to an integer o... |
high | 8.4 | — | Google / android | 2026-09-15 | 2026-09-21 |
| CVE-2026-0159 In Cellular Modem, there is a possible out-of-bounds write due to a missing boun... |
high | 8.8 | — | Google / android | 2026-09-15 | 2026-09-21 |
| CVE-2026-0170 In Vp9DecodeFrameTag of vp9hwd_headers.cc, there is a possible out-of-bounds wri... |
high | 8.8 | — | Google / android | 2026-09-15 | 2026-09-21 |
| CVE-2026-88765 GitLab has remediated an issue in GitLab EE affecting all versions from 12.3 to... |
high | 8.5 | — | Gitlab / gitlab | 2026-09-15 | 2026-09-28 |
| CVE-2026-85234 A flaw was found in tftp-hpa. |
high | 7.5 | — | — | 2026-09-15 | 2026-10-13 |
| CVE-2026-61668 DIRAC is an interware, meaning a software framework for distributed computing. |
high | 8.1 | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-58485 mcp-searxng is a Model Context Protocol server that gives AI assistants web sear... |
high | 7.1 | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-58483 mcp-searxng is a Model Context Protocol server that gives AI assistants web sear... |
high | 7.5 | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-56825 Shopper is a Headless e-commerce Admin Panel. |
high | 8.1 | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-56827 Shopper is a Headless e-commerce Admin Panel. |
high | 8.1 | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-56829 Shopper is a Headless e-commerce Admin Panel. |
high | 8.1 | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-54549 Meta Ads MCP is a Model Context Protocol (MCP) server that lets AI assistants ru... |
high | 8.3 | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-55225 Strimzi provides a way to run an Apache Kafka cluster on Kubernetes or OpenShift... |
high | 8.0 | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-52484 An issue in MitraStar GPT-2742GX4X5v6-SV GL_g2.5_100XNT0b23_3 allows an authenti... |
high | 8.8 | — | — | 2026-09-15 | 2026-09-22 |
| CVE-2026-54547 Meta Ads MCP is a Model Context Protocol (MCP) server that lets AI assistants ru... |
high | 7.4 | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-40058 CrowdStrike released a security update to address a vulnerability in the Falcon... |
high | 8.8 | — | — | 2026-09-15 | 2026-09-18 |
| CVE-2026-13210 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.7... |
high | 7.7 | — | Gitlab / gitlab | 2026-09-15 | 2026-09-28 |
| CVE-2026-12752 IBM Business Automation Workflow containers and traditional is vulnerable to an... |
high | 7.1 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-12358 IBM Verify Identity Access could allow a remote attacker to cause a denial of se... |
high | 7.5 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-12666 IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 throu... |
high | 8.1 | — | — | 2026-09-15 | 2026-09-17 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.