September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,828
Low
527
Severity not reported
2,542
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), linux (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-13293 IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 throu... |
high | 8.8 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-13260 IBM Verify Identity Access could allow a remote attacker to cause a denial of se... |
high | 7.5 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-13275 IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 throu... |
high | 7.1 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-13285 IBM MQ is vulnerable to an XML external entity injection (XXE) attack when proce... |
high | 7.1 | — | — | 2026-09-14 | 2026-09-18 |
| CVE-2026-13287 IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 throu... |
high | 7.1 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-13107 IBM Business Automation Workflow containers and traditional may use programming... |
high | 7.1 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-82028 Magistrala before 1.0.0 contains a SQL injection vulnerability in the timescale-... |
high | 8.8 | — | — | 2026-09-14 | 2026-09-23 |
| CVE-2026-73496 MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (C... |
high | 7.7 | — | — | 2026-09-14 | 2026-09-30 |
| CVE-2026-65838 Skipper is an HTTP router and reverse proxy for service composition. |
high | 8.2 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-54632 SIPSorcery is a WebRTC, SIP, and VoIP library for C# and .NET. |
high | 7.5 | — | — | 2026-09-14 | 2026-09-30 |
| CVE-2026-54447 garminconnect is a Python 3 API wrapper for Garmin Connect that retrieves statis... |
high | 8.4 | — | — | 2026-09-14 | 2026-09-30 |
| CVE-2026-54628 Anyquery is an SQL query engine built on top of SQLite. |
high | 8.6 | — | — | 2026-09-14 | 2026-09-30 |
| CVE-2026-54629 Anyquery is an SQL query engine built on top of SQLite. |
high | 7.5 | — | — | 2026-09-14 | 2026-09-30 |
| CVE-2026-47253 Anyquery is an SQL query engine built on top of SQLite. |
high | 7.3 | — | — | 2026-09-14 | 2026-09-30 |
| CVE-2026-19624 A flaw was found in NetworkManager-l2tp. |
high | 7.8 | — | — | 2026-09-14 | 2026-09-18 |
| CVE-2026-19816 A flaw was found in PackageKit. |
high | 7.1 | — | — | 2026-09-14 | 2026-09-18 |
| CVE-2026-17467 IBM Cloud Pak for Data System (Yosemite 1.0) 3.0.5.2 could allow a remote attack... |
high | 8.2 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-16673 IBM DataStage on Cloud Pak for Data 5.4.0.0 IBM DataStage could allow a remote a... |
high | 8.8 | — | Ibm / datastage on cloud pak for data | 2026-09-14 | 2026-10-06 |
| CVE-2026-17133 IBM App Connect Enterprise 13.0.1.0 through 13.0.8.0, and 12.0.1.0 through 12.0.... |
high | 7.8 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-17156 IBM App Connect Enterprise 13.0.1.0 through 13.0.8.0, and 12.0.1.0 through 12.0.... |
high | 7.8 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-17416 IBM App Connect Enterprise 13.0.1.0 through 13.0.8.0, and 12.0.1.0 through 12.0.... |
high | 7.8 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-16335 IBM DataStage on Cloud Pak for Data 5.4.0.0 IBM DataStage could allow a remote a... |
high | 8.8 | — | Ibm / datastage on cloud pak for data | 2026-09-14 | 2026-10-06 |
| CVE-2026-16338 IBM DataStage on Cloud Pak for Data 5.4.0.0 IBM DataStage could allow a remote a... |
high | 8.8 | — | Ibm / datastage on cloud pak for data | 2026-09-14 | 2026-10-06 |
| CVE-2026-16428 IBM DataStage on Cloud Pak for Data 5.4.0.0 IBM DataStage could allow a remote a... |
high | 8.8 | — | Ibm / datastage on cloud pak for data | 2026-09-14 | 2026-10-06 |
| CVE-2026-16466 IBM DataStage on Cloud Pak for Data 5.4.0.0 IBM DataStage could allow a remote a... |
high | 8.8 | — | Ibm / datastage on cloud pak for data | 2026-09-14 | 2026-10-06 |
| CVE-2026-15955 IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 could allow a remote at... |
high | 7.5 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-90809 A vulnerability was identified in HKUDS nanobot up to 0.2.1. |
high | 7.3 | — | — | 2026-09-14 | 2026-09-15 |
| CVE-2026-89023 ThemeAtelier Domain For Sale plugin for WordPress before 3.5.2 contains a missin... |
high | 8.6 | — | — | 2026-09-14 | 2026-09-14 |
| CVE-2026-86830 Incorrect privilege assignment in Temporary Elevated Access Management (TEAM) fo... |
high | 7.2 | — | — | 2026-09-14 | 2026-10-20 |
| CVE-2026-82035 PyMuPDF through 1.28.2, fixed in commit b2c8f3a, contains a path traversal vulne... |
high | 7.1 | — | — | 2026-09-14 | 2026-09-24 |
| CVE-2026-90946 DeepWiki-Open through commit d92819a contains an arbitrary file read vulnerabili... |
high | 7.5 | — | — | 2026-09-14 | 2026-09-23 |
| CVE-2026-91079 Huly Platform through 0.7.426 contains a server-side request forgery vulnerabili... |
high | 8.5 | — | — | 2026-09-14 | 2026-09-24 |
| CVE-2026-91080 webhook through 2.8.3 reads the entire request body into memory before evaluatin... |
high | 7.5 | — | — | 2026-09-14 | 2026-09-23 |
| CVE-2026-90944 Krayin CRM through 2.2.6 exposes the POST /admin/mail/inbound-parse endpoint wit... |
high | 8.2 | — | — | 2026-09-14 | 2026-09-24 |
| CVE-2026-90805 A flaw has been found in subhajitkhan online-clinic-management-system up to e9ee... |
high | 7.3 | — | — | 2026-09-14 | 2026-09-15 |
| CVE-2026-85921 Double free in Windows Secure Kernel Mode allows an authorized attacker to eleva... |
high | 8.2 | — | Microsoft / windows 11 26h1 | 2026-09-14 | 2026-09-29 |
| CVE-2026-85892 Concurrent execution using shared resource with improper synchronization ('race... |
high | 7.8 | — | Microsoft / edge chromium | 2026-09-14 | 2026-09-25 |
| CVE-2026-73494 blaze is a Scala library for building asynchronous pipelines, with a focus on ne... |
high | 7.4 | — | — | 2026-09-14 | 2026-09-30 |
| CVE-2026-70658 Pay is a payments engine for Ruby on Rails 6.0 and higher. |
high | 7.4 | — | — | 2026-09-14 | 2026-09-30 |
| CVE-2026-55253 LangChain MongoDB provides integrations between MongoDB, Atlas, LangChain, and L... |
high | 7.7 | — | — | 2026-09-14 | 2026-09-30 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.