September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,826
Low
527
Severity not reported
2,544
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), apache (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-84383 libheif is a HEIF and AVIF file format decoder and encoder. |
critical | 9.8 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-75031 In the interchange/interchange project, a critical remote code execution (RCE) v... |
critical | 9.8 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-61682 kcp is a Kubernetes-like control plane for form-factors and use-cases beyond Kub... |
critical | 9.9 | — | — | 2026-09-18 | 2026-09-24 |
| CVE-2026-10858 IBM MQ for HPE NonStop 8.1.0 through 8.1.0.40 could allow an authenticated attac... |
critical | 9.9 | — | — | 2026-09-18 | 2026-09-19 |
| CVE-2026-10747 IBM MQ Appliance could allow a remote attacker to cause a denial of service or p... |
critical | 10.0 | — | — | 2026-09-18 | 2026-09-21 |
| CVE-2025-53837 XWiki Rendering is a generic rendering system that converts textual input in a g... |
critical | 9.9 | — | — | 2026-09-18 | 2026-10-14 |
| CVE-2026-10027 IBM MQ could allow a remote attacker to cause a denial of service or execute arb... |
critical | 9.8 | — | Ibm / mq | 2026-09-18 | 2026-09-23 |
| CVE-2025-15399 IBM Common Licensing Agent 9.0, Agent 9.0.0.1, Agent 9.0.0.2, ART 9.0, ART 9.0.0... |
critical | 10.0 | — | — | 2026-09-18 | 2026-10-14 |
| CVE-2026-93603 vm2 through 3.12.0 (fixed in 3.12.1) does not correctly handle a nullish `this`... |
critical | 10.0 | — | — | 2026-09-18 | 2026-09-22 |
| CVE-2026-93605 vm2 NodeVM versions before 3.12.1 contain a sandbox escape vulnerability where t... |
critical | 10.0 | — | — | 2026-09-18 | 2026-09-21 |
| CVE-2026-93606 vm2 (npm) versions 3.12.0 and earlier contain a sandbox escape in `VM` and `Node... |
critical | 10.0 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-93019 Imager versions before 1.036 for Perl exit the process reading a TGA with a colo... |
critical | 9.1 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-21806 HCL BigFix Service Management is affected by an Administrative Session Concurren... |
critical | 9.8 | — | Hcltech / bigfix service management | 2026-09-18 | 2026-10-14 |
| CVE-2026-56590 HCL BigFix Service Management is affected by an Unrestricted File Upload vulnera... |
critical | 9.8 | — | Hcltech / bigfix service management | 2026-09-18 | 2026-10-14 |
| CVE-2026-56592 HCL BigFix Service Management is affected by an Improper Authentication validati... |
critical | 9.8 | — | Hcltech / bigfix service management | 2026-09-18 | 2026-10-14 |
| CVE-2026-13684 An improper encoding or escaping of output vulnerability in SCGI in Synology Dis... |
critical | 9.8 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-13639 An insufficient entropy vulnerability in login logic in Synology DiskStation Man... |
critical | 9.8 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-67100 HCL BigFix Service Management is affected by SQL Injection flaw and a Cross-Tena... |
critical | 9.8 | — | Hcltech / bigfix service management | 2026-09-18 | 2026-10-08 |
| CVE-2026-84738 The AF Companion WordPress plugin before 2.2.0 does not validate the type of fil... |
critical | 9.1 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-93467 The OAKlouds developed by HGiga has a Insecure Deserialization vulnerability. |
critical | 9.8 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-85878 Improper authorization in Azure Database for PostgreSQL allows an authorized att... |
critical | 9.9 | — | Microsoft / azure horizondb | 2026-09-18 | 2026-09-25 |
| CVE-2026-69843 Authentication bypass by spoofing in Microsoft Fabric allows an unauthorized att... |
critical | 10.0 | — | Microsoft / fabric | 2026-09-18 | 2026-09-25 |
| CVE-2026-62874 Insufficient verification of data authenticity in Azure Billing allows an unauth... |
critical | 9.8 | — | Microsoft / azure billing | 2026-09-18 | 2026-10-07 |
| CVE-2026-85889 Missing authentication for critical function in Azure AI Foundry allows an unaut... |
critical | 9.8 | — | Microsoft / azure ai foundry | 2026-09-17 | 2026-09-25 |
| CVE-2026-87701 Improper neutralization of special elements in output used by a downstream compo... |
critical | 9.6 | — | Microsoft / azure cosmos db | 2026-09-17 | 2026-09-29 |
| CVE-2026-83944 Improper access control in Azure Logic Apps allows an unauthorized attacker to e... |
critical | 9.1 | — | Microsoft / azure logic apps | 2026-09-17 | 2026-09-25 |
| CVE-2026-70200 Improper limitation of a pathname to a restricted directory ('path traversal') i... |
critical | 9.8 | — | Microsoft / azure logic apps | 2026-09-17 | 2026-09-25 |
| CVE-2026-70009 Improper limitation of a pathname to a restricted directory ('path traversal') i... |
critical | 9.8 | — | Microsoft / azure arc | 2026-09-17 | 2026-09-25 |
| CVE-2026-69865 Authorization bypass through user-controlled key in Microsoft Container Registry... |
critical | 10.0 | — | Microsoft / azure container registry | 2026-09-17 | 2026-09-29 |
| CVE-2026-69399 Azure Arc Elevation of Privilege Vulnerability |
critical | 9.8 | — | Microsoft / azure arc | 2026-09-17 | 2026-09-25 |
| CVE-2026-54734 Prebid Server Java is the Java version of Prebid Server. |
critical | 10.0 | — | — | 2026-09-17 | 2026-09-23 |
| CVE-2026-54767 WeGIA is a web manager for charitable institutions. |
critical | 9.1 | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-73639 Imager::File::PNG versions from 1.003 before 1.004 for Perl write past the end o... |
critical | 9.1 | — | — | 2026-09-17 | 2026-09-22 |
| CVE-2026-54670 WeGIA is a web manager for charitable institutions. |
critical | 9.1 | — | — | 2026-09-17 | 2026-09-23 |
| CVE-2026-93372 Buffer overflow in WebGL in Google Chrome on on Android prior to 153.0.8010.52 a... |
critical | 9.6 | — | Google / chrome | 2026-09-17 | 2026-09-21 |
| CVE-2026-93373 Use after free in Extensions in Google Chrome prior to 153.0.8010.52 allowed a r... |
critical | 9.6 | — | Google / chrome | 2026-09-17 | 2026-09-21 |
| CVE-2026-93374 Use after free in Dawn in Google Chrome on on Android prior to 153.0.8010.52 all... |
critical | 9.6 | — | Google / chrome | 2026-09-17 | 2026-09-21 |
| CVE-2026-54460 OpenReception's appointment booking software provides an end-to-end encrypted ap... |
critical | 9.8 | — | — | 2026-09-17 | 2026-09-30 |
| CVE-2026-45140 Chamilo LMS is an open-source learning management system. |
critical | 9.8 | — | — | 2026-09-17 | 2026-09-24 |
| CVE-2026-45143 Chamilo LMS is an open-source learning management system. |
critical | 9.0 | — | — | 2026-09-17 | 2026-09-29 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.