September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,826
Low
527
Severity not reported
2,544
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), apache (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-91106 HP has identified and remediated multiple externally reported vulnerabilities wi... |
critical | 9.8 | — | Hp / linux imaging and printing | 2026-09-16 | 2026-09-21 |
| CVE-2026-91097 HP has identified and remediated multiple externally reported vulnerabilities wi... |
critical | 9.8 | — | Hp / linux imaging and printing | 2026-09-16 | 2026-09-21 |
| CVE-2026-91098 HP has identified and remediated multiple externally reported vulnerabilities wi... |
critical | 9.8 | — | Hp / linux imaging and printing | 2026-09-16 | 2026-09-21 |
| CVE-2026-91099 HP has identified and remediated multiple externally reported vulnerabilities wi... |
critical | 9.8 | — | Hp / linux imaging and printing | 2026-09-16 | 2026-09-21 |
| CVE-2026-91100 HP has identified and remediated multiple externally reported vulnerabilities wi... |
critical | 9.8 | — | Hp / linux imaging and printing | 2026-09-16 | 2026-09-21 |
| CVE-2026-91101 HP has identified and remediated multiple externally reported vulnerabilities wi... |
critical | 9.8 | — | Hp / linux imaging and printing | 2026-09-16 | 2026-09-21 |
| CVE-2026-73456 Under certain circumstances on affected platforms running Arista EOS with gRPC N... |
critical | 10.0 | — | — | 2026-09-16 | 2026-09-17 |
| CVE-2026-68536 Server-Side Request Forgery / Local File Inclusion in Apache MyFace Core. |
critical | 9.8 | — | — | 2026-09-16 | 2026-09-17 |
| CVE-2026-92716 Shuffle through 2.2.1 contains a cross-tenant privilege escalation vulnerability... |
critical | 9.6 | — | — | 2026-09-16 | 2026-09-24 |
| CVE-2026-92717 Covenant through 0.6 registers the CovenantHub SignalR hub without an Authorize... |
critical | 9.1 | — | — | 2026-09-16 | 2026-09-23 |
| CVE-2026-92720 Kubero through 3.1.1 fails to apply authentication guards to the notifications A... |
critical | 9.1 | — | — | 2026-09-16 | 2026-09-24 |
| CVE-2026-51990 An issue in Sogou Sogou Input Method < 16.3.0.3498 (fixed in 16.3.0.3498) allows... |
critical | 9.8 | — | — | 2026-09-16 | 2026-09-22 |
| CVE-2026-92398 A vulnerability was found in Ruijie RG-EW3000GX EW_3.0(1)B11P380. |
critical | 9.1 | — | — | 2026-09-16 | 2026-09-16 |
| CVE-2026-85385 Concrete CMS below 9.5.4 did not validate the user timezone value (uTimezone) on... |
critical | 9.6 | — | Concretecms / concrete cms | 2026-09-16 | 2026-09-21 |
| CVE-2026-76420 A vulnerability in the internal configuration of the Apache JServ Protocol (AJP)... |
critical | 9.0 | — | — | 2026-09-16 | 2026-09-17 |
| CVE-2026-20331 As part of Cisco's ongoing commitment to proactive security and product quality,... |
critical | 9.6 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-20234 As part of Cisco's ongoing commitment to proactive security and product quality,... |
critical | 9.9 | — | Cisco / identity services engine | 2026-09-16 | 2026-09-28 |
| CVE-2026-20305 A vulnerability in the diagnostic tools of Cisco ISE and ISE-PIC could allow an... |
critical | 9.1 | — | — | 2026-09-16 | 2026-09-17 |
| CVE-2026-20306 A vulnerability in the REST API of Cisco ISE and ISE-PIC could allow an authenti... |
critical | 9.1 | — | — | 2026-09-16 | 2026-09-17 |
| CVE-2026-20307 A vulnerability in the web-based management interface of Cisco ISE could allow a... |
critical | 9.9 | — | — | 2026-09-16 | 2026-09-17 |
| CVE-2026-92397 A vulnerability has been found in Ruijie RG-EW3000GX EW_3.0(1)B11P380. |
critical | 9.1 | — | — | 2026-09-16 | 2026-09-16 |
| CVE-2026-90999 Sentry Seer is vulnerable to a multi-stage trust-boundary violation that allows... |
critical | 9.8 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-70416 Dell ObjectScale, versions prior to 4.4.0.0, contains a Deserialization of Untru... |
critical | 9.8 | — | Dell / objectscale | 2026-09-16 | 2026-09-21 |
| CVE-2025-59953 LMDeploy is a toolkit for compressing, deploying, and serving large language mod... |
critical | 9.8 | — | — | 2026-09-16 | 2026-10-14 |
| CVE-2025-43936 Dell ObjectScale, versions prior to ObjectScale 4.4.0.0, contains an Improper Au... |
critical | 9.1 | — | Dell / objectscale | 2026-09-16 | 2026-10-14 |
| CVE-2026-92395 @fastify/proxy-addr is a Fastify plugin that determines a request's client addre... |
critical | 9.1 | — | — | 2026-09-16 | 2026-09-17 |
| CVE-2026-91843 A stack overflow during the unauthenticated login process may allow an attacker... |
critical | 9.8 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-90048 In the Linux kernel, the following vulnerability has been resolved:
fs/ntfs3: f... |
critical | 9.8 | — | — | 2026-09-16 | 2026-10-19 |
| CVE-2026-90049 In the Linux kernel, the following vulnerability has been resolved:
net: skbuff... |
critical | 9.3 | — | — | 2026-09-16 | 2026-10-19 |
| CVE-2026-90038 In the Linux kernel, the following vulnerability has been resolved:
NFSD: Preve... |
critical | 9.8 | — | — | 2026-09-16 | 2026-10-19 |
| CVE-2026-90042 In the Linux kernel, the following vulnerability has been resolved:
ceph: prope... |
critical | 9.8 | — | — | 2026-09-16 | 2026-10-21 |
| CVE-2026-90036 In the Linux kernel, the following vulnerability has been resolved:
NFSD: Preve... |
critical | 9.8 | — | — | 2026-09-16 | 2026-10-21 |
| CVE-2026-90037 In the Linux kernel, the following vulnerability has been resolved:
NFSD: Preve... |
critical | 9.8 | — | — | 2026-09-16 | 2026-10-21 |
| CVE-2026-90011 In the Linux kernel, the following vulnerability has been resolved:
scsi: targe... |
critical | 9.1 | — | — | 2026-09-16 | 2026-10-19 |
| CVE-2026-90012 In the Linux kernel, the following vulnerability has been resolved:
spi: Fix DM... |
critical | 9.8 | — | — | 2026-09-16 | 2026-10-19 |
| CVE-2026-89990 In the Linux kernel, the following vulnerability has been resolved:
ceph: lock... |
critical | 9.8 | — | — | 2026-09-16 | 2026-10-19 |
| CVE-2026-89969 In the Linux kernel, the following vulnerability has been resolved:
nvmet-tcp:... |
critical | 9.8 | — | — | 2026-09-16 | 2026-10-19 |
| CVE-2026-89970 In the Linux kernel, the following vulnerability has been resolved:
nvmet-auth:... |
critical | 9.8 | — | — | 2026-09-16 | 2026-10-19 |
| CVE-2026-89972 In the Linux kernel, the following vulnerability has been resolved:
nvme: add m... |
critical | 9.8 | — | — | 2026-09-16 | 2026-10-21 |
| CVE-2026-89930 In the Linux kernel, the following vulnerability has been resolved:
KVM: nVMX:... |
critical | 9.3 | — | — | 2026-09-16 | 2026-10-19 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.