September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,826
Low
527
Severity not reported
2,544
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), apache (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-89914 In the Linux kernel, the following vulnerability has been resolved:
KVM: arm64:... |
critical | 9.3 | — | — | 2026-09-16 | 2026-10-19 |
| CVE-2026-89915 In the Linux kernel, the following vulnerability has been resolved:
KVM: arm64:... |
critical | 9.3 | — | — | 2026-09-16 | 2026-10-19 |
| CVE-2026-89916 In the Linux kernel, the following vulnerability has been resolved:
KVM: arm64:... |
critical | 9.3 | — | — | 2026-09-16 | 2026-10-19 |
| CVE-2026-89918 In the Linux kernel, the following vulnerability has been resolved:
KVM: arm64:... |
critical | 9.3 | — | — | 2026-09-16 | 2026-10-19 |
| CVE-2026-89857 In the Linux kernel, the following vulnerability has been resolved:
scsi: qla2x... |
critical | 9.8 | — | — | 2026-09-16 | 2026-10-19 |
| CVE-2026-89846 In the Linux kernel, the following vulnerability has been resolved:
scsi: qla2x... |
critical | 9.1 | — | — | 2026-09-16 | 2026-10-19 |
| CVE-2026-89847 In the Linux kernel, the following vulnerability has been resolved:
scsi: qla2x... |
critical | 9.8 | — | — | 2026-09-16 | 2026-10-19 |
| CVE-2026-86106 An unauthenticated actor with network access to the private HA interconnect may... |
critical | 9.6 | — | — | 2026-09-16 | 2026-09-16 |
| CVE-2026-73453 An unauthenticated P4Runtime (Programming Protocol-Independent Packet Processors... |
critical | 10.0 | — | — | 2026-09-16 | 2026-09-17 |
| CVE-2026-76186 Apache Airflow Keycloak provider: from Airflow 3.3 the Keycloak auth manager tak... |
critical | 9.1 | — | Apache / apache-airflow-providers-keycloak | 2026-09-16 | 2026-09-18 |
| CVE-2026-76187 Apache Airflow Keycloak provider: the unauthenticated token endpoint accepts a c... |
critical | 9.8 | — | Apache / apache-airflow-providers-keycloak | 2026-09-16 | 2026-09-18 |
| CVE-2026-89786 In the Linux kernel, the following vulnerability has been resolved:
ext4: fix o... |
critical | 9.1 | — | — | 2026-09-16 | 2026-10-19 |
| CVE-2026-89788 In the Linux kernel, the following vulnerability has been resolved:
ksmbd: fix... |
critical | 9.8 | — | — | 2026-09-16 | 2026-10-21 |
| CVE-2026-89778 In the Linux kernel, the following vulnerability has been resolved:
isofs: fix... |
critical | 9.8 | — | — | 2026-09-16 | 2026-10-19 |
| CVE-2026-89779 In the Linux kernel, the following vulnerability has been resolved:
fs/ntfs3: v... |
critical | 9.1 | — | — | 2026-09-16 | 2026-10-19 |
| CVE-2026-89783 In the Linux kernel, the following vulnerability has been resolved:
xfrm6: fix... |
critical | 9.8 | — | — | 2026-09-16 | 2026-10-19 |
| CVE-2026-86462 Apache Airflow FAB provider: changing a user's password through the Admin user-e... |
critical | 9.1 | — | Apache / apache-airflow-providers-fab | 2026-09-16 | 2026-09-18 |
| CVE-2026-89775 In the Linux kernel, the following vulnerability has been resolved:
KVM: arm64:... |
critical | 9.3 | — | — | 2026-09-16 | 2026-10-19 |
| CVE-2026-81642 In NLnet Labs Unbound up to and including 1.26.0, a vulnerability was found in t... |
critical | 9.8 | — | Nlnetlabs / unbound | 2026-09-16 | 2026-09-22 |
| CVE-2026-82311 Apache Airflow FAB provider: resetting a user's password does not delete that us... |
critical | 9.8 | — | Apache / apache-airflow-providers-fab | 2026-09-16 | 2026-09-18 |
| CVE-2026-82717 In NLnet Labs Unbound up to and including 1.26.0, a vulnerability was found in t... |
critical | 9.8 | — | Nlnetlabs / unbound | 2026-09-16 | 2026-09-23 |
| CVE-2026-27565 An unauthenticated remote attacker can upload a malicious IODD file that places... |
critical | 9.8 | — | — | 2026-09-16 | 2026-09-16 |
| CVE-2026-27546 An unauthenticated remote attacker can exploit an authentication bypass in the _... |
critical | 9.8 | — | — | 2026-09-16 | 2026-09-16 |
| CVE-2026-73447 A privileged attacker can exploit certain operation to execute arbitrary command... |
critical | 9.1 | — | — | 2026-09-16 | 2026-09-17 |
| CVE-2026-14349 The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress i... |
critical | 9.8 | — | — | 2026-09-16 | 2026-09-16 |
| CVE-2026-12793 The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnera... |
critical | 9.8 | — | — | 2026-09-16 | 2026-09-17 |
| CVE-2026-81855 A hardcoded cryptographic client authentication key vulnerability exists in the... |
critical | 9.1 | — | — | 2026-09-15 | 2026-09-24 |
| CVE-2026-78225 A hardcoded cryptographic server key vulnerability exists in the deployer-ng Upd... |
critical | 9.0 | — | — | 2026-09-15 | 2026-09-24 |
| CVE-2026-61560 `@zereight/mcp-gitlab` is a Model Context Protocol server for GitLab. |
critical | 9.8 | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-73437 On affected platforms running Arista EOS with Dynamic Host Configuration Protoco... |
critical | 9.6 | — | — | 2026-09-15 | 2026-09-17 |
| CVE-2026-73807 The mySCADA myPRO Manager command API does not properly enforce authentication f... |
critical | 9.8 | — | — | 2026-09-15 | 2026-09-18 |
| CVE-2026-91749 Use after free in Workers in Google Chrome prior to 153.0.8010.47 allowed a remo... |
critical | 9.6 | — | Google / chrome | 2026-09-15 | 2026-09-24 |
| CVE-2026-91939 Cotonti 1.0.0 Comments plugin passes the ci GET parameter to unserialize() witho... |
critical | 9.8 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-91738 Improper input validation in ANGLE in Google Chrome prior to 153.0.8010.47 allow... |
critical | 9.6 | — | Google / chrome | 2026-09-15 | 2026-09-17 |
| CVE-2026-91728 Integer overflow in V8 in Google Chrome prior to 153.0.8010.47 allowed a remote... |
critical | 9.6 | — | Google / chrome | 2026-09-15 | 2026-09-17 |
| CVE-2026-91729 Use after free in DigitalCredentials in Google Chrome prior to 153.0.8010.47 all... |
critical | 9.6 | — | Google / chrome | 2026-09-15 | 2026-09-17 |
| CVE-2026-91716 Use after free in Auth in Google Chrome prior to 153.0.8010.47 allowed a remote... |
critical | 9.6 | — | Google / chrome | 2026-09-15 | 2026-09-17 |
| CVE-2026-91718 Use after free in Core in Google Chrome prior to 153.0.8010.47 allowed a remote... |
critical | 9.6 | — | Google / chrome | 2026-09-15 | 2026-09-17 |
| CVE-2026-91710 Use after free in WebAppInstalls in Google Chrome prior to 153.0.8010.47 allowed... |
critical | 9.6 | — | Google / chrome | 2026-09-15 | 2026-09-17 |
| CVE-2026-66890 The affected products use hard-coded credentials, which could allow remote acces... |
critical | 9.6 | — | — | 2026-09-15 | 2026-09-18 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.