September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,833
Low
527
Severity not reported
2,537
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), linux (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-79575 The JWT signing secret in yfexam-exam v2.0 is derived from the username and the... |
high | 7.5 | — | — | 2026-09-08 | 2026-09-09 |
| CVE-2026-7476 Use After Free vulnerability in Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valha... |
high | 7.8 | — | — | 2026-09-08 | 2026-09-10 |
| CVE-2026-7477 Use After Free vulnerability in Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valha... |
high | 7.8 | — | — | 2026-09-08 | 2026-09-10 |
| CVE-2026-78837 A SQL injection vulnerability in the ap_form_{id} parameter in AppNitro MachForm... |
high | 7.5 | — | — | 2026-09-08 | 2026-09-09 |
| CVE-2026-5729 Use After Free vulnerability in Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5... |
high | 7.8 | — | — | 2026-09-08 | 2026-09-10 |
| CVE-2026-61517 Netis NX10 firmware V4.0.1.5808 and V3.0.0.4142 contain an OS command injection... |
high | 7.2 | — | — | 2026-09-08 | 2026-09-10 |
| CVE-2026-18851 Missing authorization in Ivanti Endpoint Manager Mobile before version 12.10.0.0... |
high | 8.8 | — | Ivanti / endpoint manager mobile | 2026-09-08 | 2026-09-09 |
| CVE-2026-12645 A Missing Authorization vulnerability in Ivanti Neurons for ITSM before 2026.2 a... |
high | 8.8 | — | Ivanti / neurons for itsm | 2026-09-08 | 2026-09-18 |
| CVE-2026-12646 A Missing Authorization vulnerability in Ivanti Neurons for ITSM before 2026.2 a... |
high | 8.8 | — | Ivanti / neurons for itsm | 2026-09-08 | 2026-09-18 |
| CVE-2026-12647 A Missing Authorization vulnerability in Ivanti Neurons for ITSM before 2026.2 a... |
high | 8.8 | — | Ivanti / neurons for itsm | 2026-09-08 | 2026-09-18 |
| CVE-2026-12648 A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM bef... |
high | 8.8 | — | Ivanti / neurons for itsm | 2026-09-08 | 2026-09-18 |
| CVE-2026-12650 A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM bef... |
high | 8.8 | — | Ivanti / neurons for itsm | 2026-09-08 | 2026-09-18 |
| CVE-2026-12651 A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM bef... |
high | 8.8 | — | Ivanti / neurons for itsm | 2026-09-08 | 2026-09-18 |
| CVE-2026-0860 Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Arm... |
high | 7.5 | — | — | 2026-09-08 | 2026-09-10 |
| CVE-2026-79376 An issue in the l2cap_handle_data() function of Bestechnic Co., Ltd BES2300 Blue... |
high | 8.8 | — | — | 2026-09-08 | 2026-09-09 |
| CVE-2026-79377 A heap overflow in the a2dp_decoder_sbc.cpp component of Bestechnic Co., Ltd BES... |
high | 7.5 | — | — | 2026-09-08 | 2026-09-09 |
| CVE-2026-79378 An issue in the btm_acl_handle() function of Bestechnic Co., Ltd BES2300 Bluetoo... |
high | 7.5 | — | — | 2026-09-08 | 2026-09-09 |
| CVE-2026-74239 XenForo before 2.3.13 contains a path traversal vulnerability in the style archi... |
high | 7.2 | — | Xenforo / xenforo | 2026-09-08 | 2026-09-11 |
| CVE-2026-73311 XenForo before 2.3.13 contains an OAuth2 authorization code reuse vulnerability... |
high | 7.4 | — | Xenforo / xenforo | 2026-09-08 | 2026-09-11 |
| CVE-2026-73312 XenForo before 2.3.13 contains a refresh token replay vulnerability that allows... |
high | 7.4 | — | Xenforo / xenforo | 2026-09-08 | 2026-09-11 |
| CVE-2026-73313 XenForo before 2.3.13 contains a multi-factor authentication bypass vulnerabilit... |
high | 8.1 | — | Xenforo / xenforo | 2026-09-08 | 2026-09-14 |
| CVE-2026-73314 XenForo before 2.3.13 contains a signature verification logic error in the PayPa... |
high | 7.5 | — | Xenforo / xenforo | 2026-09-08 | 2026-09-11 |
| CVE-2026-73315 XenForo before 2.3.13 contains a server-side request forgery vulnerability in th... |
high | 8.6 | — | Xenforo / xenforo | 2026-09-08 | 2026-09-11 |
| CVE-2026-73316 XenForo before 2.3.13 contains a payment replay vulnerability in the PayPal REST... |
high | 7.5 | — | Xenforo / xenforo | 2026-09-08 | 2026-09-11 |
| CVE-2026-33388 An access control vulnerability was discovered in the Credentials Manager functi... |
high | 7.4 | — | — | 2026-09-08 | 2026-10-15 |
| CVE-2026-33389 An improper certificate/host key validation vulnerability was discovered in the... |
high | 7.5 | — | — | 2026-09-08 | 2026-10-15 |
| CVE-2026-79602 A guest with a PCI device assigned that has at least a BAR on the IO port
space... |
high | 8.8 | — | — | 2026-09-08 | 2026-09-10 |
| CVE-2026-77103 CommServe contained an authentication bypass issue affecting access authorizatio... |
high | 7.5 | — | Commvault / commvault | 2026-09-08 | 2026-09-09 |
| CVE-2026-77104 CommServe contained a path traversal issue affecting information disclosure. |
high | 7.5 | — | Commvault / commvault | 2026-09-08 | 2026-09-09 |
| CVE-2026-77105 CommServe contained a cryptographic signature verification issue affecting privi... |
high | 8.8 | — | Commvault / commvault | 2026-09-08 | 2026-09-09 |
| CVE-2026-77106 Cvlaunchd contained a missing authorization issue affecting command execution au... |
high | 8.8 | — | Commvault / commvault | 2026-09-08 | 2026-09-11 |
| CVE-2026-77091 DataCube contained a path traversal issue affecting security feature enforcement... |
high | 7.8 | — | Commvault / commvault | 2026-09-08 | 2026-09-11 |
| CVE-2026-77097 Private Metrics Server contained a missing authentication condition affecting me... |
high | 8.2 | — | Commvault / commvault | 2026-09-08 | 2026-09-11 |
| CVE-2026-77101 CommServe contained a stack-based buffer overflow issue affecting service availa... |
high | 7.5 | — | Commvault / commvault | 2026-09-08 | 2026-09-09 |
| CVE-2026-77102 CommServe contained a heap-based buffer overflow issue affecting service availab... |
high | 7.5 | — | Commvault / commvault | 2026-09-08 | 2026-09-09 |
| CVE-2026-75021 fastify-cli starts the Node.js Inspector when a debug flag is used, but it ignor... |
high | 8.1 | — | — | 2026-09-08 | 2026-09-08 |
| CVE-2026-86713 PX4 Autopilot through 1.17.0 contains a use-after-free vulnerability in the load... |
high | 7.1 | — | — | 2026-09-08 | 2026-09-08 |
| CVE-2026-77968 A flaw was found in hawtio-operator. |
high | 8.2 | — | — | 2026-09-08 | 2026-09-08 |
| CVE-2026-86711 electerm before 5.3.15 exposes 40+ main-process functions through an unvalidated... |
high | 7.4 | — | — | 2026-09-08 | 2026-09-08 |
| CVE-2026-86712 SiYuan before 3.8.2 trusts the attacker-writable text/siyuan clipboard MIME type... |
high | 8.8 | — | — | 2026-09-08 | 2026-09-10 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.