September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,833
Low
527
Severity not reported
2,537
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), linux (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-85451 MOOS core-moos through 10.4.0 contains a remote process termination vulnerabilit... |
high | 7.1 | — | Themoos / core-moos | 2026-09-03 | 2026-10-14 |
| CVE-2026-85452 MOOS ui-moos through 50b9c6c contains a buffer overflow vulnerability in ScopeTa... |
high | 8.8 | — | — | 2026-09-03 | 2026-09-08 |
| CVE-2026-85455 MOOS core-moos through 10.4.0 contains a buffer over-read vulnerability in CMOOS... |
high | 8.2 | — | Themoos / core-moos | 2026-09-03 | 2026-10-14 |
| CVE-2026-85443 MOOS core-moos through 10.4.0 contains a denial of service vulnerability in MOOS... |
high | 7.5 | — | Themoos / core-moos | 2026-09-03 | 2026-10-14 |
| CVE-2026-85444 MOOS-IvP through 24.8.1 contains a buffer over-read vulnerability in isQuoted(),... |
high | 7.5 | — | Mit / moos-ivp | 2026-09-03 | 2026-10-14 |
| CVE-2026-85445 MOOS-IvP through 24.8.1 contains a denial of service vulnerability in the Demuxe... |
high | 7.5 | — | Mit / moos-ivp | 2026-09-03 | 2026-10-14 |
| CVE-2026-85446 MOOS-IvP versions through 24.8.1 contain a quadratic processing vulnerability in... |
high | 7.5 | — | Mit / moos-ivp | 2026-09-03 | 2026-10-14 |
| CVE-2026-85447 MOOS-IvP pRealm through version 24.8.1 accepts unbounded REALMCAST_REQ subscript... |
high | 7.5 | — | Mit / moos-ivp | 2026-09-03 | 2026-10-14 |
| CVE-2026-85448 MOOS-IvP uFldShoreBroker through 24.8.1 fails to limit the number of claimed com... |
high | 7.5 | — | Mit / moos-ivp | 2026-09-03 | 2026-10-14 |
| CVE-2026-85449 MOOS-IvP pMarineViewer through 24.8.1 fails to limit the number of tracked node... |
high | 7.5 | — | Mit / moos-ivp | 2026-09-03 | 2026-10-14 |
| CVE-2026-85439 MOOS-IvP through 24.8.1 contains a remote code execution vulnerability in alogsp... |
high | 7.8 | — | Mit / moos-ivp | 2026-09-03 | 2026-10-14 |
| CVE-2026-85441 MOOS core-moos through 10.4.0 fails to validate that serialized string lengths a... |
high | 7.5 | — | Themoos / core-moos | 2026-09-03 | 2026-10-14 |
| CVE-2026-85442 MOOS core-moos through 10.4.0 fails to validate packet length declarations in CM... |
high | 7.5 | — | Themoos / core-moos | 2026-09-03 | 2026-10-14 |
| CVE-2026-85431 MOOS essential-moos through version 10.0.1 contains an unauthenticated UDP packe... |
high | 7.5 | — | Themoos / essential-moos | 2026-09-03 | 2026-10-14 |
| CVE-2026-85432 MOOS core-moos through 10.4.0 fails to validate client identity in MOOSDB messag... |
high | 8.2 | — | Themoos / core-moos | 2026-09-03 | 2026-10-14 |
| CVE-2026-85436 MOOS essential-moos through 10.0.1 contains a buffer overflow vulnerability in C... |
high | 7.5 | — | Themoos / essential-moos | 2026-09-03 | 2026-10-14 |
| CVE-2026-85429 MOOS-IvP uFldNodeComms through 24.8.1 trusts the source node identity from the m... |
high | 7.5 | — | Mit / moos-ivp | 2026-09-03 | 2026-10-14 |
| CVE-2026-70178 Missing authorization in Microsoft Fabric allows an authorized attacker to eleva... |
high | 8.8 | — | Microsoft / fabric | 2026-09-03 | 2026-09-08 |
| CVE-2026-85225 A vulnerability was identified in code-projects Doctor Appointment System 1.0. |
high | 7.3 | — | — | 2026-09-03 | 2026-09-05 |
| CVE-2026-85378 A vulnerability was identified in light0011 cms c774dce31c6df0055568a8d5c53d964d... |
high | 7.3 | — | — | 2026-09-03 | 2026-09-11 |
| CVE-2026-62906 Improper neutralization of special elements in data query logic in Microsoft Dis... |
high | 7.4 | — | Microsoft / discovery studio | 2026-09-03 | 2026-10-14 |
| CVE-2026-69857 Authorization bypass through user-controlled key in Azure Cosmos DB allows an au... |
high | 8.8 | — | Microsoft / azure cosmos db | 2026-09-03 | 2026-09-09 |
| CVE-2026-64197 There is an out-of-bounds write vulnerability in DASYLab due to improper validat... |
high | 7.3 | — | Ni / dasylab | 2026-09-03 | 2026-09-22 |
| CVE-2026-64198 There is an out-of-bounds read vulnerability in DASYLab due to improper validati... |
high | 7.3 | — | Ni / dasylab | 2026-09-03 | 2026-09-22 |
| CVE-2026-64199 There is an out-of-bounds read vulnerability in DASYLab due to improper validati... |
high | 7.3 | — | Ni / dasylab | 2026-09-03 | 2026-09-22 |
| CVE-2026-64200 There is an out-of-bounds read vulnerability in DASYLab due to improper validati... |
high | 7.3 | — | Ni / dasylab | 2026-09-03 | 2026-09-22 |
| CVE-2026-64195 There is an out-of-bounds write vulnerability in DASYLab due to lack of proper v... |
high | 7.3 | — | Ni / dasylab | 2026-09-03 | 2026-09-22 |
| CVE-2026-64196 There is an out-of-bounds write vulnerability in DASYLab due to improper validat... |
high | 7.3 | — | Ni / dasylab | 2026-09-03 | 2026-09-22 |
| CVE-2026-8862 IBM Netezza Software 11.3.0.3 through Interim Fix 002 has credentials that are h... |
high | 7.5 | — | Ibm / netezza performance server | 2026-09-03 | 2026-09-10 |
| CVE-2026-85208 A security flaw has been discovered in itsourcecode Online Medicine Delivery Sys... |
high | 7.3 | — | — | 2026-09-03 | 2026-09-04 |
| CVE-2026-82520 parsedmarc before 11.0.1 decompresses gzip and ZIP attachments in a single unbou... |
high | 7.5 | — | — | 2026-09-03 | 2026-09-24 |
| CVE-2026-63376 toml-node is a TOML parser for Node.js and the browser. |
high | 8.2 | — | — | 2026-09-03 | 2026-09-09 |
| CVE-2026-77465 toml-node is a TOML parser for Node.js and the browser. |
high | 7.5 | — | — | 2026-09-03 | 2026-09-09 |
| CVE-2026-85053 Improper resource exposure in CacheStorage in Google Chrome prior to 152.0.7977.... |
high | 8.8 | — | Google / chrome | 2026-09-03 | 2026-09-08 |
| CVE-2026-85051 Type confusion in Compositing in Google Chrome prior to 152.0.7977.82 allowed a... |
high | 8.8 | — | Google / chrome | 2026-09-03 | 2026-09-08 |
| CVE-2026-85048 Use after free in Compositing in Google Chrome prior to 152.0.7977.82 allowed a... |
high | 8.3 | — | Google / chrome | 2026-09-03 | 2026-09-08 |
| CVE-2026-85049 Use after free in Skia in Google Chrome prior to 152.0.7977.82 allowed a remote... |
high | 8.8 | — | Google / chrome | 2026-09-03 | 2026-09-08 |
| CVE-2026-85046 Google Chromium V8 Type Confusion Vulnerability |
high | 8.8 | Listed | Google / Chromium V8 | 2026-09-03 | 2026-09-21 |
| CVE-2026-85045 Race condition in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote at... |
high | 7.5 | — | Google / chrome | 2026-09-03 | 2026-09-08 |
| CVE-2026-82527 R2R through 3.6.6 contains a SQL injection vulnerability that allows unauthentic... |
high | 7.5 | — | — | 2026-09-03 | 2026-09-23 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.