September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,833
Low
527
Severity not reported
2,537
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), linux (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-80751 In the Linux kernel, the following vulnerability has been resolved:
pmdomain: m... |
high | 7.8 | — | — | 2026-09-03 | 2026-09-04 |
| CVE-2026-80752 In the Linux kernel, the following vulnerability has been resolved:
Input: psxp... |
high | 8.4 | — | — | 2026-09-03 | 2026-09-04 |
| CVE-2026-80741 In the Linux kernel, the following vulnerability has been resolved:
drm/log: Fi... |
high | 7.1 | — | — | 2026-09-03 | 2026-09-04 |
| CVE-2026-80734 In the Linux kernel, the following vulnerability has been resolved:
btrfs: init... |
high | 8.8 | — | — | 2026-09-03 | 2026-10-21 |
| CVE-2026-80735 In the Linux kernel, the following vulnerability has been resolved:
ovpn: ensur... |
high | 7.3 | — | — | 2026-09-03 | 2026-09-04 |
| CVE-2026-80736 In the Linux kernel, the following vulnerability has been resolved:
thunderbolt... |
high | 7.8 | — | — | 2026-09-03 | 2026-09-04 |
| CVE-2026-80737 In the Linux kernel, the following vulnerability has been resolved:
serial: amb... |
high | 7.8 | — | — | 2026-09-03 | 2026-10-16 |
| CVE-2026-80738 In the Linux kernel, the following vulnerability has been resolved:
bpf: Check... |
high | 7.3 | — | — | 2026-09-03 | 2026-10-30 |
| CVE-2026-80731 In the Linux kernel, the following vulnerability has been resolved:
net: remove... |
high | 7.8 | — | — | 2026-09-03 | 2026-10-16 |
| CVE-2026-80732 In the Linux kernel, the following vulnerability has been resolved:
ata: pata_s... |
high | 7.8 | — | — | 2026-09-03 | 2026-09-04 |
| CVE-2026-79679 Use of Weak Credentials vulnerability in B&R Industrial Automation GmbH mapp Aud... |
high | 8.7 | — | — | 2026-09-03 | 2026-09-03 |
| CVE-2026-80465 A vulnerability has been identified in Mendix SAML (Mendix 10 compatible) (All v... |
high | 8.7 | — | — | 2026-09-03 | 2026-10-26 |
| CVE-2026-76642 util-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit st... |
high | 7.8 | — | — | 2026-09-03 | 2026-09-24 |
| CVE-2026-73600 Dell PowerProtect Data Manager, versions 20.2.0.0 and below, contain a stack buf... |
high | 7.8 | — | Dell / powerprotect data manager | 2026-09-03 | 2026-10-14 |
| CVE-2026-71220 A stack out-of-bounds write vulnerability was found in gfs2-utils. |
high | 7.0 | — | Redhat / enterprise linux | 2026-09-03 | 2026-09-22 |
| CVE-2026-71221 A stack out-of-bounds write vulnerability was found in gfs2-utils. |
high | 7.0 | — | Redhat / enterprise linux | 2026-09-03 | 2026-09-22 |
| CVE-2026-3416 The API Publisher component previously used a non-cryptographic pseudorandom num... |
high | 7.5 | — | Wso2 / api control plane | 2026-09-03 | 2026-09-15 |
| CVE-2021-38489 HDD password plaintext is stored in a UEFI variable. |
high | 8.2 | — | — | 2026-09-03 | 2026-09-03 |
| CVE-2026-84851 An uncontrolled recursion issue exists in Amazon Ion-C versions before 1.1.6 tha... |
high | 7.5 | — | — | 2026-09-03 | 2026-09-03 |
| CVE-2026-84394 fast-uri accepts a host that contains an unbalanced or misplaced authority brack... |
high | 7.5 | — | Openjsf / fast-uri | 2026-09-03 | 2026-09-04 |
| CVE-2026-82524 UnoPim before 2.1.5 contains an authenticated file upload vulnerability that all... |
high | 7.2 | — | — | 2026-09-02 | 2026-10-06 |
| CVE-2026-84292 fast-uri serializes the port component of a URI without validating it. |
high | 7.5 | — | Openjsf / fast-uri | 2026-09-02 | 2026-10-06 |
| CVE-2026-78662 Previously, a channel registered in the mux's chanList is not usable until it is... |
high | 7.5 | — | Golang / crypto | 2026-09-02 | 2026-09-04 |
| CVE-2026-56855 Previously, after a channel has been established, a malicious peer could send cr... |
high | 7.5 | — | Golang / crypto | 2026-09-02 | 2026-09-04 |
| CVE-2023-20577 A heap overflow in SMM module may allow an attacker with access to a second vuln... |
high | 7.4 | — | — | 2026-09-02 | 2026-09-04 |
| CVE-2023-20576 Insufficient Verification of Data Authenticity in AGESA™ may allow an attacker t... |
high | 7.7 | — | — | 2026-09-02 | 2026-09-04 |
| CVE-2026-84841 A security flaw has been discovered in tsi-coop tsi-dpdp-cms up to 0.5.0. |
high | 7.3 | — | — | 2026-09-02 | 2026-09-05 |
| CVE-2026-84381 HTTPX2 is a next generation HTTP client for Python. |
high | 8.1 | — | — | 2026-09-02 | 2026-09-09 |
| CVE-2026-84382 HTTPX2 is a next generation HTTP client for Python. |
high | 7.5 | — | — | 2026-09-02 | 2026-09-09 |
| CVE-2026-77125 A vulnerability was identified in Sonatype Nexus Repository 3 in which two blobs... |
high | 7.1 | — | Sonatype / nexus repository manager | 2026-09-02 | 2026-09-22 |
| CVE-2026-77124 In affected versions of Nexus Repository 3, the script execution endpoint (POST... |
high | 7.2 | — | Sonatype / nexus repository manager | 2026-09-02 | 2026-09-22 |
| CVE-2026-49832 DSpace open source software is a repository application which provides durable a... |
high | 8.0 | — | — | 2026-09-02 | 2026-09-09 |
| CVE-2026-82404 TOON is a compact, human-readable serialization of JSON data for LLM prompts. |
high | 8.3 | — | — | 2026-09-02 | 2026-09-09 |
| CVE-2026-79755 Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. |
high | 8.0 | — | — | 2026-09-02 | 2026-09-09 |
| CVE-2026-52831 Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. |
high | 8.0 | — | — | 2026-09-02 | 2026-09-09 |
| CVE-2026-52833 Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. |
high | 8.0 | — | — | 2026-09-02 | 2026-09-09 |
| CVE-2026-53635 Open edX Platform enables the authoring and delivery of online learning at any s... |
high | 7.6 | — | — | 2026-09-02 | 2026-09-09 |
| CVE-2026-45730 Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. |
high | 8.3 | — | — | 2026-09-02 | 2026-09-09 |
| CVE-2026-20277 As part of Cisco's ongoing commitment to proactive security and product quality,... |
high | 8.2 | — | — | 2026-09-02 | 2026-09-18 |
| CVE-2026-20278 As part of Cisco's ongoing commitment to proactive security and product quality,... |
high | 8.8 | — | — | 2026-09-02 | 2026-09-18 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.